CISCO PIX PAT and NAT

[tiredadmin]

New to Cisco PIX. PIX is currently configured to PAT all internal addresses to single public.

From config:

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

I need to NAT a single specific internal address to a specific outside address. Basically an exception for one system. I have done a lot of searching and reading but cannot find a clear example of this. Any help would be appreciated.

 

[BuckWeet]

The only way you can do this is implement access lists on the NAT statements..

Unfortunately you cannot do an access-list with deny statement for that particular IP and then do a permit any any for the remaining..

Once you setup the ACL, you apply it to the NAT statments.. To match the particular IP to an outside IP, you need to create a new NAT process..


BuckWeet

 

[Supergrrover]

Try a static -
static (inside,outside) ext.ern.al.ip int.ern.al.ip netmask 255.255.255.255
Statics override nat/global statements and it creates a permanent one-to-one mapping.

You can also do policy nat as buckweet suggested. The policy nat statements (nat with an ACL) also take precedence.

http://www.cisco.com/en/US/products...s_configuration_example09186a008046f31a.shtml

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807d2874.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[tiredadmin]

Thanks Buckwheat and Brent,
Brent, I think the static is what I was looking for but I am confused about the syntax and here is why. In my config (inherited) I have several working static statements already that do NATs for external to internal addresses.

static (inside,outside) xx.xxx.xxx.xxx 192.168.21.138 netmask 255.255.255.255 0 0

Am I to understand that the syntax is the same for outgoing connections? I guess I am surprised the statement or addresses are not flipped around.

 

[Supergrrover]

When you have it so that you are using ports in the statement it behaves differently, but when it is only the IP I believe it just ties the two together - inbound and outbound. It is how a TAC fixed a reverse DNS lookup error on a client's mail server who had port mapping only and we changed it to a full static and all of a sudden it worked without changing the DNS MX record.
Let me know how it works out.
To test - put in the full static and do an IP lookup on a website from the internal box and see what it reports.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[FWHATER]

Shouldn't there be an actual access-list, something like:

access-list acl permit tcp host x.x.x.x host x.x.x.x eq xx
access-group acl in interface outside

then

nat (inside) 2 access-list acl

I'm not sure if there are any access lists in his config, nor is there interface that it is applied to.

I could be wrong....