SNAT PIX 501
Posted on 2009-04-11
I'm having an issue where I can sit on the PIX and ping everything on the internal network. I can ping everything I've allowed on the external network as well. However, I can't get traffic across the NAT to ping. Here's the config:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
access-list outside_access_in permit ip host NAMED-SOMETHING any
access-list outside_access_in permit icmp object-group icmp-sources any
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside 126.96.36.199 255.255.255.224
ip address inside 172.16.41.100 255.255.255.0
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 188.8.131.52 172.16.42.1 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 184.108.40.206 1
route inside 0.0.0.0 0.0.0.0 172.16.41.200
Lame Layout Example
ROUTER -> PIX -> SWITCH -> DEVICES
Without route to internal router
outside 0.0.0.0 0.0.0.0 220.127.116.11 1 OTHER static (What I added)
outside 18.104.22.168 255.255.255.224 22.214.171.124 1 CONNECT static (Shows by default since it's the interface)
inside 172.16.41.0 255.255.255.0 172.16.41.100 1 CONNECT static (Shows by default since it's the interface)
When I ping I get:
No route to 172.16.42.1 from "Where I'm at" on the PIX debug log...
When I add the 172.16.x.x route
outside 0.0.0.0 0.0.0.0 126.96.36.199 1 OTHER static
outside 188.8.131.52 255.255.255.224 184.108.40.206 1 CONNECT static
inside 172.16.0.0 255.255.0.0 172.16.41.200 1 OTHER static
inside 172.16.41.0 255.255.255.0 172.16.41.100 1 CONNECT static
When I ping now... I don't get the "No Route" but I don't get replies either.
Reminder, I can ping everything on the internal and external network from the PIX. However, Outisde in and Inside out doesn't work even though it's allowed...
If I changed the NAT'd devices gateway to the PIX, then it works fine. BTW: The gateway isn't mine and I'm sure there isn't any type of route pointing back to me. I'm typically coming in from an external IP and I guess that my traffic is getting pushed out another direction once it hits their network.
So, would Source NAT work? Never used it.. So, I have no idea.