Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 51)

3-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 3 Enabling Multiple Context Mode

Security Context Overview

Shared Interface Guidelines

If you want to allow traffic from a shared interface through the security appliance, then you must

translate the destination addresses of the traffic. In other words, you must have a global command

associated with the shared interface or a static command that specifies the shared interface as the global

interface. The classifier relies on the address translation configuration to classify the packet within a

context. If you do not want to perform NAT, you can still ensure classification into a context by

specifying a global command for the shared interface: the global command specifies the real destination

addresses, and a matching nat command is not required. (If you share an interface, and you allow only

management traffic to and from the interface, then the classifier uses the interface IP address

configuration to classify the packets. NAT configuration does not enter into the process.)

The type of NAT configured for the destination address determines whether the traffic can originate on

the shared interface or if it can only respond to an existing connection. The properties of dynamic NAT

(that uses a global address pool) dictate that you cannot initiate a connection to the host. Therefore,

traffic from the shared interface must be in response to an existing connection. Static NAT, however, lets

you initiate connections to the host, so with this configuration, you can initiate connections on the shared

interface.

For an outside shared interface (connected to the Internet, for example), the inside host addresses are

known, so configuring NAT for those addresses is easy, even if you want to configure static NAT.

Configuring an inside shared interface poses a problem, however, if you want to allow communication

between the shared interface and the Internet. For example, if you want to allow inside hosts on the

shared interface to initiate traffic to the Internet, then you need to configure static NAT statements for

each Internet address. This requirement necessarily limits the kind of Internet access you can provide

for users on an inside shared interface. If you intend to statically translate addresses for Internet servers,

then you also need to consider DNS entry addresses and how NAT affects them. For example, if a server

sends a packet to www.example.com, then the DNS server needs to return the translated address.

Managing DNS entries for translated addresses depends on where the DNS server resides. See the NAT

chapter for more information.

Configuration is more straightforward if you want to allow Internet users to initiate connections to a host

on the inside shared interface because you can configure a broad dynamic NAT statement for the outside

ingress interface that matches any address.

1 2 ... 46 47 48 49 50 51 52 53 54 55 56 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 51