Adding IP addresses to outside interface PIX 501

Posted on 2004-11-03
Last Modified: 2013-11-16

I currently have a PIX 501 w/ a VPN to a remote office (also PIX501) and each office has 5 useable IP addresses.  When I set up the config I only gave each PIX 1 address for testing.  Now that everything is working I would like to add the 4 other addresses to the outside interfaces.


Do I add them individually to the interface via the ip address outside command?
Aside from the address, what else may need updating?   Is this going to break current VPN or NAT?


Question by:lmar
    LVL 79

    Expert Comment

    You cannot assign more than one IP address to the interface. Your remaining 4 IP's are available for use for static NAT to specified inside hosts. Do you have specific hosts that you want to be dedicated to a specific public IP? Do you even need to pay for the extra IP's?
    LVL 2

    Author Comment

    Thanks LRMOORE, I would like to use the additional IP addresses for services on the inside of our private network.  What is the easiest way to accomplish this?
    LVL 79

    Expert Comment

    Simply create static NAT entries like this:

        static (inside,outside) <public ip1> <private ip1> netmask
        static (inside,outside) <public ip2> <private ip2> netmask
        static (inside,outside) <public ip3> <private ip3> netmask
        static (inside,outside) <public ip4> <private ip4> netmask

    Then, create access-lists to permit specified services as in this example:

        access-list outside_access_in permit tcp any host <public ip1> eq http
        access-list outside_access_in permit tcp any host <public ip2> eq http
        access-list outside_access_in permit tcp any host <public ip2> eq https
        access-list outside_access_in permit tcp any host <public ip3> eq smtp
        access-list outside_access_in permit tcp any host <public ip3> eq pop3
    apply the access-list to the outside interface
        access-group outside_access_in in interface outside


    LVL 2

    Author Comment

    Thanks LRMOORE!

    On the static NAT entries I just add the 4 addresses that I don't have assigned to the outside address, correct?

    LVL 79

    Accepted Solution

    If you have a need to spread out the services among more than 4 internal systems, you can always use any combination of 1-1 static NAT as in the above example, and/or port redirections:
     This example only uses one of the spare 4 addresses, redirecting services ports to 4 different internal hosts, then a 2nd public IP dedicated to a specific internal host:

        static (inside,outside) tcp <public ip1> 25 <private ip1> 25 netmask
        static (inside,outside) tcp <public ip1> 3389 <private ip2> 3389 netmask
        static (inside,outside) tcp <public ip1> 80 <private ip3> 80 netmask
        static (inside,outside) tcp <public ip1> 110 <private ip4> 110 netmask
        static (inside,outside) <public ip2> <private ip5> netmask

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Join & Write a Comment

    Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
    Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now