An Inside User Visits A Web Server Using Nat - Cisco PIX 500 Series Configuration Manual

Chapter 15 Firewall Mode Overview

An Inside User Visits a Web Server Using NAT

Figure 15-8
Figure 15-9
209.165.201.0/27 through FWSM
The following steps describe how data moves through the security appliance (see
1.
2.
3.
4.
5.
6.
OL-12172-03
shows an inside user accessing an outside web server.
Inside to Outside with NAT
www.example.com
Static route on router to
Security
appliance
The user on the inside network requests a web page from www.example.com.
The security appliance receives the packet and adds the source MAC address to the MAC address
table, if required. Because it is a new session, it verifies that the packet is allowed according to the
terms of the security policy (access lists, filters, AAA).
For multiple context mode, the security appliance first classifies the packet according to a unique
interface.
The security appliance translates the real address (10.1.2.27) to the mapped address 209.165.201.10.
Because the mapped address is not on the same network as the outside interface, then be sure the
upstream router has a static route to the mapped network that points to the security appliance.
The security appliance then records that a session is established and forwards the packet from the
outside interface.
If the destination MAC address is in its table, the security appliance forwards the packet out of the
outside interface. The destination MAC address is that of the upstream router, 209.165.201.2.
If the destination MAC address is not in the security appliance table, the security appliance attempts
to discover the MAC address by sending an ARP request and a ping. The first packet is dropped.
The web server responds to the request; because the session is already established, the packet
bypasses the many lookups associated with a new connection.
Internet
Source Addr Translation
10.1.2.27
10.1.2.1
Management IP
10.1.2.2
Host
10.1.2.27
Cisco Security Appliance Command Line Configuration Guide
Transparent Mode Overview
209.165.201.10
Figure 15-8):
15-13