Static Translation
in [Cisco]
|
From: Darren Green on 16 Sep 2006 14:28 I have an urgent PIX Change to do. I have been asked to add a static translation to a PIX. I have a public range on the outside of the PIX which has been further subnetted to give me public addresses on the inside as well. The public addresses on the outside have all been used with various static (inside,outside) translations for LAN hosts which are reachable via a next hop router on the inside Interface of the PIX. The inside public address of the PIX also has a number of static translations, these have the affect of natting the inside public addresses to themsleves, so that it is unchanged on the outside of the Firewall. I need to translate a new LAN host behind my inside router. As my Public addresses on the outside of the PIX are all used, can I use one of the Public addresses on the inside interface ? I don't believe I can but any urgent clarification would be really appreciated. My network Public Interface (Public Range - no more addresses left) | | PIX | | Inside Interface (Public Range Subnetted from Outside Range Above - 2/3 addresses left) | | Inside Router | | LAN Host I need to translate
From: Walter Roberson on 16 Sep 2006 18:37 In article <9NGdnXzef4H335HYRVnytg(a)bt.com>, Darren Green <darrenfgreen(a)XXnospamXXbtopenworld.com> wrote: >I have an urgent PIX Change to do. >The inside public address of the PIX also has a number of static >translations, these have the affect of natting the inside public addresses >to themsleves, so that it is unchanged on the outside of the Firewall. >I need to translate a new LAN host behind my inside router. As my Public >addresses on the outside of the PIX are all used, can I use one of the >Public addresses on the inside interface ? >Public Interface (Public Range - no more addresses left) >| >PIX >| >Inside Interface (Public Range Subnetted from Outside Range Above - 2/3 >addresses left) >| >Inside Router >| >LAN Host I need to translate Yes, if you have an available address in the public range you use on the inside, then you have no problem. If the IP address of the new host is in the public range, then just follow exactly the same way as for the existing public range. If the IP address of the new host is in a different range, then just static (inside,outside) PUBLICIP INSIDEIP netmask 255.255.255.255 and then in your access-list for the outside interface, refer to the PUBLICIP. In this situation, you -might- need to route inside INSIDEIP 255.255.255.255 INSIDEROUTERIP if you do not already have a route that moves that interior address range towards the router.
From: Darren Green on 17 Sep 2006 02:24 "Walter Roberson" <roberson(a)hushmail.com> wrote in message news:E0%Og.543669$Mn5.220050(a)pd7tw3no... > In article <9NGdnXzef4H335HYRVnytg(a)bt.com>, > Darren Green <darrenfgreen(a)XXnospamXXbtopenworld.com> wrote: >>I have an urgent PIX Change to do. > >>The inside public address of the PIX also has a number of static >>translations, these have the affect of natting the inside public addresses >>to themsleves, so that it is unchanged on the outside of the Firewall. > >>I need to translate a new LAN host behind my inside router. As my Public >>addresses on the outside of the PIX are all used, can I use one of the >>Public addresses on the inside interface ? > >>Public Interface (Public Range - no more addresses left) >>| >>PIX >>| >>Inside Interface (Public Range Subnetted from Outside Range Above - 2/3 >>addresses left) >>| >>Inside Router >>| >>LAN Host I need to translate > > Yes, if you have an available address in the public range you > use on the inside, then you have no problem. If the IP address of the > new host is in the public range, then just follow exactly the same > way as for the existing public range. If the IP address of the new > host is in a different range, then just > > static (inside,outside) PUBLICIP INSIDEIP netmask 255.255.255.255 > > and then in your access-list for the outside interface, refer to > the PUBLICIP. In this situation, you -might- need to > > route inside INSIDEIP 255.255.255.255 INSIDEROUTERIP > > if you do not already have a route that moves that interior address > range towards the router. Thank you Walter. Regards Darren
|
Pages: 1 Prev: DNS Issue over Site -Site VPN Tunnel. Next: ssh configuration |