0

I've run into this config on Cisco firewall:

nat (IFNAME1) 99 0.0.0.0 0.0.0.0 outside

global (IFNAME2) 99 100.100.100.100 netmask 255.255.255.255

It looks like an ok PAT config that would translate IP address of packets coming on interface IFNAME1 then they go out through IFNAME2.

Could someone explain to me what does the keyword "outside" at the end of 1st line nat statement mean? Because all the examples I've found online do not have this "outside" keyword. Maybe it allows reverse translation if packets would come to IFNAME2?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 16, 2017 at 21:39

2 Answers 2

Reset to default
1

It's NAT to outside interface. So all packets would be rewritten with IP assigned to outside interface.

Improve this answer
4
  • What do you mean by all packets? Packets coming to interface IFNAME1 and going to IFNAME2? As you can see in the config the pair (99) of two statements are used in PIX PAT and those lines define that all packets coming to IFNAME1 and going out of IFNAME2 will be translated to 100.100.100.100. Well at least, that would be the case without "outside" keyword. cisco.com/c/en/us/support/docs/security/…
    – jimmy2times
    Commented Feb 12, 2017 at 19:00
  • Cisco documentation for PIX 7.0: In order to use dynamic outside NAT for a DMZ network hostname(config)#nat (dmz) 1 10.1.1.0 255.255.255.0 outside. Global in yours example is just exempt from NAT.
    – Datagram.Network
    Commented Feb 13, 2017 at 0:26
  • No you are wrong. It is used for what I've guest in my original question. Stop writing misleading comments.
    – jimmy2times
    Commented Feb 13, 2017 at 14:03
  • Check PIX 7.x documentation. Especially bit starting with "In order to use dynamic outside NAT for a DMZ network, and exempt another DMZ network, enter this command:" Pretty same scenario, but exempt is done with access-list. cisco.com/c/en/us/support/docs/security/…
    – Datagram.Network
    Commented Feb 14, 2017 at 16:56
1

This type of NAT with outside at the end of nat command called outside NAT. For outside NAT (from low security level to higher security level), you need to use the outside keyword in the nat command. Because if NAT control enabled you can't pass traffic from lower to higher security level without nat configured. For example for DMZ hosts to communicate with insude hosts ,nat outside should be configured

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.