Modificare la mia configurazione per inserire un pix

[xmatrix83]

Fino ad ora mi sono semrpe trovato la situazione di inserire un pix tra la lan e il router, ma sempre con un solo ip pubblico, quindi dal router nattavo tutto il traffico al pix ed il gioco è fatto

ip nat inside source list 101 interface dial0 overload ip nat inside source static 192.168.0.1 83.25.25.3



Ora ho più di un ip e volevo configurare il router in modo che assegni un indirizzo ip pubblico alla outside del pix.

questa è la mia configurazione sapreste darmi una mano a modificarla??



version 12.3
no service pad
service timestamps debug uptime
service timestamps log datetime localtime
service password-encryption
service udp-small-servers
!
hostname t-74413346694
!
enable secret **********
!
username uilcisco password **********
no aaa new-model
ip subnet-zero
no ip source-route
ip domain name interbusiness.it
ip name-server 151.99.125.2
!
!
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!

interface Ethernet0
ip address 192.168.0.1 255.255.255.0 secondary
ip address 80.21.48.145 255.255.255.248
ip access-group 102 out
ip nat inside
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
description PVC verso 6 ATM0/0/2.194
bandwidth 64
ip address 85.37.28.42 255.255.255.252
ip access-group 104 in
ip access-group 103 out
ip nat outside
pvc 8/35
vbr-nrt 256 64 1
oam-pvc manage
oam retry 5 5 1
encapsulation aal5snap
!
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
duplex auto
speed auto
!
interface FastEthernet3
no ip address
duplex auto
speed auto
!
interface FastEthernet4
no ip address
duplex auto
speed auto
!
ip nat pool netgen 80.21.48.146 80.21.48.146 netmask 255.255.255.248
ip nat inside source list 1 pool netgen overload
ip nat inside source static 192.168.0.253 80.21.48.149
ip nat inside source static 192.168.0.200 80.21.48.148
ip nat inside source static 192.168.0.190 80.21.48.150
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip route 80.21.48.0 255.255.255.0 ATM0.1
ip route 151.99.0.0 255.255.0.0 ATM0.1
ip http server
no ip http secure-server
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 18 permit 151.99.126.0 0.0.0.255
access-list 19 permit 151.99.126.0 0.0.0.255
access-list 30 permit 82.91.115.39
access-list 30 permit 192.168.0.0 0.0.0.255
access-list 102 deny ip 80.21.48.144 0.0.0.7 any
access-list 102 permit tcp any 80.21.48.144 0.0.0.7 established
access-list 102 permit ip any 80.21.48.144 0.0.0.7
access-list 102 permit ip any 192.168.0.0 0.0.0.255
access-list 103 permit udp 80.21.48.144 0.0.0.7 151.99.125.0 0.0.0.31 eq
access-list 103 permit tcp 80.21.48.144 0.0.0.7 151.99.125.0 0.0.0.31 gt
access-list 103 permit tcp 80.21.48.144 0.0.0.7 host 151.99.126.5 eq www
access-list 103 permit icmp 80.21.48.144 0.0.0.7 151.99.0.0 0.0.127.255
access-list 103 permit ip 80.21.48.144 0.0.0.7 151.99.125.0 0.0.0.31
access-list 103 permit ip 80.21.48.144 0.0.0.7 151.99.126.0 0.0.0.255
access-list 103 deny ip 80.21.48.144 0.0.0.7 151.99.0.0 0.0.127.255
access-list 103 permit ip 80.21.48.144 0.0.0.7 any
access-list 104 deny tcp any any eq 2065
access-list 104 permit ip any any
snmp-server community public RO 18
snmp-server community private RW 19
snmp-server enable traps tty
snmp-server host 151.99.126.2 private
tacacs-server host 151.99.126.2
tacacs-server last-resort password
tacacs-server directed-request
tacacs-server extended
tacacs-server notify connections
tacacs-server notify enable
!
line con 0
login local
no modem enable
stopbits 1
line aux 0
line vty 0 4
access-class 30 in
exec-timeout 120 0
login local
length 0
!
scheduler max-task-time 5000
!

[hashashin]

ciao,

io toglierei tutti i nat dal router e lascerei che sia il pix ad occuparsi dei nat!!!

[andrewp]

Uhm...non ho letto la conf perchè è tardi...configura un IP statico pubblico sulla outside del pix e metti la ethernet su IP unnumbered.

Domani rileggo quello che ho scritto per vedere se ha un senso

[xmatrix83]

si infatti io volevo proprio assegnare un ip pubblico alla outside del pix, ma non credo che basti impostare sul pix l'ip, credo che dovro' fare anche qualche configurazione sul router o sbaglio?

che significa IP unnumbered?? e lo dovrei mettere sullla eth0 del router o del pix??

Grazie mille