Cisco PIX 525 Spécifications télécharger pdf (Page 114)

3-2

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Enabling Inbound Connections

The main options of the static command are as follows:

static [(internal_if_name, external_if_name)] global_ip local_ip [netmask network_mask]

[max_conns]

• Replace internal_if_name with the internal network interface name. In general, this is the higher

security level interface you are accessing.

• Replace external_if_name with the external network interface name. In general, this is the lower

security level interface you are accessing.

• Replace global_ip with the outside (global) IP address. In general, this is the interface with the lower

security level. This address cannot be a PAT IP address.

• Replace local_ip with the internal (local) IP address from the inside network. In general, this is the

interface with the higher security level.

• Replace network_mask with the network mask that pertains to both global_ip and local_ip. For host

addresses, always use 255.255.255.255. For network addresses, use the appropriate subnet mask for

the network.

• (Optional) replace max_conns with the maximum number of concurrent connections permitted

through the static address translation.

Note To configure static translation for a host residing on the less secure interface (using outside NAT)

reverse the interface in the static command. Refer to the Cisco

PIX Firewall Command

Reference for more information about the static command.

For example, the following command maps a server with an internal IP address of 10.1.1.3 to the

registered IP address 209.165.201.12:

static (inside, outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255

This command simply maps the addresses; make sure you also configure access using the access-list and

access-group commands, as described in the next section. Also, you must inform the DNS administrator

to create an MX record for the external address so that traffic sent to the server host name is directed to

the correct address.

Note For more information about how to configure static translation without NAT, refer to the static command

in the Cisco PIX Firewall Command Reference.

Enabling Inbound Connections

By default, the PIX Firewall denies access to an internal or perimeter (more secure) network from an

external (less secure) network. You specifically allow inbound connections by using access lists. Access

lists work on a first-match basis, so for inbound access, you must deny first and then permit after.

Note Beginning with Version 5.3, the PIX Firewall uses access lists to control connections between inside and

outside networks. Access lists are implemented with the access-list and access-group commands. These

commands are used instead of the conduit and outbound commands, which were used in earlier

versions of PIX

Firewall. In PIX Firewall software releases later than Version 6.3, the conduit and

outbound commands are no longer supported. To help you with the conversion process, a tool is

available online at: https://cco-dev.cisco.com/cgi-bin/Support/OutputInterpreter/home.pl.

1 2 ... 109 110 111 112 113 114 115 116 117 118 119 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 114

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525