Cisco PIX 520 - PIX Firewall 520, Online Help Manual

Page: 153 / 256

Hosts/Networks>Add>NAT
In the Create host/network>NAT (Network Address Translation) dialog box, you can define two types of
address translation rules enforced by a PIX Firewall when network packets destined to or originating from the
selected host or network are transferred between two interfaces attached to the PIX Firewall unit (inter-interface
communications). In this dialog box, you can only define translation rules between the selected interface and
interfaces of lower security levels. You cannot define NAT rules for networks or hosts defined on the interface
with the lowest security level (typically, the outside interface).
Note: Both translation rules and access rules are required for the PIX Firewall to allow hosts on low security
interfaces to initiate connections to hosts on high security interfaces. The translation rules are necessary to create
mapping of the actual address of the host on the high security interface to the address that it will be identified as
on the low security interface. The access rules can then permit or deny traffic to the host on the high security
interface.
For the selected host or network, you can define up to one type of NAT rule per interface. The following types of
NAT rules are valid:
Static—Static NAT rules expose all IP services on an internal host to external users. They also override
dynamic NAT rules that apply to a specific host or network. Static rules expose the address of the host or
network on higher security interfaces to hosts on lower security interfaces, making those addresses visible
to the lower security interface. In this case, hosts with static address translations on either interface can
initiate connections assuming the appropriate access rules are defined to enable the connections. For more
information on static NAT and its uses, refer to
Understanding Static NAT .
●
Dynamic—Dynamic NAT rules map between external, exposed IP address(es) and an internal network or
host address. They hide specific networks and hosts behind a higher security interface from hosts on lower
security interfaces. When using dynamic NAT rules, hosts behind the higher security interfaces can initiate
connections to hosts behind lower security interfaces, but hosts behind lower security interfaces cannot
initiate connections to the hosts behind the higher security interface. This effect results from the fact that
such addresses are dynamically assigned by the PIX Firewall unit, rather than statically defined as static
NAT rules.
For the selected host or network, which resides behind the higher security interface, you can dynamically
map its address to one of the following dynamic rule types:
Address pool ID—A pool can be defined as a range of IP addresses, a Port Address Translation
(PAT) for a single, valid IP address for the less secure interface, or the IP address assigned to that
less secure interface. This type of rule allows hosts routed through an interface with a higher security
level to conduct sessions between hosts reached through an interface with a lower security level
without exposing the addresses behind the interface with the higher security level.
❍
Same address—Specifies that the PIX Firewall unit use the original address of the network or host.
When translation rules of this type are defined, the PIX Firewall does not modify the packet headers.
❍
●