Static and Source IP when on the Internet

Yes on the PIX. static are bi-directional on the PIX. They have to be -- otherwise return packets wouldn't come from the right address. (Yes, some special processing could in theory happen for TCP, but there is also the UDP case: each UDP packet is considered to be independant, so the firewall wouldn't know which packet related to which internal conversation.)

Thanks - much. Slow getting my head around this stuff!

Walter,

Even if the internal host is initiating the traffic the static will apply? As the static at least by definition is for incoming traffic - initiated from the outside. So I want to confirm traffice originated from the inside will use the static also.

Thanks, Dan Foxley

The static command creates a one-to-one address translation rule (called a static translation slot or "xlate"). Each local address is translated to a fixed global address.

If anything, the language is biased towards application on inside traffic going outwards, but bidirectional it is:

Because the global address is the same for each consecutive connection, and a persistent translation rule exists, the static command allows hosts on the global network to initiate traffic to a local host (if the access list allows it).

Dan,

Don't forget to clear your xlate or at least the xlate entry for the internal host after making this change. Otherwise you won't get the expected results until your xlate entry times out.

clear xlate local aaa.bbb.ccc.ddd (where aaa.bbb.ccc.ddd is your internal IP).

J

Perfect. I know I thick headed. Thanks.