Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 185)

5-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 5 Configuring Application Inspection (Fixup)

Basic Internet Protocols

HTTP

You can use the fixup command to change the default port assignment for the Hypertext Transfer

Protocol (HTTP). The command syntax is as follows.

fixup protocol http [port[-port]

Use the port option to change the default port assignments from 80. Use the -port option to apply HTTP

application inspection to a range of port numbers.

Note The no fixup protocol http command statement also disables the filter url command.

HTTP inspection performs several functions:

• URL logging of GET messages

• URL screening via N2H2 or Websense

• Java and ActiveX filtering

The latter two features are described in “Filtering Outbound Connections” in Chapter 3, “Controlling

Network Access and Use.”

ICMP

PIX Firewall Version 6.3 introduces support for NAT of ICMP error messages. NAT for ICMP is disabled

by default. When this feature is enabled, the PIX

Firewall creates xlates for intermediate hops that send

ICMP error messages, based on the static/NAT configuration. The PIX

Firewall overwrites the packet

with the translated IP addresses.

To enable this feature, use the following command:

[no] fixup protocol icmp error

When disabled (as is the case with any version before 6.3), the PIX Firewall does not create xlates for

intermediate nodes that generate ICMP error messages. ICMP error messages generated by the

intermediate nodes between the inside host and the PIX

Firewall reach the outside host without

consuming any additional NAT resource. This is undesirable when an outside host uses the traceroute

command to trace the hops to the destination on the inside of the PIX

Firewall. When the PIX Firewall

does not NAT the intermediate hops, all the intermediate hops appear with the translated destination IP

address.

IPSec

PIX Firewall Version 6.3 provides improved support for application inspection of Encapsulating

Security Payload (ESP) and for using IPSec with NAT.

ESP is an IPSec protocol that provides data confidentiality, data integrity, and protection services,

optional data origin authentication, and anti-replay services. ESP encapsulates the data to be protected.

However, because ESP packets do not identify the ports that are involved, PAT is performed by assigning

port 0 (zero). Only one ESP tunnel is supported at a time. Also, when the PIX

Firewall has this feature

enabled, it cannot terminate VPN tunnels in relation to other IPSec peers.

1 2 ... 180 181 182 183 184 185 186 187 188 189 190 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 185

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525