- A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
RE: Pix PAT addresses posted 08/28/2000
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]

Title: Pix PAT addresses
Well....  There's no "great" way to load balance it well.  You can only have one PAT pool, as you're finding out.
Now, on the other hand, you can specify two separate pools for your global, and just have a really short xlate timeout value, so those pools gete re-used for connections quickly.  but that's not pretty with the small number of IPs that you have (not sure how many static's your doing).
The other thing to think about is that you could do PAT on each of the company's routers, and then just do a static for those two IPs used (NAT0?) on the PIX.  So while the PIX is maintaining a connection table, and monitoring the ports, the other routers are actually handling the NAT or PAT in this instance.
Just a thought for you, it'll distribute the workload at that point, and accomplish what you want.
Hope that helps!
-----Original Message-----
From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx]On Behalf Of Price, Jamie
Sent: Monday, August 28, 2000 1:33 AM
To: ccielab@xxxxxxxxxxxxxx
Subject: Pix PAT addresses

Hi Guys,

I've got a scenario where 2 companies are using 1 Pix for inet access.  One, subnet A, enters the Pix on interface 1, the other, subnet B, enters the Pix on Interface 2 - or the "DMZ".  Obviously they are sharing the same public IP block.  This is a /27 range.  For address allocation, this block has been split down the middle - each company recieving 15 addresses.  Each company then sacrifices one address each for the upstream router and outside Pix address, leaving them with 14 each. 

I wanted to segment traffic outbound from the Pix so that should bandwidth consumption become an issue then each company would each be ensured 50% bandwidth on the Inet connection.  My thoughts were that at the upstream router I could utilize custom queueing to ensure this by creating access lists with a /28 mask i.e. access list 100 identifying the first 16 addresses in the block of 32, access list 101 identifying the next 16, then apply those lists to the queues (say queue 1 at 3000 bytes, queue 2 at 3000 bytes and the default queue at 1500) my theory being that if each subnet has its own queue then a third default queue would effectively always be empty (but still there to catch any possible oversights) and therefore traffic could be evenly distributed. I realize that all broadcasts and traffic bound for the Pix interface would be the burden of the company that had that address in its range, but that traffic is minimal and an accepted overhead.

However I was under the mistaken assumption that I would be able to configure more than one PAT address on the outside interface.  My intentions were to assign PAT address 1 - i.e. global (outside) 1 x.x.x.1-x.x.x.1 - to subnet A  and PAT address 2 - i.e. global (outside) 2 x.x.x.16-x.x.x.16 - to subnet B - and then match the appropriate nat-id's to the global commands. 

You cant assign more than one PAT address to an interface - the Pix clearly tells you one is already created and simply doesnt add the new.  Quite obviously if both inside interfaces have to utilize one PAT address then the whole equal distribution plan goes out the window.

Can anyone think of a config workaround to assigning multiple Global PAT addresses to the outside interface of a Pix - or an alternative way to achieving the goal?

Also any thoughts on this whole theory that I had on equal distribution (for example - if it would even work) would also be greatly appreciated.