Cisco PIX 525 Spécifications télécharger pdf (Page 30)

1-4

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Controlling Network Access

PIX Firewall handles UDP data transfers in a manner similar to TCP. Special handling allows DNS,

archie, StreamWorks, H.323, and RealAudio to work securely. The PIX

Firewall creates UDP

“connection” state information when a UDP packet is sent from the inside network. Response packets

resulting from this traffic are accepted if they match the connection state information. The connection

state information is deleted after a short period of inactivity.

For more information about how ASA works and how you can configure application inspection with

different types of applications, refer to

Chapter 5, “Configuring Application Inspection (Fixup).”

Multiple Interfaces and Security Levels

All PIX Firewalls provide at least two interfaces, which by default, are called outside and inside, and are

assigned a security level of 0 and 100, respectively. A lower security level indicates that the interface is

relatively less protected than the higher security level. Typically, the outside interface is connected to the

public Internet, while the inside interface is connected to your private network and is protected from

public access.

Many PIX Firewall models provide up to eight interfaces, to let you create one or more perimeter

networks, also called bastion networks or demilitarized zones (DMZs). A DMZ is a network that is more

secure than the outside interface but less secure than the inside interface. You can assign security levels

to your perimeter networks from 0 to 100. Typically, you put mail servers or web servers that need to be

accessed by users on the public Internet in a DMZ to provide some protection, but without jeopardizing

the resources on your internal network.

How Data Moves Through the PIX Firewall

When an outbound packet arrives at a PIX Firewall higher security level interface (security levels can be

viewed with the show nameif command), the PIX

Firewall checks to see if the packet is valid based on

the Adaptive Security Algorithm, and then whether or not previous packets have come from that host. If

not, then the packet is for a new connection, and PIX

Firewall creates a translation slot in its state table

for the connection. The information that PIX

Firewall stores in the translation slot includes the inside IP

address and a globally unique IP address assigned by Network Address Translation (NAT), Port Address

Translation (PAT), or Identity (which uses the inside address as the outside address). The PIX

Firewall

then changes the packet's source IP address to the globally unique address, modifies the checksum and

other fields as required, and forwards the packet to the lower security level interface.

When an inbound packet arrives at an external interface such as the outside interface, it first passes the

PIX

Firewall Adaptive Security criteria. If the packet passes the security tests, the PIX Firewall removes

the destination IP address, and the internal IP address is inserted in its place. The packet is forwarded to

the protected interface.

Note Traffic may not exit the PIX Firewall on the same network interface it entered. This condition results in

the following message in the system log:

%PIX-7-106011: Deny inbound (No xlate) chars

Explanation This is a connection-related message. This message occurs when a

packet is sent to the same interface that it arrived on. This usually indicates that a

security breach is occurring. When the PIX Firewall receives a packet, it tries to

establish a translation slot based on the security policy you set with the global and

conduit commands, and your routing policy set with the route command.

1 2 ... 25 26 27 28 29 30 31 32 33 34 35 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 30

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525