Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 69)

2-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Establishing Outbound Connectivity with NAT and PAT

Chapter 3, “Controlling Network Access and Use.” Static NAT provides a permanent one-to-one map

between two addresses. Dynamic NAT uses a range or pool of global addresses to let you support a large

number of users with a limited number of global addresses.

Port Address Translation (PAT) maps a single global IP address to many local addresses. PAT extends

the range of available outside addresses at your site by dynamically assigning unique port numbers to

the outside address as a connection is requested. A single IP addresses has up to 65,535 ports that are

available for making connections. For PAT, the port number uniquely identifies each connection.

Usually, NAT and PAT apply to addresses of inside hosts that are initiating outbound connections

through the PIX

Firewall. In this case, the global addresses are typically IP addresses registered with the

Network Information Center (NIC) for use on the public Internet. The local addresses are internal IP

addresses that you do not wish to use on the public Internet. You may wish to translate your internal

addresses because they are non-routable (private) or to discourage attacks from the public Internet.

PIX Firewall Version 6.2 and higher supports NAT and PAT of addresses on outside networks (lower

security interfaces) that initiate connections to hosts on higher security interfaces. Outside NAT is

occasionally useful for controlling routing and for connecting networks with overlapping addresses. For

more information about outside NAT, refer to the

“Using Outside NAT” section on page 2-38.”

Table 2-3 summarizes the different functions and applications of NAT and PAT.

Ta b l e 2-3 Address Translation Types

Type of Address

Translation

Function

Inside dynamic

NAT

Translates between host addresses on more secure interfaces and a range or pool

of IP addresses on a less secure interface. This provides a one-to-one mapping

between internal and external addresses that allows internal users to share

registered IP addresses and hides internal addresses from view on the public

Internet.

Inside dynamic PAT Translates between host addresses on more secure interfaces and a single address

on a less secure interface. This provides a many-to-one mapping between internal

and external addresses. This allows internal users to share a single registered IP

address and hides internal addresses from view on the public Internet. PAT is

supported for fewer applications than is NAT. For restrictions on its use, refer to

the

“How Application Inspection Works” section on page 5-1 in Chapter 5,

“Configuring Application Inspection (Fixup).”

Inside static NAT Provides a permanent, one-to-one mapping between an IP address on a more

secure interface and an IP address on a less secure interface. This allows hosts to

access the inside host from the public Internet without exposing the actual IP

address.

Outside dynamic

NAT

Translates between a host address on a less secure interface and a range or pool

of IP addresses on a more secure interface. This provides a one-to-one mapping

between an external and an internal address. This is most useful for controlling

the addresses that appear on inside interfaces of the PIX

Firewall and for

connecting private networks with overlapping addresses.

1 2 ... 64 65 66 67 68 69 70 71 72 73 74 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 69

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525