资源描述：
《PIX防火墙NAT高级配置》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、Chapter6CiscoPIXFirewallTranslationsSecurityBootcamp'2001,CiscoSystems,Inc.Allrightsreserved.1CSPFA2.16-1ObjectivesUponcompletionofthischapter,youwillbeabletoperformthefollowingtasks:DescribehowtheTCPandUDPprotocolsfunctionwithinthePIXFirewall.Describehowstaticanddynamictr
2、anslationsfunction.ConfigureinboundandoutboundaccessthroughthePIXFirewall.TestandverifycorrectPIXFirewalloperation.SecurityBootcamp'2001,CiscoSystems,Inc.Allrightsreserved.2TransportProtocolsSecurityBootcamp'2001,CiscoSystems,Inc.Allrightsreserved.3CSPFA2.16-3SessionsinanI
3、PWorldInanIPworld,anetworksessionisatransactionbetweentwoendsystems.Itiscarriedoutovertwotransportlayerprotocols:TCP(TransmissionControlProtocol)UDP(UserDatagramProtocol)SecurityBootcamp'2001,CiscoSystems,Inc.Allrightsreserved.4TCPTCPisaconnection-oriented,reliable-deliver
4、y,robust,andhighperformancetransportlayerprotocol.TCPfeaturesSequencingandacknowledgementofdataAdefinedstatemachine(openconnection,dataflow,retransmit,closeconnection)CongestionmanagementandavoidancemechanismsSecurityBootcamp'2001,CiscoSystems,Inc.Allrightsreserved.5TCP
5、InitializationInsidetoOutsidePrivatenetworkThePIXFirewallchecksforPublicnetworkSourceaddr1100..00..00..33atranslationslot.Ifoneis119922..116688..00..2200notfound,itcreatesoneDestinationaddr117722..3300..00..5500afterverifyingNAT,global,117722..3300..00..5500accesscontrol,a
6、ndSourceport11002266authenticationor11002266Destinationport2233authorization,ifany.IfOK,2233aconnectioniscreated.Initialsequence#44990099114499776699AckPIXFirewall#1#210.0.0.3FlagSSyynnSSyynn172.30.0.50StarttheembryonicNodataconnectioncounter#3#4117722..3300..00..550011772
7、2..3300..00..5500ThePIXFirewallfollowsthe1100..00..00..33119922..116688..00..2200AdaptiveSecurityAlgorithm:2233(SrcIP,SrcPort,2233DestIP,DestPort)check1100226611002266SequencenumbercheckIPheader9922551133Translationcheck9922551133TCPheader44990099224499777700Ifthecodebitis
8、notsyn-ack,SSyynn--AAcckkPIXdropsthepacket.SSyynn--AAcckkSecurityBootcamp'2001,CiscoSyste
