Network Address Translation

Hi,

I would apreciate if someone could help me with this (ridiculous?)
question:

In order for a packet to make use of a destination address translation
is it necessary to reach the pix through the interface where the
virtual address is defined?

Thank you very much,

Fabio Maia.

 

:I would apreciate if someone could help me with this (ridiculous?)
:question:

:In order for a packet to make use of a destination address translation
:is it necessary to reach the pix through the interface where the
:virtual address is defined?

Almost, but...

Modern address translation on the PIX can be specified via the 'static' command
or via the 'nat' command (I'm leaving out conduit/outbound and kin.)

The 'static' command is interface specific: the command itself names
the interfaces it applies between.

The traditional 'nat' command only applied when connections were formed
from the inside to the outside, and did not allow new connections to be
formed from the outside to the inside.

In PIX 6.0, Cisco added a new form of 'nat', 'nat (inside) 0 access-list XXX'.
Traffic matched by the access-list could be said to have NAT "turned off"
[no matter which interface the traffic was to!], or it could be said
that NAT was still active but that the identity address translation is
being done. Incoming traffic that matches the nat 0 access-list IS
allowed to form connections from the outside to the inside. Thus, one can
"make use of" the 'null' destination address translation even though
the translation has been defined without explicit reference to the
outside interface.

Fun with semantics...

 

Ok, Walter. So to perform a real destination address replacement (no
identity) the packet MUST get into the pix through the external
interface specified in the static command.

Thank you very much for your time.