Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Руководство по настройке, Страница: 111 / 742

5-5
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 5 Configuring the Firewall Mode
Routed Mode Overview
The following steps describe how data moves through the FWSM (see Figure 5-3 ):
1. A user on the inside network requests a web page from the DMZ web server using the destination
address of 10.1.1.3.
2.
The FWSM receives the packet and because it is a new session, the FWSM verifies that the packet
is allowed according to the terms of the security policy (access lists, filters, AAA).
For multiple context mode, the FWSM first classifies the packet according to either a unique
interface or a unique destination address associated with a context; the destination address is
associated by matching an address translation in a context. In this case, the interface is unique; the
web server IP address does not have a current address translation.
3.
The FWSM then records that a session is established and forwards the packet out of the DMZ
interface.
4. When the DMZ web server responds to the request, the packet goes through the fast path, which lets
the packet bypass the many lookups associated with a new connection.
5.
The FWSM forwards the packet to the inside user.
An Outside User Attempts to Access an Inside Host
Figure 5-4 shows an outside user attempting to access the inside network.
Figure 5-4 Outside to Inside
www.example.com
User
10.1.2.27
209.165.201.2
10.1.1.1 10.1.2.1
Outside
Inside DMZ
92891
FWSM