 surprised what happens in the field. Many small busi- ness networks are limited to eight addresses. In reality, many don't need any more than that. In this example, we only need to have one static NAT configured-the web server. Here is the configuration relating to NAT: global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside, outside) 10.0.0.6 192.168.1.6 netmask 255.255.255.255 0 0 This configuration works fine, but what if the need arises for another web server to be available on the Internet? Say a secure server has been built using HTTPS, which listens on TCP port 443. The problem is a lack of public IP addresses. Assuming that the original web server only listens on TCP port 80, we can solve the problem using port redirection. Using capabilities introduced in the 6.x release of the PIX OS, we can specify that incoming traffic destined for the 10.0.0.6 IP address on TCP port 80 be translated to one IP address internally, while packets destined for the same IP address on TCP port 443 be sent to another IP address: static (inside,outside) tcp 10.0.0.6 80 192.168.1.6 80 netmask 255.255.255.255 static (inside,outside) tcp 10.0.0.6 443 192.168.1.7 443 netmask 255.255.255.255 Chapter 26: PIX Firewall Configuration Normally, the static command includes only the outside and inside IP addresses, and all packets are sent between them. Including the port numbers makes the static statement more specific. The result is that packets destined for 10.0.0.6 will be translated to different IP addresses internally, depending on their destination ports: a packet sent to 10.0.0.6:80 will be translated to 192.168.1.6:80, while a packet destined for 10.0.0.6:443 will be translated to 192.168.1.7:443. Here is a very common scenario. A company has put a PIX in place for Internet secu- rity. Certain servers need to be accessed from the Internet. These servers will be in a DMZ. The outside interface connects to the Internet, the inside interface connects to the company LANs, and the DMZ contains the Internet-acc