Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


NAT is the problem ?

Posted on 2004-10-18
Medium Priority
Last Modified: 2010-04-10
I have the following configuration:

ADSL-----RouterVPN ( PIX501 ( (
                                                    PcB (

All subnet masks are 24 bits.
RouterVPN has proper configuration.

I need PcA to be able to go outside and to be reachable from outside, hence i decided a static NAT by entering:

static (inside,outside) netmask

Also I set the following default gateways:
For PcA:
For PcB:
For PIX:

After setting all the IP I performed some connectivity tests and got what follows:

From PcB:
ping : OK
ping : OK

From PcA:
ping : OK

From PIX:
ping outside : OK
ping outside : ? I need to verify
ping inside : OK

My questions are:
1)Is it enough to use only the "static (...,..)..."  command or should I use it after entering:
nat (inside) 1 netmask
global (outside) 1 netmask

2)Why can't I reach from PcA the router ?

Thx in advance

Question by:minicuc
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +2
LVL 43

Expert Comment

ID: 12339679
Are you allowing ICMP traffic on the PIX outside interface?  If ICMP is not permitted, you won't be able to ping anything beyond the PIX from PcA or ping through the PIX from the outside interface.

Expert Comment

ID: 12339709
can you ping the internet form your  pix  ?

if you can the its not routing the segment 192.168.1.xx

Accepted Solution

Felix2000 earned 1000 total points
ID: 12339973
Doing the static is fine but you also need to make an access list to allow traffic in. Otherwise the traffic is still denied.
Statics only make the translation for traffic allowed in.

This is an example access access list to allow traffic in from your natted ip and icmp

### Permit Access from anybody to host
access-list acloutin permit ip any

### If you want specific access you can do something like this for a website
# access-list acloutin permit tcp any eq 80

### Permit Things like Ping / Traceroute through the pix
access-list acloutin permit icmp any interface outside unreachable
access-list acloutin permit icmp any interface outside time-exceeded
access-list acloutin permit icmp any interface outside echo-reply
access-list acloutin permit icmp any interface outside echo

### Apply the access list to the interface
access-group acloutin in interface outside

Hope that helps.

-= Felix =-
Q2 2017 - Latest Malware & Internet Attacks

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out our latest Quarterly Internet Security Report!


Expert Comment

ID: 12340634
Your router can't connect to PC-A because the router doesn't know that 192.168.1.xx is handled by PIX501.  It assumes that the only addresses on its internal network are in the subnet (whatever the netmask is), and that everything else must be on the external side.  If your RouterVPN supports it, you will need to add a route/gateway to via  Since 192.168.x.x addresses are technically considered "non-routable," this might present a problem.  Also, if your RouterVPN doesn't support static routes, you are in trouble.

Since RouterVPN does not know how to get to PC-A, it can not return the pings, even if your firewall rules are correct.  If you were to put a network sniffer (like Ethereal on a hub, not a switch) right in front of, then you should see the packets from PC-A, each one followed by "Destination Unreachable" packets from the router.

If that doesn't work, then one troubleshooting step is to try everything using routable addresses on PC-A and the PIX, and then change them to non-routable addresses once things are working, in case your router/PIX refuses to route the non-routable addresses.

- Will

Expert Comment

ID: 12341287
RouterVPN or PC-B doesn't need routers for the 192.168.x.x it's being natted... to anyone infront of the nat he needs to try to connect to

-= Felix =-

Author Comment

ID: 12368866
Thx all, i'll check and get back to you shortly

Expert Comment

ID: 12369509
Good point, Felix2000.  Somehow I must have been thinking that the NAT was on the other end.  In that case, disregard most of my previous post.

Author Comment

ID: 12381331
Felix  solution works fine.Thx.
Only couple of doubts:

1) It seems the ICMP access-list lines are not needed, PcA is able to ping RouterVPN even without them. Is it correct ?

2) Are these ICMP access-list lines equivalent to the following ICMp commands ?

icmp permit any echo-reply outside
icmp permit any echo outside


Expert Comment

ID: 12384505
I believe the ICMP lines are for the PIX itself  not things being or being NAT'ed by it.

PC A is allowed out since he is inside. The access lists should also help people coming from the outside to ping / traceroute to the router/nat ip's.
Traceroute's time-exceeded might not normally be allowed back through the pix by default.

Glad it helped
-= Felix =-

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Suggested Courses

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question