Cisco PIX 525 Spécifications télécharger pdf (Page 72)

2-12

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Establishing Outbound Connectivity with NAT and PAT

Step 4 Add a global command statement for each lower security interface which you want users to have access

to; for example, on the outside, dmz1, and dmz2. The global command creates a pool of addresses that

translated connections pass through.

There should be enough global addresses to handle the number of users on each interface simultaneously

accessing the lower security interface. You can specify a single PAT entry, which permits up to 64,000

hosts to use a single IP address. PAT has some restrictions in its use such as it cannot support H.323 or

caching nameserver use, so you may want to use it to augment a range of global addresses rather than

using it as your sole global address.

For example:

global (outside) 1 209.165.201.5 netmask 255.255.255.224

global (outside) 1 209.165.201.10-209.165.201.20 netmask 255.255.255.224

The first global command statement specifies a single IP address, which the PIX Firewall interprets as

a PAT. You can specify PAT using the IP address at the interface using the interface keyword.The PAT

lets up to 65,535 hosts start connections to the outside.

Note PIX Firewall Version 5.2 and higher permits multiple PAT global command statements for each

interface.

The second global command statement configures a pool of global addresses on the outside interface.

When you define IP address pools for NAT and PAT in the same configuration for the same interface, the

PIX

Firewall uses the NAT address pools first, regardless of the order of the statements in the

configuration. If there is more than one statement assigning IP address pools for NAT, the addresses are

used in the order of the statements. IP addresses assigned for PAT are used only after any NAT IP address

pools are exhausted. This minimizes the exposure of PAT in case users need to use H.323 applications.

global (dmz1) 1 192.168.1.10-192.168.1.100 netmask 255.255.255.0

global (dmz2) 1 192.168.2.10-192.168.2.100 netmask 255.255.255.0

The global command statement for dmz1 lets users on the inside,dmz2, dmz3, and dmz4 start

connections on the dmz1 interface.

The global command statement for dmz2 lets users on the inside, dmz3, and dmz4 start connections on

the dmz2 interface.

If you use network subnetting, specify the subnet mask with the netmask option.

You can track usage among different subnets by mapping different internal subnets to different PAT

addresses.

For example:

nat (inside) 1 10.1.0.0 255.255.0.0

nat (inside) 2 10.1.1.1 255.255.0.0

global (outside) 1 192.168.1.1

global (outside) 2 209.165.200.225

In this example, hosts on the internal network 10.1.0.0/16 are mapped to global address 192.168.1.1, and

hosts on the internal network 10.1.1.1/16 are mapped to global address 209.165.200.225 in global

configuration mode.

1 2 ... 67 68 69 70 71 72 73 74 75 76 77 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 72

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525