Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 71)

2-11

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Establishing Outbound Connectivity with NAT and PAT

Figure 2-1 Sketching Interfaces and Security Levels

34787

dmz1

192.168.1.1

security20

dmz3

192.168.3.1

security60

dmz4

192.168.4.1

security80

dmz2

192.168.2.1

security40

outside

209.165.201.1

security0

inside

192.168.0.1

security100

PIX Firewall

Step 3 Add a nat command statement for each higher security level interface from which you want users to start

connections to interfaces with lower security levels:

a. To let inside users start connections on any lower security interface, use the nat (inside) 1 0 0

command.

b. To let dmz4 users start connections on any lower security interface such as dmz3, dmz2, dmz1, or

the outside, use the nat

(dmz4) 1 0 0 command.

c. To let dmz3 users start connections on any lower security interface such as dmz2, dmz1, or the

outside, use the nat

(dmz3) 1 0 0 command.

d. To let dmz2 users start connections on any lower security interface, such as dmz1 or outside, use the

nat

(dmz2) 1 0 0 command.

e. To let dmz1 users start connections to the outside, use the nat (dmz1) 1 0 0 command.

Instead of specifying “0 0,” to let all hosts start connections, you can specify a host or a network address

and mask.

For example, to let only host 192.168.2.42 start connections on the dmz2 interface, you could specify

the following:

nat (dmz2) 1 192.168.2.42 255.255.255.255

The “1” after the interface specifier is the NAT ID. You can use one ID for all interfaces and the

PIX

Firewall sorts out which nat command statement pertains to which global command statement on

which interface, or you can specify a unique NAT ID to limit access to specific interface. Remember that

the nat command opens access to all lower security level interfaces so that if you want users on the inside

to access the perimeter interfaces as well as the outside, then use one NAT ID for all interfaces. If you

only want inside users to access the dmz1 interface but not the outside interface, use unique NAT IDs

for each interface.

The NAT ID in the nat command must be the same NAT ID you use for the corresponding global

command.

NAT ID 0 means to disable Network Address Translation.

1 2 ... 66 67 68 69 70 71 72 73 74 75 76 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 71

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525