Cisco Catalyst 6500 Series Configuration Manual page 65

Chapter 4 Configuring the Firewall Mode
Figure 4-5
The steps below describe how data moves through the FWSM (see
A user on the outside network attempts to reach an inside host (assuming the host has a routable
1.
IP address).
If the inside network uses private addresses, no outside user can reach the inside network without
NAT. The outside user might attempt to reach an inside user by using an existing NAT session.
The FWSM receives the packet, and because it is a new session, the FWSM verifies if the packet is
2.
allowed according to the security policy (ACLs, filters, AAA).
The packet is denied, and the FWSM drops the packet and logs the connection attempt.
3.
If the outside user is attempting to attack the inside network, the FWSM employs many technologies
to determine if a packet is valid for an already established session. See the
Features" section on page 1-6
OL-6392-01
Outside to Inside
www.cisco.com
Outside
Switch
209.165.201.2
FWSM
10.1.2.1 10.1.1.1
Inside
User
10.1.2.27
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
DMZ
for more information.
Firewall Mode Overview
Figure 4-5):
"Other Protection
4-7