Cisco PIX 520 - PIX Firewall 520, Онлайн руководство пользователя

Страница: 129 / 256

Example of a Static PAT Rule
The NAT table displays all static PAT rules first, followed by the normal static NAT rules, and then the dynamic
NAT rules. No new column is introduced in the table. The contents of "Original Address" and "Translated
Address" columns are extended to show service mapping for static PAT rules.
Rule Original Translated
Type Interface Address Interface Address
inside
209.165.201.1
Port 8000/tcp
outside
Interface IP
Port 80/tcp
The Rule Type column lists whether the rule type is Static or Dynamic. A static translation shows the static
icon.
●
The Original column lists where the translation originates, including what interface, IP addresses, Port
number/protocol are translated.
●
The Translated column lists the interface where the translation occurs, and what IP addresses, Port
number/protocol are presented to connections on that interface.
●
How PDM Handles Redundant or Overlapping
Translation Rules
Definition of terms:
Redundant: If there exists two or more NAT rules in a configuration to translate an IP address, and the resulted
translations are identical, the rules are called "redundant" to each other, for example:
static (in,out) 1.1.1.0 1.1.1.0 1.
static (in,out) 1.1.1.1 1.1.1.1 2.
For address 1.1.1.1, both rules will translate it to 1.1.1.1. However, translation may not be exactly identical, for
example:
static (in,out) 1.1.1.0 1.1.1.0 0 0 1.
static (in,out) 1.1.1.1 1.1.1.1 100 100 norandomseq 2.
Overlap: If there exists two or more NAT rules in a configuration to translate an address and the resulted
translations are different, the rules are overlapping each other, for example:.
static (in,out) 1.1.1.0 1.1.1.0 1.
static (in,out) 1.1.1.5 1.1.1.1 2.
PDM builds NAT rules in two cases: when PDM reads your current configuration and when you use PDM to
add/edit a NAT rule. PDM checks for NAT overlapping/redundancy only in the second case. If you use the CLI
to configure NAT, it is up to you to avoid overlapping/redundancy.
The following is a list of possible NAT overlapping/redundancy scenarios that will help you understand how
PDM behaves and why it does it this way. As you will see, some cases are not so obvious. One needs to
understand how PIX Firewall translates packets using the NAT configuration and the runtime xlate database to
see why a particular combination will fail at runtime, and thus should be prevented or warned when being