Cisco PIX 525 Especificaciones descargar pdf (Pagina 117)

3-5

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Using the Static Command for Port Redirection

Use the deny parameter to restrict specific types of access. For example, to prevent hosts belonging to

the 192.168.1.0 network on the inside interface from starting connections on the outside interface and to

permit all others, specify the 192.168.1.0 network address as the source address and the network

connected to the outside interface as the destination address. In the example that follows, the network

on the outside interface is 209.165.201.0. The access-list and access-group command statements are as

follows.

access-list acl_in deny tcp 192.168.1.0 255.255.255.224 209.165.201.0 255.255.255.224

access-list acl_in permit ip any any

access-group acl_in in interface inside

You can also use access lists to prevent access to a specific server. For example, if you want to restrict

hosts on the inside interface from accessing a website at address 209.165.201.29 on the outside interface,

use the following commands.

access-list acl_in deny tcp any host 209.165.201.29 eq www

access-list acl_in permit ip any any

access-group acl_in in interface inside

These commands let any hosts start connections, but not to 209.165.201.29. The access-group command

specifies that the hosts are on the inside interface.

Note You can use URL filtering for greater control of outbound access to web sites, as described in the

“Filtering URLs with Internet Filtering Servers” section on page 3-32.”

Using the Static Command for Port Redirection

This section describes the port redirection feature, introduced in PIX Firewall Version 6.0. It includes

the following topics:

• Overview, page 3-5

• Port Redirection Configuration, page 3-6

• Port Redirection Example, page 3-7

Overview

Port redirection allows hosts on a lower security interface to connect to a particular IP address and port

and to have the PIX

Firewall redirect the traffic to the appropriate server on a higher security interface.

The shared address can be a unique address, a shared outbound PAT address, or an address shared with

the external interface. To implement port redirection, use the following command.

static [(internal_if_name, external_if_name)] {tcp|udp} {global_ip|interface} global_port

local_ip local_port [netmask mask]

For an explanation of this command syntax, refer to the Cisco PIX Firewall Command Reference.

1 2 ... 112 113 114 115 116 117 118 119 120 121 122 ... 465 466

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 117