Cisco PIX 525 Especificaciones descargar pdf (Pagina 252)

100

101

14-26

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 14 Applying NAT

Using Static PAT

• To configure regular static NAT, enter the following command:

hostname(config)# static (

real_interface

mapped_interface

) {

mapped_ip

| interface}

real_ip

[netmask

mask

] [dns] [norandomseq] [[tcp]

tcp_max_conns

[

emb_limit

]]

[udp

udp_max_conns

]

See the “Configuring Dynamic NAT or PAT” section on page 14-22 for information about the

options.

For example, the following policy static NAT example shows a single real address that is translated to

two mapped addresses depending on the destination address (see Figure 14-8 on page 14-10 for a related

figure):

hostname(config)# access-list NET1 permit ip host 10.1.2.27 209.165.201.0 255.255.255.224

hostname(config)# access-list NET2 permit ip host 10.1.2.27 209.165.200.224

255.255.255.224

hostname(config)# static (inside,outside) 209.165.202.129 access-list NET1

hostname(config)# static (inside,outside) 209.165.202.130 access-list NET2

The following command maps an inside IP address (10.1.1.3) to an outside IP address (209.165.201.12):

hostname(config)# static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255

The following command maps the outside address (209.165.201.15) to an inside address (10.1.1.6):

hostname(config)# static (outside,inside) 10.1.1.6 209.165.201.15 netmask 255.255.255.255

The following command statically maps an entire subnet:

hostname(config)# static (inside,dmz) 10.1.1.0 10.1.2.0 netmask 255.255.255.0

Using Static PAT

This section describes how to configure a static port translation. Static PAT lets you translate the real IP

address to a mapped IP address, as well as the real port to a mapped port. You can choose to translate

the real port to the same port, which lets you translate only specific types of traffic, or you can take it

further by translating to a different port.

Figure 14-22 shows a typical static PAT scenario. The translation is always active so both translated and

remote hosts can originate connections, and the mapped address and port is statically assigned by the

static command.

Figure 14-22 Static PAT

When you add a static PAT rule, the security appliance automatically enacts an additional internal

dynamic PAT rule. This internal rule is necessary to permit applications that are multistreams (FTP, RSH,

SQL*Net, SIP, H.323, or CTIQBE) so that they can transparently communicate through the security

appliance.

10.1.1.1:23 209.165.201.1:23

Inside Outside

10.1.1.2:8080 209.165.201.2:80

130044

Security

Appliance

1 2 ... 247 248 249 250 251 252 253 254 255 256 257 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 252

Comentarios a estos manuales