This chapter looked at some of those features and commands
required to allow data to pass efficiently through the firewall. The Adaptive
Security Algorithm (ASA) was addressed to understand better how the PIX Firewall
determines which traffic patterns to allow and which to deny. The basic
higher-security to lower-security level flow was expanded to indicate that
returning traffic is always approved, unless it’s specifically blocked by
ACLs.
Static translations create a one-to-one permanent IP address xlate
table entry, which can then be enabled with an ACL to create potentially many
connections. Static translations are generally used to allow access to shared
resources, such as servers. NAT and PAT are used to create temporary, one-to-one
xlate table entries, allowing returning traffic from forays into lower security
areas. If NAT and PAT are used together, any available NAT address is used
before any PAT translations occur.
PIX access lists are created and applied much like those in the
Cisco IOS, except they’re always implemented inbound on an interface.
Three filter commands can be used to block
potentially destructive or unpleasant web resources from the network. The Filter ActiveX command blocks Active X objects from web pages.
The Filter Java command does the same thing to Java applets.
And, the Filter URL command works with either an N2H2 or a
Websense server to filter content based on an extensive database. Filter URL
also offers web tracking and custom blocking features.
PIX OS v6.2 introduced the concept of object groups that allows a
group of similar items to be defined, and then uses ACLs to assign permissions
and/or restrictions to the group. An object group can be networks, services,
ICMP message types, or protocols. If you understand grouping, you can achieve
tremendous savings in configuration time and space on large, complex
configurations.
The PIX Firewall doesn’t support routing between the interfaces,
but it does use a form of static and default routes to direct traffic. It’s
possible to enable RIP on individual interfaces, allowing the firewall to learn
about the attached networks.
Sections
Comments (0 posted)
Syndication
