ss Translation (PAT). PAT has also been called NAT Overload in IOS. To complicate matters, in the PIX OS, NAT is used in a number of ways that may not seem obvious. For example, you may have to use a nat statement to allow pack- ets from one interface to another, even though they both have public IP addresses, and would normally require no translation. NAT Commands A few commands are used to configure the majority of NAT scenarios. Some, such as the nat command, have many options that I will not list here. The subject of NAT on a PIX firewall could fill a book itself. My goal is to keep it simple. If you need more information than what I've provided here, the Cisco command references are a good place to start. The commands you're most likely to need are: The nat command is used when translating addresses from a more secure inter- face to a less secure interface. For example, if you needed to translate an address on the inside of your PIX to an address on the outside, you would use the nat command. Private IP addresses on the inside of a PIX are translated to one or more public IP addresses using the nat command. (Technically, the addresses do not need to be private and public addresses as described by RFC1918. The PIX documentation uses the terms "global" and "local" to describe addresses seen outside the PIX as opposed to those seen inside.) static The static command is used when translating addresses from a less secure inter- face to a more secure interface. For example, if you had a server inside your PIX that needed to be accessed from outside, you would assign a public IP address to the private IP address of the server using the static command. global The global command is used for PAT configurations where many addresses are translated to one address. It is also used to provide a pool of NAT addresses. This command is used in conjunction with the nat command. NAT Examples There are many possible NAT scenarios, some of which can become quite complicated. I will cover some of the more common scenarios here. Fo