I have currently configured a PIX501's ethernet0 to DHCP so it gets an IP from my ISP via a Cable Modem.

ISP --- --> [ethernet0/dhcp] | PIX501 | [ethernet1/] --> [Layer 3 ethernet1/1] | PA-200 | --> Internal network

I need to pass ALL traffic (no filtering) through from the Internet via Ethernet0 to Ethernet1 on the PIX.

PIX Ethernet1 will then be connected to a Palo Alto firewall (ethernet1/1) which will perform NAT/filtering etc...

Is this possible?

I think there will be some double-NAT involved here. My understanding is that double-NAT will cause issues if I need to access an internal server.

  • Might be a stupid question, but why are you stacking the PIX and the Palo Alto, if you don't want the PIX to do NAT and pass all traffic? Why not rip out the PIX entirely?
    – Stuggi
    Feb 21 '16 at 22:50
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12 '17 at 5:21

i think you have pool of real IP with GW and DNS so no you don't need any NAT on the PIX . you just need to confirm the next with ISP

  1. the interface of the PIX which faced the modem has private IP (some thing like 192.168.X.X ) and sure the modem will be your GW in same range
  2. use one of the real IP which you get from the ISP to bring internet to you and assign it to the interface connected to the palo alto
  3. in the palo alto configure the interface which is connected to the PIX with other Real IP , configure default root to PIX and sure perform NATing for what ever Subnet you need to publish

i just wonder why you configure DHCP on the PIX , in such case PIX acting as next hub for your FW and may any L3 device even the FW acting as your DHCP server.

enter image description here

i such case my dear PIX act as a router , just route out subnets get from palo alto to outside and vice versa . in such senario NAT occured only on palo alto which already has real IP as i mentained before

  • Thanks for responding. How does one configure a PIX with no NAT? I have never tried this before. I need to use the PIX configured ethernet0 for DHCP because the ISP's DHCP server does not allocate any IP's if the Palo Alto sends a DHCP Request. The PIX works fine. All I need is the PIX to obtain an IP and send all traffic to the PIX's ethernet1 then the Palo Alto can deal with the rest. The Palo Alto config I can work out.
    – pablo808
    Aug 25 '15 at 1:09
  • Thank you for the diagram. It is very useful. Are you able to share the pix config with me?
    – pablo808
    Sep 4 '15 at 3:38

The other answers have spoken to the topology and are absolutely correct. I will speak a bit to the PIX config.

If you are running PIX code versions 6.x, then you are going to be forced to consider NAT. As you probably know, in PIX code 6.x, any packets that are crossing two security levels (aka, interfaces) must be NATed or they will be dropped. This "security feature" is called nat-control. It is called this because in code versions 7.x and above, you are given the option to disable this behavior using the command no nat-control.

So, your options:

If you are running code 7.x+, disable nat-control, and let the PIX route the packets from one interface to the other.

If you are running code 6.x, you will have to NAT everything crossing your interfaces. The simplest way is to configure an Identity NAT for every IP. The configuration will look something like this:

static (inside,outside) netmask

If you are running code 6.x, you can also try setting both interfaces (inside and outside) to the same security level, which might preclude the requirement for you to NAT everything as it crosses through. I'll be honest though, I haven't tested this, and only just now thought of it as an option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.