PIX 515e - Double NATting?

nat (inside) 2 192.168.1.21 255.255.255.255 global (dmz) 2 10.162.10.78

Have fun.

Thank you so much for the reply, Lutz.

I am currently trying out your suggestion. Meantime, I noticed that my access to the Internet has been stopped, though. Is there any way to preserve it? That's the tough part.

Thanks again,

-C

Lutz D>

You have to merge this commands into your existing ones. Otherwise you loose your current configuration.

Does the VPN tunnel hang off of the DMZ interface or off of the outside interface?

The other poster suggested a regular nat with a global (dmz) . At the very least, the interface would have to be (outside) if the VPN tunnel is hanging off of the outside interface instead of the DMZ.

If the other end of the tunnel only allowed IPs in the DMZ IP range then you very likely have a nat (dmz) 0 access-list command. If you do, then that will override the nat/global pair when the responses come back -- the 10.162.10.78 IP would go untranslated and be directed towards the DMZ rather than to the inside host 192.168.1.21. nat 0 access-list overrides nat/global pairs. So you'd have to put a 'deny' into that access-list to allow translation of 10.162.10.78 .

I was thinking you might have to change the definition of your VPN tunnel, but thinking again, I don't think you will need to do that.

Thanks Lutz. I did that (added the commands you gave me) but I am still having problems accessing the web.

Should I check a particular area?

Regards,

-C> * CD wrote:

Post your current config (shorten it!) and describe your allowed data flows.