Cisco PIX NAT and static inside/outside from internal IP's

Posted on 2004-04-20
Medium Priority
Last Modified: 2013-11-16
My Cisco PIX 501 OS version 6.2(2) is ip outside X.242 and inside  I want to forward traffic to X.242 (the PIX itself) Port 80 to an internal server (Historical reasons).  I’ve use the following config and everything words fine. Everybody can connect to the Internet and the Internet can use the port forward.  But the internal people cannot connect to the port forward.

From inside the following does NOT work:  “telnet 196.X.X.242 80”

Extract of my config:
ip address outside 196.X.X.242
ip address inside
access-list 100 permit ip any
access-group 100 in interface inside
access-list 101 permit icmp any any
access-list 101 permit tcp any host 196.X.X.242 eq www
access-group 101 in interface outside
global (outside) 1 interface
nat (inside) 1 0 0
static (inside,outside) tcp 196.X.X.242 80 80 netmask 0 0
route outside 196.X.X.241 1

I think the PIX do not do the NAT for internal IP, to the port forward.  Does anybody have any tips?

Question by:louwtjie
  • 2

Accepted Solution

hawgpig earned 1000 total points
ID: 10873438
Try this....
static (inside,outside) tcp interface 80 80 dns netmask 0 0
Instead of this...
static (inside,outside) tcp 196.X.X.242 80 80 netmask 0 0
do a
clear x
and a
clear arp

The word interface should be substituted for the outside IP Address and add the "DNS" just before the word netmask and it will do the DNS doctoring...
This of course assumes you are using an external DNS

Good Luck....
LVL 23

Expert Comment

by:Tim Holman
ID: 10878379
Also look at the alias command.  I don't think the 'DNS' entry will work on anything bar PIX 6.3 ?
The following command will work with your config, as you already have access lists and static nat setup:

alias (inside) 196.x.x.242

More info - http://www.cisco.com/warp/public/110/alias.html


Author Comment

ID: 10880416
After getting the first solution, I read up more on DNS on Cisco and also noted that the first option should not work on that “old” OS, but it did.

The DNS option translate the DNS requires from the inside to an outside server very nicely by reporting the internal IP number


Expert Comment

ID: 10883926
Just to let you guys know this was actually started in 6.2(2)....It was not well published.....I actually started working for cisco just before 6.2(2) came out......the DNS statement on the static will work in 6.2(2).
Right, it is the replacemet for dns doctoring (the alias command) from previous versions of pix os. The alias command is not accepted by PDM. PDM will not work with the alias command, So the dns statement in the static is taking it's place.

Featured Post

The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

587 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question