We help IT Professionals succeed at work.

Configure PIX 506E from using multiple static IPs to single static IP

pierc2
pierc2 asked
on
842 Views
Last Modified: 2012-05-05
Our PIX 506E is currently configured to NAT using a range of static IPs provided by our ISP.  I have one static route for our Exchange server.  As I now understand it I should be able to NAT the LAN through a single static IP, but I confess I'm someone who has learned this stuff from the middle out and whose eyes often glaze over when trying to get the fundamentals (i.e. reading the Command Reference).  Basically, what I'm trying to avoid is using PAT because the Cisco documentation warned that it would break certain media protocols and we deal heavily in the creation of various media file types.  So using NAT exclusively seemed the safest way to go.

So, this is one you folks can answer blindfolded, I'm sure.  Help and enlightenment is appreciated.  

Here's the current relevant statements from the config.  Thanks.

global (outside) 1 xx.yyy.zzz.41-xx.yyy.zzz.62 netmask 255.255.255.224
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) xx.yyy.zzz.35 192.168.16.5 netmask 255.255.255.255 0 0
Comment
Watch Question

Commented:
pierc2, NAT using a single IP = PAT.

Media protocol and media files is totaly different thing. You can send mp3 file on CD using ground mail, you can email it, you can send it over HTTP/FTP, you can transfer it using MS SMB/CIFS protocols or you can stream it using RTP/RTCP. All this different network (or not network) protocols will allow you to move the same media file from one place to another. And this different protocols can or cannot tolerate PAT. Mailed CD doesnt care about your network at all :)
CERTIFIED EXPERT

Commented:
Are you asking how to use a single IP as your global nat address rather than a range?

If so you can use

global (outside) 1 xx.yyy.zzz.41 netmask 255.255.255.224

or

global (outside) 1 interface

if you want to use the IP address of your outside interface

note: this will not effect the address users connect to your exchange server with

Author

Commented:
tvman od:
I knew I was going to get an answer highlighting my ignorance of NAT/PAT.  

I am aware of the distinction between media files and protocols.  I should have left off the words "file types."  

From ciscopress Cisco Secure PIX Firewalls:  "Do not use PAT when running multimedia applications through the PIX firewall.  Multimedia applications may need to access specific ports and can conflict with port mappings provided by PAT."  

So, off hand can you advise as to exactly which protocols aren't going to work with PAT?  

Also, can I infer from your response that true NAT involves using static IPs equal in number to the internal IPs going through the firewall, otherwise some level of PAT is happening?

Author

Commented:
Darkstriker69:

Yes, I guess I am.  Thanks.  But for clarification, at that point it looks like I am really doing PAT, as per 'tvman od', so I just need to do some more homework and make sure nothing potentially important could get broken.  At the core of this question is a potential ISP switch.  The new provider would allot me a max of 5 static IPs so I guess I could reserve one for Exchange, one for the router, and NAT the other 3.  When the local addresses needing to translate exceed 3 then the PATing begins, right?

I'm realize I'm probably being over cautious about PAT.  A little knowledge is a dangerous thing, eh?  As I said, I need to do more homework.

Author

Commented:
Correction....Of the 3 non-routed static IPs I would create a range from 2 (yes, not much of a range) and then create an additional global statement for the third that would be the PAT address.
CERTIFIED EXPERT
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
Folks, this is fantastic clarification.  Much more so than I've gotten from any documentation.  I think I'm cool now.  Many thanks for the help!

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.