Cisco PIX 525 Spécifications télécharger pdf (Page 68)

2-8

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Establishing Outbound Connectivity with NAT and PAT

Use the show nameif command to view the current names and security levels for each interface. The

results of this command for a PIX

Firewall with three interfaces might be as follows.

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security10

Security levels let you control access between systems on different interfaces and the way you enable or

restrict access depends on the relative security level of the interfaces:

• To enable access to a higher security level interface from a lower-level interface, use the static and

access-list commands

• To enable access to a lower-level interface from a higher-level interface, use the nat and global

commands

An attacker who obtains access to an interface can easily attack other interfaces with a lower security

level. For this reason, locate public servers on a perimeter interface with the lowest security level.

However, the TFTP server from where you download PIX

Firewall configurations should be kept on a

more secure interface to prevent unauthorized access.

The format for the nameif command is as follows:

nameif hardware_id interface security_level

• Replace hardware_id with the value used in the interface command, such as ethernet0.

• Replace interface with any meaningful name, such as dmz or perim for each perimeter interface.

You will need to enter this name frequently, so a shorter name is a better choice, although you can

use up to 48 characters. The default names are intfn, where n represents the position of the interface

card in the PIX

Firewall.

• Replace security_level with a value such as security40 or security60.

The default security levels for perimeter interfaces increment by 5 for each interface starting with

security10 for intf2 (the default name for the first perimeter interface). For example, intf3 =

security15, intf4 = security20, and intf5 = security25. You can choose any unique security level

between 1 and 99 for a perimeter interface.

Establishing Outbound Connectivity with NAT and PAT

This section describes how to use Network Address Translation (NAT) and Port Address Translation

(PAT) to establish outbound connectivity from hosts on higher security interfaces to hosts on lower

security interfaces. It includes the following topics:

• Overview, page 2-8

• How NAT and PAT Work, page 2-10

• Configuring NAT and PAT, page 2-10

Overview

Network Address Translation (NAT) allows you to hide internal IP addresses, those behind the PIX

Firewall, from external networks. NAT is accomplished by mapping global IP addresses to local IP

addresses. Static NAT is described in the “

Enabling Server Access with Static NAT” section in

1 2 ... 63 64 65 66 67 68 69 70 71 72 73 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 68

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525