Cisco PIX 525 Especificaciones descargar pdf (Pagina 232)

100

101

14-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 14 Applying NAT

NAT Overview

Figure 14-6 shows a remote host attempting to initiate a connection to a mapped address. This address

is not currently in the translation table, so the security appliance drops the packet.

Figure 14-6 Remote Host Attempts to Initiate a Connection to a Mapped Address

Note For the duration of the translation, a remote host can initiate a connection to the translated host if an

access list allows it. Because the address is unpredictable, a connection to the host is unlikely. However

in this case, you can rely on the security of the access list.

Dynamic NAT has these disadvantages:

• If the mapped pool has fewer addresses than the real group, you could run out of addresses if the

amount of traffic is more than expected.

Use PAT if this event occurs often, because PAT provides over 64,000 translations using ports of a

single address.

• You have to use a large number of routable addresses in the mapped pool; if the destination network

requires registered addresses, such as the Internet, you might encounter a shortage of usable

addresses.

The advantage of dynamic NAT is that some protocols cannot use PAT. For example, PAT does not work

with IP protocols that do not have a port to overload, such as GRE version 0. PAT also does not work

with some applications that have a data stream on one port and the control path on another and are not

open standard, such as some multimedia applications. See the “Application Inspection Engines” section

on page 21-1 for more information about NAT and PAT support.

PAT

PAT translates multiple real addresses to a single mapped IP address. Specifically, the security appliance

translates the real address and source port (real socket) to the mapped address and a unique port above

1024 (mapped socket). Each connection requires a separate translation, because the source port differs

for each connection. For example, 10.1.1.1:1025 requires a separate translation from 10.1.1.1:1026.

Web Server

www.example.com

Outside

Inside

209.165.201.2

10.1.2.1

10.1.2.27

Security

Appliance

209.165.201.10

132217

1 2 ... 227 228 229 230 231 232 233 234 235 236 237 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 232

Comentarios a estos manuales