Cisco PIX 525 Specifikace stáhnout pdf (Strana 254)

14-28

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 14 Applying NAT

Using Static PAT

For example, for Telnet traffic initiated from hosts on the 10.1.3.0 network to the security appliance

outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by entering the

following commands:

hostname(config)# access-list TELNET permit tcp host 10.1.1.15 eq telnet 10.1.3.0

255.255.255.0 eq telnet

hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet access-list TELNET

For HTTP traffic initiated from hosts on the 10.1.3.0 network to the security appliance outside interface

(10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by entering:

hostname(config)# access-list HTTP permit tcp host 10.1.1.15 eq http 10.1.3.0

255.255.255.0 eq http

hostname(config)# static (inside,outside) tcp 10.1.2.14 http access-list HTTP

To redirect Telnet traffic from the security appliance outside interface (10.1.2.14) to the inside host at

10.1.1.15, enter the following command:

hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask

255.255.255.255

If you want to allow the preceding real Telnet server to initiate connections, though, then you need to

provide additional translation. For example, to translate all other types of traffic, enter the following

commands. The original static command provides translation for Telnet to the server, while the nat and

global commands provide PAT for outbound connections from the server.

hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask

255.255.255.255

hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255

hostname(config)# global (outside) 1 10.1.2.14

If you also have a separate translation for all inside traffic, and the inside hosts use a different mapped

address from the Telnet server, you can still configure traffic initiated from the Telnet server to use the

same mapped address as the static statement that allows Telnet traffic to the server. You need to create

a more exclusive nat statement just for the Telnet server. Because nat statements are read for the best

match, more exclusive nat statements are matched before general statements. The following example

shows the Telnet static statement, the more exclusive nat statement for initiated traffic from the Telnet

server, and the statement for other inside hosts, which uses a different mapped address.

hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask

255.255.255.255

hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255

hostname(config)# global (outside) 1 10.1.2.14

hostname(config)# nat (inside) 2 10.1.1.0 255.255.255.0

hostname(config)# global (outside) 2 10.1.2.78

To translate a well-known port (80) to another port (8080), enter the following command:

hostname(config)# static (inside,outside) tcp 10.1.2.45 80 10.1.1.16 8080 netmask

255.255.255.255

1 2 ... 249 250 251 252 253 254 255 256 257 258 259 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 254

Komentáře k této Příručce