Basic use of Cisco PIX Firewalls

1.interface command

When configuring the user interface, we often hear about the proper terminology of the interface.

HARDWARE_ID refers to Ethernet 0,e1,e2

Interface_name refers to OUTSIDE,INSIDE,DMZ

Hardware_speed, the production is set to Automatic, but Cisco recommends that we manually configure the speed. About speed and the network transport media you choose.

No shutdown user activates this port on router, in Pix, no no shutdown command, only use to shutdown this parameter, mainly used to manage shutdown interface.

Interface hardware_id Hardware_speed [shutdown]

Interface E0 Auto

Interface E1 Auto

Interface E2 Auto

2.nameif command

Nameif is primarily used to command an interface and assigns it a security value from 1 to 99, because both the external and internal interfaces are default, 0 and 100 respectively, and the E0 is the external interface by default, E1 refers to the internal interface.

Nameif hardware_id If_name Security_level

Nameif E0 outside 0

Nameif E1 inside 100

Nameif E2 DMZ 50

Use show Nameif to view configuration

As for the Security_level, please look at what I wrote earlier. From the High Security section of the flow to the Low security section of the flow how to go, let go, and what conditions need to flow into the outflow.

3.ip Address command

The IP address of the Cisco PIX interface can be obtained from two locations, namely manual and DHCP

IP address is used to manually configure IP addresses on an interface by adding a logical location to a hardware ID.

IP address if_name ip_address [netmask]

IP address inside 192.168.6.0 255.255.255.0

Remove the currently configured IP address Pix (config) #clear IP address (all IP address cleared)

Pix (config) #no IP address inside 192.168.6.0 255.255.255.0 (clear IP address for this interface)

4.Nat command

For a group of IP addresses to convert to another set of IP addresses, yesterday I saw 6.2 version support NAT outside IP address, I do not know what the environment is used, hehe

When using NAT command, there is a special note: Nat 0 has a special meaning, followed by Nat always used with global.

Nat (If_name) nat_id local_ip [Netmas]

Nat (inside) 1 192.168.6.0 255.255.255.0

5.Global command

The global command defines the address or address range that is converted with a NAT command, and note that the nat_id in the global command needs to be the same as the nat_id in the NAT command you configure.

Global (If_name) nat_id global_ipglobal_ip-global_ip [netmask]