| 9.2 |  | Network Address Translations |
| 9.2.2 |  | Dynamic inside translations |

| Overview of Dynamic Inside Translations Dynamic inside translations are used for local hosts and their outbound connections, and hide the host address from the Internet. With dynamic translations, administrators must first define which hosts are eligible for translation with the nat command, and then define the address pool with the global command. The pool for address allocation is chosen on the outgoing interface based on the nat_id selected with the nat command.

The nat command works with the global command to enable NAT. The nat command associates a network with a pool of global IP addresses. It lets administrators specify lists of inside hosts that can use the PIX Security Appliance for address translation.

In Figure , the global pool of addresses assigned by the global command is 192.168.0.20 through 192.168.0.254. This enables up to 235 individual IP addresses.

Two Interfaces using Dynamic Inside Translations
Figure shows a PIX with two active interfaces configured to permit dynamic inside translations. The first nat command statement permits all hosts on the 10.0.0.0 network to start outbound connections using the IP addresses from a global pool. The second nat command statement permits all hosts on the 10.2.0.0 network to do the same. The nat_id in the first nat command statement tells the PIX Security Appliance to translate the 10.0.0.0 addresses to those in the global pool containing the same nat_id. Likewise, the nat_id in the second nat command statement tells the PIX Security Appliance to translate addresses for hosts on network 10.2.0.0 to the addresses in the global pool containing nat_id 2.

Three Interfaces using Dynamic Inside Translation
Figure illustrates a PIX Security Appliance with three active interfaces configured to permit dynamic inside translations. The first nat command statement in this example enables hosts on the inside interface, which has a security level of 100, to start connections to hosts on interfaces with lower security levels. In this case, that includes hosts on the outside interface and hosts on the demilitarized zone (DMZ). The second nat command statement enables hosts on the DMZ, which has a security level of 50, to start connections to hosts on interfaces with lower security levels. In this case, that includes only the outside interface.

Because both global pools and the nat (inside) command statement use a nat_id of 1, addresses for hosts on the 10.0.0.0 network can be translated to those in either global pool. Therefore, when users on the inside interface access hosts on the DMZ, their source addresses will be translated to addresses in the 172.16.0.2 to 172.16.0.254 range from the global (dmz) command statement. When they access hosts on the outside, their source addresses will be translated to addresses in the 192.168.0.20 to 192.168.0.254 range from the global (outside) command statement.

When users on the DMZ access hosts on the outside, their source addresses will always be translated to addresses in the 192.168.0.20 to 192.168.0.254 range from the global (outside) command statement. The global (dmz) command statement gives inside users access to the Web server on the DMZ interface.

| Lab Activity e-Lab Activity: Internet Access Configuration The administrator wants to set up basic Internet connectivity for the internal network. The administrator does not want internal addresses exposed. However, the administrator wants to grant access to the internal Web server from outside hosts. In this activity, the student will create a default route to the perimeter router.