Cisco PIX 525 Spécifications télécharger pdf (Page 70)

2-10

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Establishing Outbound Connectivity with NAT and PAT

How NAT and PAT Work

The PIX Firewall associates internal addresses with global addresses using a NAT identifier (NAT ID).

For example, if the inside interface has NAT ID 5, then hosts making connections from the inside

interface to another interface (perimeter or outside) get a substitute (translated) address from the pool of

global addresses associated with NAT ID 5.

If you decide not to use NAT to protect internal addresses from exposure on outside networks, assign

those addresses NAT ID 0, which indicates to the PIX

Firewall that translation is not provided for those

addresses. Refer to the Cisco

PIX Firewall Command Reference for configuration information.

For interfaces with a higher security level such as the inside interface, or a perimeter interface relative

to the outside interface, use the nat and global commands to let users on the higher security interface

access a lower security interface. For the opposite direction, from lower to higher, you use the access-list

command described in the Cisco

PIX Firewall Command Reference.

As you enter the nat and global commands to let users start connections, you can use the show nat or

show global commands to list the existing commands. If you make a mistake, remove the old command

with the no form of the command, specifying all the options of the first command. This is where a

terminal with cut and paste capability is useful. After you use the show

global command, you can cut

the old command, enter

no and a space on the command line, paste the old line in, and press the Enter

key to remove it.

Configuring NAT and PAT

Follow these steps to let users on a higher security level interface start connections:

Step 1 Use the show nameif command to view the security level of each interface.

Step 2 Make a simple sketch of your network with each interface and its security level as shown in Figure 2-1.

Outside dynamic

PAT

Translates between host addresses on less secure interfaces and a single address

on a more secure interface. This provides a many-to-one mapping between

external addresses and an internal address.

Outside static NAT Provides a permanent, one-to-one mapping between an IP address on a less

secure interface and an IP address on a more secure interface.

Policy NAT Translates source and destination address pairs to different global statements,

even if the source address is the same. For example, traffic from IP address A to

server

A can be translated to global address A, while traffic from IP address A to

server B can be translated to global address

Table 2-3 Address Translation Types

Type of Address

Translation Function

1 2 ... 65 66 67 68 69 70 71 72 73 74 75 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 70

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525