Cisco PIX 525 Specifikace stáhnout pdf (Strana 75)

2-15

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Configuring the PIX Firewall for Routing

The “1” at the end of the command statement specifies how many hops (routers) the router is from the

PIX

Firewall. Because it is the first router, you use 1.

Step 3 Add the static routes for the dmz4 interface:

route dmz4 192.168.7.0 255.255.255.0 192.168.4.2 1

route dmz4 192.168.8.0 255.255.255.0 192.168.4.2 1

These command statements direct packets intended to the 192.168.6.0 and 192.168.7.0 networks back

through the router at 192.168.4.2.

Using OSPF

This section describes how the Open Shortest Path First (OSPF) routing protocols are implemented in

PIX

Firewall Version 6.3. It includes the following topics:

• Overview, page 2-15

• Security Issues When Using OSPF, page 2-15

• OSPF Features Supported, page 2-16

• Restrictions and Limitations, page 2-17

Overview

PIX Firewall Version 6.3 introduces support for dynamic routing using the Open Shortest Path First

(OSPF) routing protocol. OSPF is widely deployed in large internetworks because of its efficient use of

network bandwidth and its rapid convergence after changes in topology.

Note OSPF is not supported on the PIX Firewall 501.

The OSPF functionality in PIX Firewall Version 6.3 is similar to that provided by Cisco IOS

Release12.2(3a). For details about the syntax for each command and subcommand used to manage

OSPF, refer to the Cisco

PIX Firewall Command Reference or to Cisco IOS software documentation.

Security Issues When Using OSPF

Authentication should be used with all routing protocols when possible because route redistribution

between OSPF and other protocols (like RIP) can potentially be used by attackers to subvert routing

information. If MD5 authentication is used on all segments, security should not be an issue with OSPF.

When using dynamic routing, the physical security of the PIX Firewall is of increased importance.

Access to the physical device and configuration information should be kept secure. Shared-keys should

be changed at a reasonable interval.

As part of its normal operation, OSPF advertises routes to networks, and this may not be desirable in

many PIX

Firewall implementations. You may need to prevent networks from being advertised

externally when using private addressing or when required by your security policy.

If NAT is used, if OSPF is operating on public and private areas, and if address filtering is required, then

you need to run two OSPF processes—one process for the public areas and one for the private areas.

1 2 ... 70 71 72 73 74 75 76 77 78 79 80 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 75

Komentáře k této Příručce

Související produkty a manuály pro Bezpečnostní systémy pro řízení přístupu Cisco PIX 525