Alcatel AST570, Руководство пользователя

Страница: 224 / 300

AST570 Firewall and
NAPT
17 Security Services - Firewalling
224 / 300
3EC 17766 AAAA TCZZA Ed. 04
17.5 Firewalling and NAPT
The position of the Input, Static NA(P)T, Dynamic NA(P)T, Forward
and Output logical processing modules in the overall AST570
Firewall model is relative to the traffic direction. In contrast, the
AST570 ' WAN and (W)LAN interfaces are physical interfaces;
their position is not relative to the traffic direction.
The Dynamic NA(P)T module is situated between the Forward and
Output hook (See AST570 Firewall model). Since the traffic
direction will determine input, and output, the Dynamic NA(P)T
module can always be positioned between the Forward and
Output module.
If you set rules on a hook, you should know if the packets that
pass through that hook contain IP addresses that are
NA(P)Ttranslated or not.
If rules are set on the Output hook and NA(P)T is active, the IP
packets that pass that hook will contain translated IP addresses.
If you want to avoid certain traffic, by setting rules that filter on
certain (ranges of) IP addresses, you should be aware of the
location where the rule will be verified, since, depending on the
hook, another IP address will be seen by the Firewall.
As a conclusion: if NA(P)T is activated, the IP address that
identifies a local device, will be different depending on the
direction of the traffic.