Cisco Catalyst 6500 Series User Manual

9-33
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
OL-6392-01
Chapter 9 Configuring Network Address Translation
NAT Examples
Overlapping Networks
In Figure 9-21, the FWSM connects two private networks with overlapping address ranges.
Figure 9-21 Using Outside NAT with Overlapping Networks
Two networks use an overlapping address space (192.168.100.0/24), but hosts on each network must
communicate (as allowed by ACLs). Without NAT, when a host on the inside network tries to access a
host on the overlapping dmz network, the packet never makes it past the FWSM, which sees the packet
as having a destination address on the inside network. Moreover, if the destination address is being used
by another host on the inside network, that host receives the packet.
To solve this problem, use NAT to provide non-overlapping addresses. If you want to allow access in
both directions, use static NAT for both networks. If you only want to allow the inside interface to access
hosts on the dmz, then you can use dynamic NAT for the inside addresses, and static NAT for the dmz
addresses you want to access. This example shows static NAT.
To configure static NAT for these two interfaces, follow these steps. The 10.1.1.0/24 network on the dmz
is not translated.
Step 1 Translate 192.168.100.0/24 on the inside to 10.1.2.0 /24 when it accesses the dmz by entering the
following command:
FWSM/contexta(config)# static (inside,dmz) 10.1.2.0 192.168.100.0 netmask 255.255.255.0
Step 2 Translate the 192.168.100.0/24 network on the dmz to 10.1.3.0/24 when it accesses the inside by
entering the following command:
FWSM/contexta(config)# static (dmz,inside) 10.1.3.0 192.168.100.0 netmask 255.255.255.0
Step 3 Configure the following static routes so that traffic to the dmz network can be routed correctly by the
FWSM:
FWSM/contexta(config)# route dmz 192.168.100.128 255.255.255.128 10.1.1.2 1
FWSM/contexta(config)# route dmz 192.168.100.0 255.255.255.128 10.1.1.2 1
192.168.100.2
inside
192.168.100.0/24
outside
10.1.1.2
192.168.100.1
192.168.100.2
dmz
192.168.100.0/24
192.168.100.3
FWSM
10.1.1.1
104675
192.168.100.3

Cisco Catalyst 6500 Series Specifications

General

Brand	Cisco
Model	Catalyst 6500 Series
Category	Switch
Language	English