Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Static NAT on PIX 520 with IOS 4.4(7)

Posted on 2006-07-23
Medium Priority
Last Modified: 2013-11-16
I have an older ios release that I'm messing around with at home because I can't learn on the equipment at work.  
Here's how my network settings are with a direct connection to my ISP, so this would be the outside interface:
ip address range: -

How can I setup static NAT between the ouside interface, which will reflect the settings above, and the inside hosts on my network on let's say

Thank you.
Question by:sipscott
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
LVL 20

Expert Comment

ID: 17165339
PIX v4.4 ?!  My, that's ancient!
  What you're describing above actually isn't static NAT, just dynamic NAT...  If you're trying to NAT the 192.168.1.x to the pool of IPs: - .254, & you're manually setting the PIX's gateway & outside IP, see below:

ip address inside  <- or whatever your inside IP is going to be
ip address outside  <- or whatever your outside IP is going to be
route outside 0 0
nat (inside) 1 0 0
global (outside) 1

  Here's the PIX 4.4 config guide (especially the command ref):


Author Comment

ID: 17165490
Oh man, that's exactly what I've been trying all night!  I can ping each interface, but data won't flow through the inside interface to any hosts on the outside or vice versa.  Here's how my network is setup, try not to laugh!  I have my computer connected directly to the inside interface of the PIX with a crossover cable.  The outside interface of the PIX is connected to a wireless bridge (Buffalo WLI-TX4-G54HP).  Which connects up to my wireless ISP about 5 miles away.  They are using a microtik router with an IP address of it's running DHCP, and has its own static 1 to 1 mapping.  I can ping from the outide interface on my PIX to various hosts on the wireless network: other access points and gateways.  I can also ping from the inside interface to various hosts on my home network.  I cannot ping through either interface, and I'm begining to wonder if I may have screwed something up.  I'll include a copy of my config:

PIX Version 4.4(7)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
pager lines 24
logging on
no logging timestamp
no logging console
no logging monitor
no logging buffered
no logging trap
logging facility 20
logging queue 512
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
failover timeout 0:00:00
failover ip address outside
failover ip address inside
arp timeout 14400
global (outside) 1
nat (inside) 1 0 0
conduit permit icmp any any
no rip outside passive
no rip outside default
no rip inside passive
no rip inside default
route outside 1
timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00
timeout rpc 0:10:00 h323 0:05:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
telnet timeout 5
terminal width 80

Author Comment

ID: 17169172
this question must be tougher than I thought.  I have experience setting up a similar config on a PIX with v6, but as was mentioned earlier 4.4 is rather old!
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

LVL 11

Expert Comment

ID: 17170729
Do you have any potential to bring the PIX OS to a more current level ( at least the 6.x ) level?

4.x is ancient and doesnt even support alot of the functionality of the newer versions.
LVL 20

Expert Comment

ID: 17172840
1)  First off, have you checked with your ISP on the IP settings?  I rather doubt they're giving you the entire range of 254 IPs to use (
2)  I checked the Command Reference for 4.4 (in the URL above), & it doesn't appear to support DHCP for the "ip address" command, unlike PIX 5.2 & above (ie, 'ip address dhcp setroute').  So, looks like you'd have to have a static IP given to you by your ISP if running v4.4 code.
3) Did you poweroff the wireless bridge before connecting your PIX, then reboot the wireless bridge?  
4)  Have you manually cleared the NAT table?  -->  clear xlate

Just to keep things simple, I'd disable failover on this:
  no failover
And verify this with "show failover", what you want to see is:
 Failover Off

  Assuming you clear up any IP addressing problems with your ISP, they may have to clear their ARP cache on their end.  Once you're sure about IP settings, save the config then reboot the PIX.


Author Comment

ID: 17173110
Getting a static IP was no problem, I've got about 220 unused addresses to pick from.  (I work for the ISP)  I also have failover disabled.  The PIX communicates on the wireless flawlessly, I can ping from the outside to anywhere including www.google.com.  The problem appears to be all in NAT.

Here's the diagnosis:

pixfirewall(config)# ping outside response received -- 70ms response received -- 60ms response received -- 70ms
pixfirewall(config)# ping outside response received -- 10ms response received -- 0ms response received -- 0ms
pixfirewall(config)# ping inside response received -- 0ms response received -- 0ms response received -- 0ms

****From my workstation*****
Ethernet adapter Local Area Connection 4:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . :
        Subnet Mask . . . . . . . . . . . :
        Default Gateway . . . . . . . . . :

C:\Documents and Settings\Scott>ping

Pinging with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

C:\Documents and Settings\Scott>ping

Pinging with 32 bytes of data:

Reply from bytes=32 time<1ms TTL=255
Reply from bytes=32 time<1ms TTL=255
Reply from bytes=32 time<1ms TTL=255
Reply from bytes=32 time<1ms TTL=255

Ping statistics for
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
LVL 20

Expert Comment

ID: 17173187
> I've got about 220 unused addresses to pick from.  (I work for the ISP)
  Lucky you!  I could you my own Class C to play with...  ;)

What's the output of "show ver"?
And what's the output of "show xlate" immediately after trying to ping from your workstation?  Do you get any entries for your PC's IP?

Have you also tried doing PAT on the outside interface IP?  eg:
no global (outside) 1
no nat (inside) 1 0 0
global (outside) 1 netmask  <- if it works, run similar steps but try instead
nat (inside) 1 0 0
clear xlate

Are you absolutely sure the subnet mask is correct for the outside interface?


Author Comment

ID: 17173252
pixfirewall(config)# sho ver

PIX Version 4.4(7)
Compiled on Mon 02-Oct-00 07:07 by pixbuild
Finesse Bios V3.3

pixfirewall up 13 mins 0 secs

Hardware:   SE440BX2, 128 MB RAM, CPU Pentium II 449 MHz
Flash atmel @ base 0x300
0: ethernet0: address is 00a0.c957.d76e, irq 11
1: ethernet1: address is 00a0.c9b2.5ec7, irq 9

Licensed Options:
Failover:       Enabled
IPSec:          Enabled
Ports allowed:  6
I can't do this with 4.4:

pixfirewall(config)# global (outside) 1 netmask
Start and end addresses overlap with outside interface address
**** WARNING ***
        Configuration Replication is NOT performed from Standby unit to Active unit.
        Configurations are no longer synchronized.

**I went ahead and used for PAT instead, still doesn't work.  I took a look on the microtik config and I'm positive my ISP uses a class C subnet mask for  Question is does this work in 4.4?  I can still ping from the outside and from my isp back to the outside on the pix.  Could it be screwing something up within NAT?


Author Comment

ID: 17173263
show xlate:
no entries are made after ping from my workstation.
LVL 20

Accepted Solution

calvinetter earned 2000 total points
ID: 17173458
>I can't do this with 4.4:
>pixfirewall(config)# global (outside) 1 netmask
  Yeah, confirmed that this was first allowed in 5.2(1)  (via "interface" keyword of course, like nowadays).

  Have you also tried being specific about what you're trying to NAT?  eg:
no nat (inside) 1 0 0
nat (inside) 1
clear xlate    <- make *sure* you're running this after adding/modifying 'nat' or 'global' statements!

  And for good measure:
write mem

FYI for 'global' statement:  see Usage Note #5 under the Usage Guidelines:
Apparently in 4.4 if using a pool of IPs for the global statement, you must configure reverse DNS for those IPs?!  If that's true, what the hell was Cisco thinking?! LOL

Featured Post

Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question