Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 100)

2-40

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Using Outside NAT

These commands translate all the source addresses on the remote network to a range of internal IP

addresses (192.168.100.3-128).The router then automatically distributes the traffic from the inside

interface of the PIX

Firewall along with traffic originating on the 192.168.100.0 subnetwork.

Configuring Overlapping Networks

In Figure 2-11, the PIX Firewall connects two private networks with overlapping address ranges.

Figure 2-11 Using Outside NAT with Overlapping Networks

67582

192.168.100.2

192.168.100.0

209.165.200.225

192.168.100.1

192.168.100.2

192.168.100.0

192.168.100.3

PIX Firewall

209.165.200.226

209.165.200.225

209.165.200.226

In Figure 2-11, two networks use an overlapping address space and two hosts with the same IP address

(192.168.100.2) must communicate. A router (209.165.200.225) connects the outside interface of the

PIX

Firewall (209.165.200.226) to the network on the right. The following regular NAT and outside NAT

statements map each address in the private network 192.168.100.0 to the corresponding address in the

public network 209.165.201.0:

static (inside,outside) 209.165.201.0 192.168.100.0 netmask 255.255.255.0

static (outside, inside) 209.165.201.0 192.168.100.0 netmask 255.255.255.0

In this example, if host 192.168.100.2 on the right network initiates a connection to host 192.168.100.2

on the left network, it uses the IP address 209.165.201.2. When the PIX

Firewall receives this message,

the destination address is translated from 209.165.200.2 to 192.168.100.2. Then the static that enables

outside NAT is applied, and the source address is changed from 192.168.100.2 to 209.165.201.2 and is

then forwarded.

The response is forwarded to the PIX Firewall with the destination address 209.165.201.2 so the outside

NAT static is applied and the destination address is changed to 192.168.100.2. Then the regular NAT

static is applied and the source address gets changed from 192.168.100.2 to 209.165.201.2.

Note To enable connectivity between the two overlapping networks, the alias command can be used with

previous versions of PIX

Firewall, or static outside NAT can be used with PIX Firewall Version 6.2 or

higher. We recommend using static outside NAT instead of the alias command because it allows the

isolation of address translation between two interfaces and optionally supports rewriting of DNS address

resource records.

The NAT command for regular NAT, which translates the inside hosts from 192.168.100.0/24 into

209.165.201.0/24 on the outside network, is as follows:

static (inside,outside) 209.165.201.0 192.168.100.0 netmask 255.255.255.0

1 2 ... 95 96 97 98 99 100 101 102 103 104 105 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 100

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525