An Outside User Attempts To Access An Inside Host - Cisco PIX 500 Series Configuration Manual

Chapter 15 Firewall Mode Overview
3.
4.
5.

An Outside User Attempts to Access an Inside Host

Figure 15-4
Figure 15-4
The following steps describe how data moves through the security appliance (see
1.
2.
OL-12172-03
For multiple context mode, the security appliance first classifies the packet according to either a
unique interface or a unique destination address associated with a context; the destination address
is associated by matching an address translation in a context. In this case, the interface is unique;
the web server IP address does not have a current address translation.
The security appliance then records that a session is established and forwards the packet out of the
DMZ interface.
When the DMZ web server responds to the request, the packet goes through the fast path, which lets
the packet bypass the many lookups associated with a new connection.
The security appliance forwards the packet to the inside user.
shows an outside user attempting to access the inside network.
Outside to Inside
www.example.com
Outside
209.165.201.2
10.1.2.1 10.1.1.1
Inside
User
10.1.2.27
A user on the outside network attempts to reach an inside host (assuming the host has a routable
IP address).
If the inside network uses private addresses, no outside user can reach the inside network without
NAT. The outside user might attempt to reach an inside user by using an existing NAT session.
The security appliance receives the packet and because it is a new session, the security appliance
verifies if the packet is allowed according to the security policy (access lists, filters, AAA).
DMZ
Cisco Security Appliance Command Line Configuration Guide
Routed Mode Overview
Figure 15-4):
15-5