Cisco PIX 525 Especificaciones descargar pdf (Pagina 233)

100

101

14-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 14 Applying NAT

NAT Overview

After the connection expires, the port translation also expires after 30 seconds of inactivity. The timeout

is not configurable. Users on the destination network cannot reliably initiate a connection to a host that

uses PAT (even if the connection is allowed by an access list). Not only can you not predict the real or

mapped port number of the host, but the security appliance does not create a translation at all unless the

translated host is the initiator. See the following “Static NAT” or “Static PAT” sections for reliable access

to hosts.

PAT lets you use a single mapped address, thus conserving routable addresses. You can even use the

security appliance interface IP address as the PAT address. PAT does not work with some multimedia

applications that have a data stream that is different from the control path. See the “Application

Inspection Engines” section on page 21-1 for more information about NAT and PAT support.

Note For the duration of the translation, a remote host can initiate a connection to the translated host if an

access list allows it. Because the port address (both real and mapped) is unpredictable, a connection to

the host is unlikely. However in this case, you can rely on the security of the access list.

Static NAT

Static NAT creates a fixed translation of real address(es) to mapped address(es).With dynamic NAT and

PAT, each host uses a different address or port for each subsequent translation. Because the mapped

address is the same for each consecutive connection with static NAT, and a persistent translation rule

exists, static NAT allows hosts on the destination network to initiate traffic to a translated host (if there

is an access list that allows it).

The main difference between dynamic NAT and a range of addresses for static NAT is that static NAT

allows a remote host to initiate a connection to a translated host (if there is an access list that allows it),

while dynamic NAT does not. You also need an equal number of mapped addresses as real addresses with

static NAT.

Static PAT

Static PAT is the same as static NAT, except it lets you specify the protocol (TCP or UDP) and port for

the real and mapped addresses.

This feature lets you identify the same mapped address across many different static statements, so long

as the port is different for each statement (you cannot use the same mapped address for multiple static

NAT statements).

1 2 ... 228 229 230 231 232 233 234 235 236 237 238 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 233

Comentarios a estos manuales