Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 31)

1-5

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Controlling Network Access

Address Translation

The Network Address Translation (NAT) feature works by substituting, or translating, host addresses on

one interface with a “global address” associated with another interface. This protects internal host

addresses from being exposed on other network interfaces. To understand whether you want to use NAT,

decide if you want to expose internal addresses on other network interfaces connected to the

PIX

Firewall. If you choose to protect internal host addresses using NAT, you identify the pool of

addresses you want to use for translation.

Note Beginning with Version 6.2 of the PIX Firewall, NAT is also available for translating outside addresses.

This helps to simplify network routing by controlling the addresses that can appear on the inside

network.

If the addresses that you want to protect access only other networks within your organization, you can

use any set of “private” addresses for the pool of translation addresses. For example, if you want to

protect the host addresses on the Finance Department’s network (connected to the inside interface on the

PIX

Firewall) from exposure when connecting to the Sales Department network (connected to the

perimeter interface on the PIX

Firewall), you can set up translation using any available set of addresses

on the Sales network. The effect is that hosts on the Finance network appear as local addresses on the

Sales network.

If the addresses that you want to protect require Internet access, you use only NIC-registered addresses

(official Internet addresses registered with the Network Information Center for your organization) for

the pool of translation addresses. For example, if you want to protect host addresses on the Sales network

(connected to a perimeter interface of the PIX

Firewall) from exposure when making connections to the

Internet (accessible through the outside interface of the PIX

Firewall), you can set up translation using

a pool of registered addresses on the outside interface. The effect is that hosts on the Internet see only

the Internet addresses for the Sales network, not the addresses on the perimeter interface.

If you are installing the PIX Firewall in an established network that has host- or network-registered

addresses, you might not want to perform translation for those hosts or networks because that would

require using another registered address for the translation.

When considering NAT, it is also important to consider whether you have an equal number of addresses

for internal hosts. If not, some internal hosts might not get network access when making a connection.

In this case you can either apply for additional NIC-registered addresses or use Port Address Translation

(PAT). PAT uses a single external address to manage up to 64,000 concurrent connections.

For inside systems, NAT translates the source IP address of outgoing packets (defined in RFC 1631). It

supports both dynamic and static translation. NAT allows inside systems to be assigned private addresses

(defined in RFC 1918), or to retain existing invalid addresses. NAT also provides additional security by

hiding the real network identity of internal systems from the outside network.

PAT uses port remapping, which allows a single valid IP address to support source IP address translation

for up to 64,000 active xlate objects. PAT minimizes the number of globally valid IP addresses required

to support private or invalid internal addressing schemes. PAT does not work with multimedia

applications that have an inbound data stream different from the outgoing control path. PAT provides

additional security by hiding the real network identity of internal systems from the outside network.

Another class of address translation on the PIX Firewall is static translation. Static translation lets you

substitute a fixed external IP address for an internal address. This is useful for servers that require fixed

IP addresses for access from the public Internet.

The PIX Firewall Identify feature allows address translation to be disabled. If existing internal systems

have valid globally unique addresses, the Identity feature allows NAT and PAT to be selectively disabled

for these systems. This feature makes internal network addresses visible to the outside network.

1 2 ... 26 27 28 29 30 31 32 33 34 35 36 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 31

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525