Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 47)

100

101

3-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 3 Enabling Multiple Context Mode

Security Context Overview

How the Security Appliance Classifies Packets

Each packet that enters the security appliance must be classified, so that the security appliance can

determine to which context to send a packet. The classifier uses the following rules to assign the packet

to a context:

1. If only one context is associated with the ingress interface, the security appliance classifies the

packet into that context.

In transparent firewall mode, unique interfaces for contexts are required, so this method is used to

classify packets at all times.

2. If multiple contexts are associated with the ingress interface, then the security appliance classifies

the packet into a context by matching the destination address to one of the following context

configurations:

a. Interface IP address (the ip address command)

The classifier looks at the interface IP address for traffic destined to an interface, such as

management traffic.

b. Global address in a static NAT statement (the static command)

The classifier only looks at static commands where the global interface matches the ingress

interface of the packet.

c. Global NAT pool address (the global command)

The classifier looks at IP addresses identified by a global pool for the ingress interface.

Note The classifier does not use a NAT exemption configuration for classification purposes because

NAT exemption does not identify a global interface.

For example, if each context has unique interfaces, then the classifier associates the packet with the

context based on the ingress interface. If you share an interface across contexts, however, then the

classifier uses the destination address.

Because the destination address classification requires NAT (for through traffic), be sure to use unique

interfaces for each context if you do not use NAT. Alternatively, you can add a global command to the

ingress interface that specifies the real addresses in a context; a matching nat command is not required

for classification purposes.

1 2 ... 42 43 44 45 46 47 48 49 50 51 52 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 47

Kommentare zu diesen Handbüchern