Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 438)

D-8

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Appendix D TCP/IP Reference Information

Using Subnet Masks

In these examples, the ip address commands specify addresses for the inside and outside network

interfaces. The ip address command only uses network masks. The inside interface is a Class A address,

but only the last octet is used in the example network and therefore has a Class C mask. The outside

interface is part of a subnet so the mask reflects the .224 subnet value.

The nat command lets users start connections from the inside network. Because a network address is

specified, the class mask specified by the ip address inside command is used.

The global command provides a PAT address to handle the translated connections from the inside. The

global address is also part of the subnet and contains the same mask specified in the ip address outside

command.

The static command maps an inside host to a global address for access by outside users. Host masks are

always specified as 255.255.255.255.

The access-list command permits any outside host to access the global address specified by the static

command. The host parameter is the same as if you specified 209.165.201.3 255.255.255.255.

The aaa command indicates that any users wishing to access the global address must be authenticated.

Because authentication only occurs when users access the specified global which is mapped to a host,

the mask is for a host. The “0 0” entry indicates any host and its respective mask.

The route statement specifies the address of the default router. The “0 0” entry indicates any host and

its respective mask.

The telnet command specifies a host that can access the PIX Firewall unit’s console using Telnet.

Because it is a single host, a host mask is used.

If you are using subnet masks, refer to “Using Subnet Masks,” to be sure that each IP address you choose

for global or static addresses is in the correct subnet.

The subnet masks are also identified by the number of bits in the mask. Table D-3 lists subnet masks by

the number of bits in the network ID.

Ta b l e D-3 Masks Listed by Number of Bit

Network

ID Bits Host ID Bits Subnet Example Notation # of Subnets

# of Hosts on

Each Subnet

24 8 .0 192.168.1.1/24 1 254

25 7 .128 192.168.1.1/25 2 126

26 6 .192 192.168.1.1/26 4 62

27 5 .224 192.168.1.1/27 8 30

28 4 .240 192.168.1.1/28 16 14

29 3 .248 192.168.1.1/29 32 6

30 2 .252 192.168.1.1/30 64 2

The .255 mask indicates a single host in a network.

1 2 ... 433 434 435 436 437 438 439 440 441 442 443 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 438