also want hosts on the inside network to be able to access the DMZ servers, although the DMZ servers should not be able to access the inside network. First, we need the nat and global statements for the inside network using the Internet: global (outside) 1 interface nat (inside) 1 192.168.1.0 255.255.255.0 0 0 Specifying a certain network, rather than using 0.0.0.0 as the address in the nat state- ment, ensures that only that network will be able to access the Internet. Should other networks that need Internet access be added internally, they will need to be added to the ASA with additional nat (inside) 1 statements. Now, we need to add the static statements SO the servers on the DMZ can be accessed from the Internet: static (DMZ,outside) 10.0.0.11 192.168.100.11 netmask 255.255.255.255 static (DMZ,outside) 10.0.0.12 192.168.100.12 netmask 255.255.255.255 static (DMZ,outside) 10.0.0.13 192.168.100.13 netmask 255.255.255.255 By default, the DMZ will not be able to access the inside network, because the DMZ has a lower security level than the inside network. In this case, we must use a static statement to allow the connections. However, it gets a little strange, because we don't need to translate the source network-we just need to allow the connection. As odd as it sounds, to accomplish this, we must statically NAT the inside network to itself: static (inside, DMZ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 An ASA firewall must translate a higher-security interface for the network to be seen by a lower-security interface. Doing this can be confusing because it creates a "trans- lation," even though nothing is being translated. The ASA must have a translation in place for the hosts on the inside network to be able to connect to the hosts on the DMZ. The IP addresses do not need to be changed, but the path needs to be built. Once NAT is in place, all that's left to do is configure access lists to allow the required traffic from the DMZ to the inside network. Miscellaneous The following items are things that trip m