Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 188)

100

101

12-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 12 Firewall Mode Overview

Routed Mode Overview

IP Routing Support

The security appliance acts as a router between connected networks, and each interface requires an

IP address on a different subnet. In single context mode, the routed firewall supports OSPF and RIP (in

passive mode). Multiple context mode supports static routes only. We recommend using the advanced

routing capabilities of the upstream and downstream routers instead of relying on the security appliance

for extensive routing needs.

Network Address Translation

NAT substitutes the local address on a packet with a global address that is routable on the destination

network. By default, NAT is not required. If you want to enforce a NAT policy that requires hosts on a

higher security interface (inside) to use NAT when communicating with a lower security interface

(outside), you can enable NAT control (see the nat-control command).

Note NAT control was the default behavior for software versions earlier than Version 7.0. If you upgrade a

security appliance from an earlier version, then the nat-control command is automatically added to your

configuration to maintain the expected behavior.

Some of the benefits of NAT include the following:

• You can use private addresses on your inside networks. Private addresses are not routable on the

Internet.

• NAT hides the local addresses from other networks, so attackers cannot learn the real address of a

host.

• NAT can resolve IP routing problems by supporting overlapping IP addresses.

Figure 12-1 shows a typical NAT scenario, with a private network on the inside. When the inside user

sends a packet to a web server on the Internet, the local source address of the packet is changed to a

routable global address. When the web server responds, it sends the response to the global address, and

the security appliance receives the packet. The security appliance then translates the global address to

the local address before sending it on to the user.

1 2 ... 183 184 185 186 187 188 189 190 191 192 193 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 188

Komentarze do niniejszej Instrukcji