PIX: Static statement required for no NAT?
Posted on 2002-04-28
I have traditionally done two things to make the pix work without nat. One is to set up a NAT 0 process. And secondly I have put in a static statement to say that the addresses inside should be represented as themselves outside. For example...
nat (inside) 0 10.0.0.0 255.0.0.0 0 0
static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.0.0 0 0
...this to define packets leaving inside for the dmz to retain their 10.* address as they egress the dmz port. This combination seemed to solve a problem I had once with trying to have the packets reach the DMZ from inside. But lately I found a fly in the ointment with this (has to do with multi-tiered pixen and non-natting - a long story for another day.) My question is - is my static statement necessary? Should the fact that I have a nat (inside) 0 process obviate the need to have such a static?