In versions of Cisco PIX prior to 7.0, you could use the alias command to allow a host on the &quot;inside&quot; network to get to a server in the DMZ via its public IP address. This command would essentially redirect the requests for the public IP address to the DMZ IP address when originated from the &quot;inside&quot; network-- thus accomplishing the goal.

<span><!--more-->
ALIAS (inside) xx.xx.xx.xx  yy.yy.yy.yy  255.255.255.255
Where xx.xx.xx.xx is the OUTSIDE address  and yy.yy.yy.yy  is the address in the DMZ</span>

<span>However, the alias command was deprecated in PIX 7.0 and later. So in order to allow the same type of access, you now use the &quot;static&quot; command to create a static NAT entry.</span>

<span>STATIC (dmz,inside)  xx.xx.xx.xx  yy.yy.yy.yy  netmask 255.255.255.255
Where xx.xx.xx.xx is the EXTERNAL address  and yy.yy.yy.yy is the address on the DMZ</span>

<span>This command basically says for communication across the real interface (dmz) and mapped interface (inside), map yy.yy.yy.yy to xx.xx.xx.xx
</span>