Cisco PIX 525 Spécifications télécharger pdf (Page 99)

2-39

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Using Outside NAT

After you configure outside NAT, when a packet arrives at the outer (less secure) interface of the

PIX

Firewall, the PIX Firewall attempts to locate an existing xlate (address translation entry) in the

connections database. If no xlate exists, it searches the NAT policy from the running configuration. If a

NAT policy is located, an xlate is created and inserted into the database. The PIX

Firewall then rewrites

the source address to the mapped or global address and transmits the packet on the inside interface. Once

the xlate is established, the addresses of any subsequent packets can be quickly translated by consulting

the entries in the connections database.

To enable outside NAT, enter the following command:

nat interface natid access-list acl-name outside

Replace interface with the name of the lower security interface and replace natid with the identifier of

the NAT entry. Replace acl-name with the name of any access list you want to apply. The outside option

causes the translation of host addresses on the lower security interface. By default, address translation

occurs only for host addresses on the higher security or "inside" interface.

Note If outside dynamic NAT is enabled on an interface, explicit NAT policy must be configured for all hosts

on the interface.

Use a natid of 0 with the outside option to disable address translation of hosts residing on the lower

security interface. Use this option only if outside dynamic NAT is configured on the interface. By

default, address translation is automatically disabled for hosts connected to the lower security interface.

Simplifying Routing

You can use outside NAT to simplify router configuration on your internal or perimeter networks by

controlling the addresses that appear on these networks. For example, in

Figure 2-10, the security policy

allows clients in the network 209.165.201.0 to access only the servers on the internal network

192.168.101.0, including the web server 192.168.101.2.

Figure 2-10 Simplifying Routing with Outside NAT

67583

192.168.100.1

192.168.101.1

Router

192.168.101.2

192.168.100.2

209.165.201.1

Web client

209.165.201.2

PIX Firewall

Internet

This policy can be supported by using the following command statements:

nat (outside) 1 209.165.201.0 255.255.255.0 outside

global (inside) 1 192.168.100.3-192.168.100.128

1 2 ... 94 95 96 97 98 99 100 101 102 103 104 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 99

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525