r these examples, I will be using 10.0.0.0 to represent a publicly routable IP network, and 192.168.1.0 as a private, unroutable network. Simple PAT using the outside interface One of the most common scenarios for a firewall is providing an office with protec- tion from the Internet. Assuming that all nodes inside the firewall require access to the Internet, and no connections will be initiated inbound, a simple PAT configuration can be used. Here, I've configured the outside interface to be used as the IP address for the global PAT. In other words, all packets that originate from the inside will be translated to the same IP address as the one used on the outside interface of the PIX: global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 All internal IP addresses will be translated because the nat statement references 0.0.0.0, which means all addresses. Chapter 26: PIX Firewall Configuration Simple PAT using a dedicated IP address Older releases of the PIX os (before 6.0) did not allow PAT to be configured using an interface. This was a problem for installations with limited public IP addresses. To accomplish PAT without using the interface's IP address, use the same configura- tion as the previous one, but specify the IP address used for the global PAT in the global command instead of the keyword interface: global (outside) 1 10.0.0.5 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 Simple PAT with public servers on the inside Small installations may have a server inside (not on a DMZ) that must be accessible from the public Internet. While this is usually not a good idea, it is nevertheless a distinct possibility that you'll need to configure such a solution. Smaller compa- nies-and even home networks-often require such configurations because a DMZ is either impractical or impossible. Here, I've designed a global PAT using the outside interface, with all addresses from the inside being translated. Additionally, I've created two static entries. The first forwards packets sent to the public IP address 10.0.0.10 to th