Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 29)

1-3

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Controlling Network Access

The PIX Firewall also lets you implement your security policies for connection to and from the inside

network.

Typically, the inside network is an organization's own internal network, or intranet, and the outside

network is the Internet, but the PIX

Firewall can also be used within an intranet to isolate or protect one

group of internal computing systems and users from another.

The perimeter network can be configured to be as secure as the inside network or with varying security

levels. Security levels are assigned numeric values from 0, the least secure, to 100, the most secure. The

outside interface is always 0 and the inside interface is always 100. The perimeter interfaces can be any

security level from 1 to 99.

Both the inside and perimeter networks are protected with the PIX Firewall's Adaptive Security

Algorithm (ASA). The inside, perimeter, and outside interfaces can listen to RIP routing updates, and

all interfaces can broadcast a RIP default route if required.

Adaptive Security Algorithm

The Adaptive Security Algorithm (ASA) is a stateful approach to security. Every inbound packet is

checked against the Adaptive Security Algorithm and against connection state information in memory.

This stateful approach to security is regarded in the industry as being far more secure than a stateless

packet screening approach.

ASA allows one way (inside to outside) connections without an explicit configuration for each internal

system and application. ASA is always in operation, monitoring return packets to ensure they are valid.

It actively randomizes TCP sequence numbers to minimize the risk of TCP sequence number attack.

Note The PIX Firewall checks the TCP sequence number and ensures that it fits within an acceptable range.

ASA applies to the dynamic translation slots and static translation slots. You create static translation

slots with the static command and dynamic translation slots with the global command. Collectively,

both types of translation slots are referred to as “xlates.” ASA follows these rules:

• No packets can traverse the PIX Firewall without a connection and state.

• Traffic may not exit the PIX Firewall on the same network interface it entered.

• Outbound connections or states are allowed, except those specifically denied by access control lists.

An outbound connection is one where the originator or client is on a higher security interface than

the receiver or server. The highest security interface is always the inside interface and the lowest is

the outside interface. Any perimeter interfaces can have security levels between the inside and

outside values.

• Inbound connections or states are denied, except those specifically allowed. An inbound connection

or state is one where the originator or client is on a lower security interface/network than the receiver

or server. You can apply multiple exceptions to a single xlate (translation). This lets you permit

access from an arbitrary machine, network, or any host on the Internet to the host defined by the

xlate.

• All ICMP packets are denied unless specifically permitted.

• All attempts to circumvent the previous rules are dropped and a message is sent to the syslog.

1 2 ... 24 25 26 27 28 29 30 31 32 33 34 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 29

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525