6第六课在PIX上实现NAT.pptVIP

学习目标 完成NAT在PIX防火墙上的应用原理，种类及配置。 课程内容 1：NAT在PIX上的应用特点 2：NAT转换方向 3：NAT-control 4：静态NAT 基于IP网络的两大协议 在IP的网络中，两台终端系统之间的会话是靠两大协议完成的: TCP UDP TCP TCP协议是面向连接的，高可靠性，健全的传输层协议 TCP features: 三次握手 拥塞避免机制 窗口机制 TCP Initialization: Inside to Outside TCP Initialization: Inside to Outside (Cont.) UDP 无连接协议 对于某些服务，UDP协议效率很高 使用范围广泛，但不安全 UDP (Cont.) 网络地址转换 建立NAT可以解决如下问题： 减少地址浪费 使用私有地址进行标识 有效保护内部网络 访问通过安全设备 Inside Address Translation 内部地址转换是高优先级别到低优先级别接口的转换 动态转换 静态转换 第六课 在PIX上实现NAT ? 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—4-* Security Appliance TCP Header IP Header The security appliance checks for a translation slot. If one is not found, it creates one after verifying NAT, global, access control, and authentication or authorization, if any. If OK, a connection is created. 10.0.0.11 The security appliance utilizes the stateful packet inspection algorithm: Source IP, source port,  destination IP, destination  port check Sequence number check Translation check # 1 172.30.0.50 # 2 # 3 # 4 Start the embryonic connection counter. No Data Private Network Source Port Destination Address Source Address Initial Sequence # Destination Port Flag ACK 172.30.0.50 10.0.0.11 1026 23 49091 Syn 10.0.0.11 172.30.0.50 23 1026 92513 Syn-Ack 49092 Public Network 172.30.0.50 192.168.0.20 49769 Syn 192.168.0.20 172.30.0.50 23 1026 92513 Syn-Ack 49770 1026 23 Private Network Public Network Security Appliance The security appliance Reset the embryonic counter for this client.. It then increases the connection counter for this host. # 5 # 6 The security appliance Strictly enforces the stateful packet inspection algorithm. Data Flows 172.30.0.50 192.168.0.20 1026 23 49770 Ack 92514 Source Port Destination Address Source Address Initial Sequence # Destination Port Flag ACK 172.30.0.50 10.0.0.11 1026 23 49092 Ack 92514 TCP Header IP Header 10.0.0.11 172.30.0.50 Security Appliance UDP Header IP Header The security appliance checks for a translation slot. If one is not found, it create