Cisco PIX 525 Especificaciones descargar pdf (Pagina 253)

14-27

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 14 Applying NAT

Using Static PAT

For example, configure the following static PAT command:

static (inside,outside) tcp 192.150.49.10 21 10.1.1.10 21

Then, the security appliance automatically enacts the following nat and global commands. These

internal rules are not added to your configuration, and you cannot alter them at the CLI.

nat (inside)

system-internal-id

10.1.1.10

global (outside)

system-internal-id

192.150.49.10

You cannot use the same real or mapped address in multiple static statements between the same two

interfaces. Do not use a mapped address in the static command that is also defined in a global command

for the same mapped interface.

For more information about static PAT, see the “Static PAT” section on page 14-7.

Note If you remove a static command, existing connections that use the translation are not affected. To remove

these connections, enter the clear local-host command.

You cannot clear static translations from the translation table with the clear xlate command; you must

remove the static command instead. Only dynamic translations created by the nat and global commands

can be removed with the clear xlate command.

To configure static PAT, enter one of the following commands.

• For policy static PAT, enter the following command:

hostname(config)# static (

real_interface

mapped_interface

) {tcp | udp} {

mapped_ip

interface}

mapped_port

access-list

acl_name

[dns] [norandomseq] [[tcp]

tcp_max_conns

[

emb_limit

]] [udp

udp_max_conns

]

Create the access list using the access-list command (see the “Adding an Extended Access List”

section on page 13-9). The protocol in the access list must match the protocol you set in this

command. For example, if you specify tcp in the static command, then you must specify tcp in the

access list. Specify the port using the eq operator. This access list should include only permit ACEs.

The source subnet mask used in the access list is also used for the mapped addresses. Policy NAT

does not consider the inactive or time-range keywords; all ACEs are considered to be active for

policy NAT configuration.

If you specify a network for translation (for example, 10.1.1.0 255.255.255.0), then the security

appliance translates the .0 and .255 addresses. If you want to prevent access to these addresses, be

sure to configure an access list to deny access.

See the “Configuring Dynamic NAT or PAT” section on page 14-22 for information about the other

options.

• To configure regular static PAT, enter the following command:

hostname(config)# static (

real_interface

mapped_interface

) {tcp | udp} {

mapped_ip

interface}

mapped_port real_ip real_port

[netmask

mask

] [dns][norandomseq] [[tcp]

tcp_max_conns

[

emb_limit

]] [udp

udp_max_conns

]

See the “Configuring Dynamic NAT or PAT” section on page 14-22 for information about the

options.

1 2 ... 248 249 250 251 252 253 254 255 256 257 258 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 253

Comentarios a estos manuales