PIX 520 Assistance

If you want the LAN to be able to access the internet, then it must be allowed to use at least one outside IP. That one IP can be the outside IP address of the PIX if your traffic is entirely TCP and UDP (and icmp mostly works too), but there are some kinds of traffic that require distinct IPs.

ip address outside X.Y.Z.A 255.255.255.240 ip address inside 192.168.1.1 255.255.255.0 ip address dmz 192.168.2.1 255.255.255.0 nat (inside) 1 192.168.1.0 255.255.255.0 global (outside) 1 interface static (dmz,outside) X.Y.Z.B X.Y.Z.B netmask 255.255.255.255 static (dmz,outside) X.Y.Z.C X.Y.Z.C netmask 255.255.255.255 route dmz X.Y.Z.B 192.168.2.2 255.255.255.255 route dmz X.Y.Z.C 192.168.2.2 255.255.255.255

Note: this setup requires a dmz router 192.168.2.2 that has an interface in X.Y.Z.*

In PIX 6, is -not- possible to use public IPs on the DMZ and have the -same- public IP range on the outside interface. Each PIX 6.x interface must be in a different subnet. The above configuration side-steps this by having the DMZ interface be in a different subnet and routing the public IPs to a router in the DMZ that is in the public subnet. You -might- have to lose one public IP to make this work, but if your DMZ does not need to talk -directly- to your WAN router [e.g., in order to monitor it] then you can reuse the WAN router IP on the DMZ.