PIX 525

Hi All,

Can some explain in detail about the command static(inside,DMZ).

When googled I understood that its a static NAT but my confusion here is I read one more thing that to travel the packet from low security zone to high security zone need to configure through this command. Please some enlighten me on this, how its works and why and where it should be used. :roll:


Thanks in Advance.

Hi Dove,

You are quite right in the googling that you have done. The Pix has the Security Level's in order to limit the threats caused by miss-configurations.

In order to get traffic from a High to Low, the traffic will flow as long as Access-Lists are in place, and the Global/NAT has been configured.

From Low to High, you need to make sure that you have a Static Translation in place in order to allow the traffic flow. In older version of the code you used a Conduit but this has been dropped (i have never used the conduit as it was before my time with the pix).

Its just an additional level of security to ensure that in order to go from the outside to inside, you have to manually add a static translation in order to allow the flow.

The static is only required if you want to allow traffic from outside (Security-Level 0) to inside (Security-Level 100). Or if you have a DMZ and you want the traffic flow from outside (Security-Level 0) to DMZ (Security-Level 50).

Traffic from Inside to Outside or Inside to DMZ will flow wihtout configuration of a static translation.

Cheers

oh, Many thanks Smurf,

Now I got an idea about this.....