I have a need to do static source NAT for a single server on my inside
interface. The concern I have is that I must do this outbound to two
separate outside (lower security) interfaces. Here is my target
approach (IPs changed):

inside src 10.2.3.4 nat to 172.3.4.5 outbound on outside interface
inside src 10.2.3.4 nat to 172.3.4.5 outbound on outside2 interface
inside interface 10.2.3.1/28
outside interface 192.168.10.1/29 (towards internet)

I have done this previous with inbound destination NAT using statics,
but I get an error message when I try to do this via PDM (PIX 6.31, PDM
3.0) for outbound source NAT. Today, the source NAT is being done by
another device on the inside network, but it has to be moved to the
firewall now.

Thoughts? Which command do I use for this approach (static,
NAT/global), and do I create a routing problem for myself?

Thanks in advance for your assistance.

Rich

"Rich Myerly" <news@myerly.net> wrote in message
news:J6idnZroINsors7dRVn-hA@wideopenwest.com...
> I have a need to do static source NAT for a single server on my inside
> interface. The concern I have is that I must do this outbound to two
> separate outside (lower security) interfaces. Here is my target
> approach (IPs changed):
>
> inside src 10.2.3.4 nat to 172.3.4.5 outbound on outside interface
> inside src 10.2.3.4 nat to 172.3.4.5 outbound on outside2 interface
> inside interface 10.2.3.1/28
> outside interface 192.168.10.1/29 (towards internet)
>
> I have done this previous with inbound destination NAT using statics,
> but I get an error message when I try to do this via PDM (PIX 6.31, PDM
> 3.0) for outbound source NAT. Today, the source NAT is being done by
> another device on the inside network, but it has to be moved to the
> firewall now.
>
> Thoughts? Which command do I use for this approach (static,
> NAT/global), and do I create a routing problem for myself?
>
Hi,
If you do this:

Static (inside,outside) 172.3.4.5 10.2.3.4 netmask 255.255.255.255

every session the host 10.2.3.4 does to outside will be NAT'ed into
172.3.4.5
and not the global stated rules
Statics works both ways, so just remember to fidle your ACL to match this
aswell.
Also your routing needs to be in place.

HTH
Martin Bilgrav



> Thanks in advance for your assistance.
>
> Rich