Cisco PIX 525 Especificaciones descargar pdf (Pagina 116)

3-4

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Controlling Outbound Connectivity

• Use the first port parameter after an operator to identify the protocol port used by the source host

that initiates the connection.

• Replace destination_address with the host or network global address that you specified with the

static command statement. For a host address, precede the address with host; for networks, specify

the network address and the appropriate network mask.

• Use the second port parameter after an operator to specify the protocol port used by the destination

host. For example, to identify a web server, use eq http or eq 80. For an email server, use eq smtp

or eq 25. For a complete list of permitted keywords and well-known port assignments, see “

Ports”

in Appendix D, “TCP/IP Reference Information.”

Two access-list command statement definitions are required to permit access to the following ports:

–

DNS, Discard, Echo, Ident, NTP, RPC, SUNRPC, and Talk each require one definition for TCP

and one for UDP.

–

TACACS+ requires one definition for port 49 on TCP.

The format for the access-group command is as follows:

access-group ID in interface low_interface

Replace ID with the same identifier that you specified in the access-list command statement.

Replace low_interface with the lower security interface that you specified in the static command

statement. This is the interface through which users will access the external (global) address.

The following example illustrates the three commands required to enable access to a web server with the

external IP address 209.165.201.12:

static (inside, outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255 0 0

access-list acl_out permit tcp any host 209.165.201.12 eq www

access-group acl_out in interface outside

This example uses the same static command that was shown in the previous section.

Controlling Outbound Connectivity

By default, all connections initiated on a network with a higher security level are allowed out, and you

configure any restrictions required. You can control outbound access by IP address and protocol port, or

combine access control with user authentication, as described in “

Using Authentication and

Authorization.” If you are not enforcing restrictions on outbound network traffic, outbound access lists

are not required.

An outbound access list lets you restrict hosts from starting outbound connections or lets you restrict

hosts from accessing specific destination addresses or networks. Access lists work on a first-match basis,

so for outbound access lists, you must permit first and then deny after.

For example, you could restrict some hosts from accessing web sites or permit others access. Define

access restrictions with the access-list command, and use the access-group command to bind the

access-list command statements to an interface.

When creating an outbound access list, the basic syntax for the access-list command statement is the

same as shown earlier in “

Enabling Inbound Connections:”

access-list ID {deny|permit} protocol source_address [operator port] destination_address

[operator port]

1 2 ... 111 112 113 114 115 116 117 118 119 120 121 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 116

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525