Cisco PIX 520 - PIX Firewall 520, Онлайн руководство пользователя

Страница: 97 / 256

Understanding Dynamic NAT
Dynamic NAT, commonly referred to as Network Address Translation (NAT), is the process of converting
between IP addresses used within an intranet or other private network (called a subdomain) and Internet IP
addresses (or external IP addresses on a PIX Firewall unit). This approach makes it possible to use a large number
of addresses within the subdomain without depleting the limited number of available numeric Internet IP
addresses.
In addition to conserving IP addresses, dynamic NAT provides additional security features for your network by
hiding its internal structure and allowing logical mappings to users who compose the different groups and
departments within your company. While some users may not need to use dynamic NAT, you should keep this
feature in mind as your network continues to grow.
The following sections describe what problems address hiding solves and how it works to solve these problems.
Why You Should Use Dynamic NAT
●
How Dynamic NAT Works
●
How Session Awareness and Port Mapping Affect Dynamic NAT
●
Why You Should Use Dynamic NAT
An address hiding translator, such as the software module that provides this feature for a PIX Firewall unit,
provides several benefits for your network:
Enhances network security by hiding your network's internal structure from external users and enables you
to logically group your users according to security domains.
●
Permits an almost unlimited number of users for one Class C network address because valid external
addresses are required only when a user is connected to the Internet.
●
When you attach your existing IP networks to the Internet, you do not need to replace the IP address of
each computer on your internal subnets with a valid, registered IP address from the Internet Network
Information Center (the American Registry for Internet Numbers [ARIN]).
●
As these benefits indicate, NAT overcomes several limitations associated with the current IP addressing
scheme. A discussion of these limitations follows.
●
Conceals Internal IP Addresses from Internet Users. As the network administrator, you may wish to conceal
internal network addresses from the Internet, which prevents them from being disclosed to possibly malicious
users. An address hiding translator dynamically assigns a valid external IP address to an internal IP address by
mapping the internal address to an external address. Because this mapping between the external and internal IP
addresses is temporary (it lasts only for the duration of a session or until the user-configured idle time-out value is
exceeded), your internal IP addresses are concealed from the Internet. Only the external addresses appear in the
packets that are distributed across the Internet.