Friday, December 02, 2005

PIX: nat or static

Basically, nat for dynamic mapping and static for static mapping.

Normally, nat is from high security(inside) to low security(outside). There is not xlate created until the traffic is initialed from inside, and you can only accept inbound traffic that after xlate created.

And static is from low to high. The xlate is created statically. But in addition to using the static command, you must also use an access-list command to allow outside traffic to access inside hosts or servers. In the other side, nat does need access-list because the traffic is initialed from inside.

nat 0 (Identity NAT) and nat 0 access-list (NAT Exemption)
With identity NAT, you can accept the inbound traffic only when the traffic is initiated from the inside and after the xlate is created. NAT exemption allows traffic whenever it matches the referenced ACL, regardless of whether or not there is already an xlate.
While NAT exemption lets you exempt traffic that is matched by the access-list command statement from NAT services, Adaptive Security remains in effect. The extent to which the inside hosts are accessible from the outside depends on the access-list command statements that permit inbound access; NAT exemption allows both inbound and outbound traffic no matter which side initiates, as long as it is permitted by the referenced ACL.

Note:
1. nat (inside) 0 192.168.1.0 and static (inside, ouside) 192.168.1.0 192.168.1.0
Both are identity NAT. Using static will allow connection initialed from outside(of cause, the access-list should allow it) and inside. But nat will only allow connection initialed from inside.
2. Only nat 0 access-list (NAT Exemption) allow connection initialed from both side. So it can replace with static policy nat.
Such as for VPN,
access-list test1 permit ip 192.168.10.0 255.255.255.0 192.168.10.0 255.255.255.o
nat 0 access-list test1
or
static (inside, outside) 192.168.10.0 access-list test1

No comments: