No PAT from Higher Sec to Lower Sec interface

Oct 20, 2005 0 Replies

I am a bit at a loss here.



I have three networks on my pix: inside, outside and a dmz. I want to have traffic from inside to the dmz bet masquerarded (visiable as a dmz ip to the dmz boxes) and vica versa (dmz traffic to the inside should be seen with an inside ip).



I have right now these nat sets.



nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 10 192.168.0.0 255.255.0.0 nat (bcc) 0 access-list dmz_outbound_nat0_acl nat (bcc) 10 172.16.0.0 255.255.0.0



from both I can access outside so there the Masquerading works. but inbweteen I see the others box IP instead of the masqueraded one.



eg from an inside box to dmz I do #> telnet dmz_ip 21



and I see in the netstat -an view on the dmz box the inside ip (192.168...) and not the PIX GW ip (172.16....).



Same with the other way around



So what can I do, to make this happen?


Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required