Static 1

[bobm10]

Hello All,

Is this a true statement?

An interface on the pix cannot access another interface unless a NAT or
static is put in place.

For Example, I have a 515e with 6 interfaces. I set up a webserver (192.168.4.100) on Dmz2. We could not access the server at all from inside until we added the following static:

static (inside,dmz2) 192.168.3.0 192.168.3.0 netmask 255.255.255.0 0 0 {.3.0 is inside}

We did have this in the config:
access-list In_inside permit ip any host 209.27.100.100
alias (inside) 209.27.100.100 192.168.4.100 255.255.255.255

Bob

 

[themut]

When you go from a high security level to a lower security level, then by default you don't need to open any holes (you don't need an access list), but you still need a translation either static or dynamic translation. In you case you used a static translation but you could've also use a dynamic one:

nat (inside) 2 0.0.0.0 0.0.0.0
global (dmz2) 2 interface