Pix Nat Setup

Posted on 2005-04-28
Last Modified: 2013-11-16

I need to setup nat for the inside interface. The inside is and because of vpn site to site I need to translate that address to

I don't even know where to start with this.

Example: if inside host access the vpn I need their address to translate to

Question by:Donnie4572
    LVL 12

    Author Comment

    global (inside) netmask

    Is this what I need to do? If yes, how is this applied to the inside interface?    nat (inside) 0  ??

    Thanks for any help.

    LVL 5

    Accepted Solution

    Not quite. Now i am assuming that the users are also able to browse the web through the PIX, and only when accessing devices on the other side of the network over the VPN that they will be translated. Also, the translation is going from the inside to the outside, that is a host on the inside 10.1.3.X accessing the VPN will be going as 10.1.4.Y to the other end.

    What you first have to do is create an access-list defining what network will be translated when accessing what. So

    > access-list inside_to_vpn permit ip <ip_nework_over_vpn> <netmask>

    Next associate the access-list with a nat pool.

    > nat (inside) 5 access-list inside_to_vpn

    Now assciate the NAT pool with the pool of IP addresses

    > global (outside) 5 netmask

    You should then have you nat pools to allow other traffic going the the internet for instance to be translated to the public ip address. That is

    global (outside) 10 interface (or other ip pool)
    nat (inside) 10 0 0

    The ID numbers (5 and 10 in this case) is important as they are matched in order.

    Now under normal circumstances, the traffic over a VPN is exempted from NAT, that is, the ip addresses are unchanged. You will have to ensure that these entries are not in there as they matched first before any others. Look for the commands "nat (inside) 0".

    Hope this helps.
    LVL 5

    Expert Comment

    As a note, the IP translations are not a 1 to 1 matching. That is is not translated to, but translated to the first available ip in the pool, which could possibly
    LVL 12

    Author Comment

    Thanks for your reply.

    You have explained exactly what I need.

    The access list for the tunnel does it have to contain the actual address of the host or the translated address or both?
    LVL 79

    Expert Comment

    The access-list for the actual tunnel must include the translated addresses (global) as the source, remote network as destination..

      access-list site1_vpn permit ip <remote IP subnet> <mask>

    LVL 12

    Author Comment

    Thank You.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Find Ransomware Secrets With All-Source Analysis

    Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

    Suggested Solutions

    If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
    This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now