essible servers. This network is shown in Figure 26-5. Internet Outside 0 10.0.0.0/24 DMZ - 50 192.168.100.0/24 Internet accessible servers Inside 100 192.168.1.0/24 Corporate LAN Figure 26-5. Firewall with DMZ From a NAT point of view, we must remember that the security levels are impor- tant. The outside interface has a security level of 0, the inside interface has a level of 100, and the DMZ has a level of 50. In this case, we want the servers in the DMZ to be accessible from outside. We also want hosts on the inside network to be able to access the DMZ servers, although the DMZ servers should not be able to access the inside network. First, we need the nat and global statements for the inside network using the Internet: global (outside) 1 interface nat (inside) 1 192.168.1.0 255.255.255.0 0 0 Specifying a specific network, rather than using 0.0.0.0 as the address in the nat statement, ensures that only that network will be able to access the Internet. Should other networks that need Internet access be added internally, they will need to be added to the PIX with additional nat (inside) 1 statements. Now, we need to add the static statements SO the servers on the DMZ can be accessed from the Internet: static (DMZ, outside) 10.0.0.11 192.168.100.11 netmask 255.255.255.255 static (DMZ,outside) 10.0.0.12 192.168.100.12 netmask 255.255.255.255 static (DMZ,outside) 10.0.0.13 192.168.100.13 netmask 255.255.255.255 By default, the DMZ will not be able to access the inside network because the DMZ has a lower security level than the inside network. In this case, we must use a static statement to allow the connections. Where it gets a little strange is that we don't need to translate the source network; we just need to allow the connection. As odd as it sounds, to accomplish this, we must statically NAT the inside network to itself: static (inside, DMZ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 A PIX firewall must translate a higher-security interface for the network to be seen by a lower-security interface. This can