Pix 515E Disabling PAT

You can get what you want with *nat exemption*.

nat (inside) 0 192.168.1.132 255.255.255.255

Delete all "global" command.

Bye, marco

Thanks for your help. I did what you mentioned. When specifying "sh xlate", cisco shows - "Global 192.168.1.132 Local 192.168.1.132". Shouldn't the global ip show external interface ip? Looking at syslog, ie ping attempt, I am only seeing response to name resolution but that is not getting back to 192.168.1.132. Is there anything else I need to do?

Syslog is not showing packets with source 192.168.1.132. It shows

Thanks again

Thanks for your help. I did what you mentioned. When specifying "sh xlate", cisco shows - "Global 192.168.1.132 Local 192.168.1.132". Shouldn't the global ip show external interface ip? Looking at syslog, ie ping attempt, I am only seeing response to name resolution but that is not getting back to 192.168.1.132. Is there anything else I need to do?

Syslog is not showing packets with source 192.168.1.132. It shows

Thanks again

It's right with NAT 0 command. There is no address translation with nat exemption.

No.

If you want to show external interface ip you should use this configuration.

nat (inside) 1 192.168.1.132 255.255.255.255 global (outside) 1 interface

However, you wrote "My goal is not to have cisco firewall alter the ports for internal clients as they are making outbound reques"

Maybe, do you want NAT without PAT? Maybe I don't understand your needs. ;-)

Looking at syslog,

Can you explain your network scheme?

x.x.x.x/x

outside pix ip address

PIX

inside pix ip address

bye, marco

The problem with this is if I am a client behind the firewall ie

Now that you explain to me, when configuring exemption, I suppose, firewall is routing packets. In that case, the server never had a return route. I just changed it and it works.

Is there a way to do this with just NAT and no PAT? Can you use static statements for outbound connections? If so, how?

Thanks for all your help

Yes. You're right.

In that case, the server never had a return

ok.

static (inside,outside) 192.168.5.132 192.168.1.132

"Static NAT allows bidirectional connection initiation, both to and from the host (if an access rule exists that allows it). With dynamic NAT and PAT, on the other hand, each host uses a different address or port for each subsequent translation, so bidirectional initiation is not supported."

On the other hand, Everytime you map many real address (e.g. inside subnet 192.168.1.0/24) to a single global address (e.g. interface public address), pix firewall do port address traslation.

nat (inside) 1 192.168.1.0 255.255.255.0

global (outside) 1 interface

Bye, marco

This is excellent. Thanks for all your help.