PIX 506e NAT Question

Hello,

I am setting up 3 web,mail,dns etc.. servers behind a PIX 506e and have a /27 from my provider. Since there is no other machines connected to the PIX besides the 3 servers that are all assigned public IP addresses can I just turn NAT off on the PIX and just do all my security with ACL's (allow through what needs through, deny all)? To accomplish this I believe I just turn off NAT and assign both the outside and inside interfaces an address from my public IP pool, is this correct? If anyone has any suggestions on this setup please let me know as this is my first PIX setup.

Thanks, Cody

Reply to
cbrugh
Loading thread data ...

No. What you asked was basically, "can I just turn off NAT and spread a subnet over both sides of my router?" Your ISP will wonder why half of the IP address range just vanished from where it used to be.

You have a pool of 30 usable IP addresses from your ISP. The question is whether or not your ISP is directly connected to the 30 IP address subnet or if your router is between this 30 IP address subnet and the ISP.

If your router is between the ISP and the subnet, the ISP is expecting to route through your router to get to any of those IP addresses no matter if they are 1 subnet of 30 or 2 subnets of 14 or 4 subnets of 6. . .

If your ISP is connected directly into that subnet, the ISP is expecting to send directly to those IP addresses from their connected router without going through your router next. The ISP will not know that half of them just jumped onto the other side of your network.

My suggestion is to keep all of the /27 IP addresses together. You are probably already doing this, but assign 1 of these global Internet IP addresses to the outside of your PIX and then several more in the form of static nat statements. It is almost the same as giving the outside interface of your PIX a bunch of IP addresses. In the PIX, assign these additional global Internet IP addresses to the private inside IP addresses of your servers that you want to be accessible from the Internet. You will like this better because it works and also because the servers benefit from PIX security by being behind them but keeping their Internet identities.

On the PIX For each server inside your network needing to look like an Internet IP address server: static (inside,outside) netmask 255.255.255.255 0 0

Reply to
Scott Perry

Thank you, this makes much better sense.

Thanks, Cody

Reply to
cbrugh

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.