PAT on PIX with 2 internal networks

Discussion in 'Cisco' started by jeffrey_collins, Oct 3, 2006.

  1. I'm trying to setup PAT for another internal network. Currently the and networks are behind our pix firewall
    (actually there is a router to handle each subnet).

    When someone tries to access the web from the network, if I
    do a sh capture <capture name> it shows the address
    correctly translated to the outside address of the pix (for example Everything works fine.

    However, on the network, it doesn't work. Their default
    route is to send it to the router at, and then it routes
    it to the address on the pix. However, if I watch the
    capture on the outside interface, it always shows the traffic leaving
    with the IP of 192.168.8.x, instead of using the outside IP. So, I
    know it's getting to and leaving the pix, just using the wrong address.
    I'm trying to figure out why it's not translating it for that subnet.

    Here are some lines from my config that may be relevant. Would
    appreciate any help...

    PIX Version 6.3(3)
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    access-list inside permit ip any
    access-list inside permit ip any
    ip address outside
    ip address inside
    global (outside) 1 interface
    global (dmz) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 0 0
    static (inside,outside) netmask 0
    access-group outside in interface outside
    access-group inside in interface inside
    route outside 1
    route inside 1
    jeffrey_collins, Oct 3, 2006
    1. Advertisements

  2. You need to modify your config:

    no static (inside,outside) netmask

    or its' better to configure:

    no static (inside,outside) netmask
    no nat (inside) 1 0 0

    nat (inside) 1 access-list pat_inside_vs_out 0 0
    access-list pat_inside_vs_out permit ip any
    access-list pat_inside_vs_out permit ip any
    Roberto Taccon, Oct 3, 2006
    1. Advertisements

  3. That did the trick. Thanks.


    jeffrey_collins, Oct 3, 2006
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.