Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 234)

100

101

14-8

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 14 Applying NAT

NAT Overview

For example, if you want to provide a single address for remote users to access FTP, HTTP, and SMTP,

but these are all actually different servers on the real network, you can specify static PAT statements for

each server that uses the same mapped IP address, but different ports (see Figure 14-7).

Figure 14-7 Static PAT

See the following commands for this example:

hostname(config)# static (inside,outside) tcp 209.165.201.3 ftp 10.1.2.27 ftp netmask

255.255.255.255

hostname(config)# static (inside,outside) tcp 209.165.201.3 http 10.1.2.28 http netmask

255.255.255.255

hostname(config)# static (inside,outside) tcp 209.165.201.3 smtp 10.1.2.29 smtp netmask

255.255.255.255

If the application used by the server requires an inspection engine to allow data channels on other ports,

such as FTP, then the server needs translation for other ports. Other protocols that require inspection

engines for data channels include TFTP, RTSP, and Skinny. See the “Application Inspection Engines”

section on page 21-1 for a complete list of protocols that require inspection engines. For example, add

the following line to the preceding configuration to translate all other ports from the FTP server at

10.1.2.27:

hostname(config)# nat (inside) 1 10.1.2.27 255.255.255.255

hostname(config)# global (outside) 1 209.165.201.3

The preceding configuration also allows the FTP server to initiate connections, if desired.

You can also use static PAT to translate a well-known port to a non-standard port or vice versa. For

example, if your inside web servers use port 8080, you can allow outside users to connect to port 80, and

then undo translation to the original port 8080. Similarly, if you want to provide extra security, you can

tell your web users to connect to non-standard port 6785, and then undo translation to port 80.

Host

Outside

Inside

Undo Translation

10.1.2.27209.165.201.3:21

Undo Translation

10.1.2.28209.165.201.3:80

Undo Translation

10.1.2.29209.165.201.3:25

FTP server

10.1.2.27

HTTP server

10.1.2.28

SMTP server

10.1.2.29

130031

1 2 ... 229 230 231 232 233 234 235 236 237 238 239 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 234

Kommentare zu diesen Handbüchern