Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 113)

CHAPTER

3-1

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Controlling Network Access and Use

This chapter describes how to establish and control network connectivity for different applications and

implementations after you have completed your basic configuration, described in

Chapter 2,

“Establishing Connectivity.” This chapter contains the following sections:

• Enabling Server Access with Static NAT, page 3-1

• Enabling Inbound Connections, page 3-2

• Controlling Outbound Connectivity, page 3-4

• Using the Static Command for Port Redirection, page 3-5

• Using Authentication and Authorization, page 3-8

• Access Control Configuration Example, page 3-14

• Using TurboACL, page 3-18

• Downloading Access Lists, page 3-20

• Simplifying Access Control with Object Grouping, page 3-24

• Filtering Outbound Connections, page 3-31

Enabling Server Access with Static NAT

Static Network Address Translation (NAT) creates a permanent, one-to-one mapping between an address

on an internal network (a higher security level interface) and a perimeter or external network (lower

security level interface). For example, to share a web server on a perimeter interface with users on the

public Internet, use static address translation to map the server’s actual address to a registered IP address.

Static address translation hides the actual address of the server from users on the less secure interface,

making casual access by unauthorized users less likely. Unlike NAT or PAT, it requires a dedicated

address on the outside network for each host, so it does not save registered IP addresses.

If you use a static command to allow inbound connections to a fixed IP address, use the access-list and

access-group commands to create an access list and to bind it to the appropriate interface. For more

information, refer to “

Enabling Inbound Connections.”

Note Do not use the PIX Firewall interface address with the static command if Stateful Failover is enabled.

Doing this will prevent Stateful Failover from receiving its interface monitoring probes, which run over

IP protocol 105, and as a result, the interface will appear to be in a waiting state. For further information

about Stateful Failover, refer to Chapter 10, “Using PIX Firewall Failover.”

1 2 ... 108 109 110 111 112 113 114 115 116 117 118 ... 465 466

Brak uwag

Cisco PIX 525 Dokumentacja Strona 113