0

I've run into this config on Cisco firewall:

nat (IFNAME1) 99 0.0.0.0 0.0.0.0 outside

global (IFNAME2) 99 100.100.100.100 netmask 255.255.255.255

It looks like an ok PAT config that would translate IP address of packets coming on interface IFNAME1 then they go out through IFNAME2.

Could someone explain to me what does the keyword "outside" at the end of 1st line nat statement mean? Because all the examples I've found online do not have this "outside" keyword. Maybe it allows reverse translation if packets would come to IFNAME2?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 16 '17 at 21:39
1

It's NAT to outside interface. So all packets would be rewritten with IP assigned to outside interface.

|improve this answer|||||
  • What do you mean by all packets? Packets coming to interface IFNAME1 and going to IFNAME2? As you can see in the config the pair (99) of two statements are used in PIX PAT and those lines define that all packets coming to IFNAME1 and going out of IFNAME2 will be translated to 100.100.100.100. Well at least, that would be the case without "outside" keyword. cisco.com/c/en/us/support/docs/security/… – jimmy2times Feb 12 '17 at 19:00
  • Cisco documentation for PIX 7.0: In order to use dynamic outside NAT for a DMZ network hostname(config)#nat (dmz) 1 10.1.1.0 255.255.255.0 outside. Global in yours example is just exempt from NAT. – Datagram.Network Feb 13 '17 at 0:26
  • No you are wrong. It is used for what I've guest in my original question. Stop writing misleading comments. – jimmy2times Feb 13 '17 at 14:03
  • Check PIX 7.x documentation. Especially bit starting with "In order to use dynamic outside NAT for a DMZ network, and exempt another DMZ network, enter this command:" Pretty same scenario, but exempt is done with access-list. cisco.com/c/en/us/support/docs/security/… – Datagram.Network Feb 14 '17 at 16:56
1

This type of NAT with outside at the end of nat command called outside NAT. For outside NAT (from low security level to higher security level), you need to use the outside keyword in the nat command. Because if NAT control enabled you can't pass traffic from lower to higher security level without nat configured. For example for DMZ hosts to communicate with insude hosts ,nat outside should be configured

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.