Understanding the conversion and connectivity of Cisco PIX firewalls

1.ASA Security Level

By default, the Cisco PIX firewall applies security levels to each interface. The more secure the network segment, the higher the full level. Security levels range from 0~100, by default, security level 0 is adapted to E0, and its default name is external (outside), and security level 100 is suitable for E1. And its default name is inside. Use the name if to configure any additional interfaces, security levels in the 1~ Between 99

e.g:

Nameif Ethernet0 outside Security0

Nameif Ethernet1 inside security100

Nameif Ethernet2 DMZ security50

1.1 The Adaptive Security Algorithm (ASA) allows traffic to flow from a high security level segment to a low security level segment and does not require a particular rule to be used in the security policy to allow these connections, and it is only possible to configure these interfaces with a single nat/global command.

1.2 At the same time, if you want a low security level segment to flow to a high security level segment, traffic must go through security policies (such as ACLs or conduit).

1.3 If you set the security level of the two interfaces to the same, the traffic cannot flow through these interfaces. Remember that ASA is the key to state connection control on the Cisco PIX Firewall.

2. Transmission protocol

2.1 First please understand the OSI 7-layer model, to be honest, if you want to do it, then this OSI 7 layer model must understand, also like Windows DNS, must spend time on it. The 1~7 is from the physical layer up, the physical layer is the first layer, the application layer is the seventh layer.

Application-tier data

Presentation Layer Data

Session-level data

Transport Layer Segment

Network Layer Packet

Data Link Layer Frame

Physical Layer Bit

2.2 Learn about TCP/IP

Popular speaking TCP/IP contains two transport protocols tcp,udp, of course, including other, TCP/IP is a protocol family, is a realization of the OSI theory, is really applied to the network of an industrial protocol family.

tcp-It is a connection based transport protocol, responsible for the reliability and efficiency of communication between nodes, through the creation of virtual circuits connection source and destination to act as two-way communication to accomplish these tasks, because the overhead is very large, so the transmission speed is slow. udp-It is a connectionless transport protocol that is used to send data to the destination.

Understanding TCP communication between nodes without PIX (three-time handshake)

Understand that there is a pix of TCP communication between nodes

2.3 Note The default security policy allows UDP packets to be sent from a high security level segment to a low security level segment.

The Cisco PIX Firewall handles UDP traffic in the following ways:

2.3.1 source and its starting UDP connection, the Cisco PIX firewall receives the connection and routes it to the destination. The PIX applies the default rule and any required transformations, creates a session object in the state table, and allows the connection to pass through an external interface.

2.3.2 any return traffic to match the drawing object, and the application session timeout, the default session timeout is 2 minutes. If the response does not match the session object, or times out, the grouping is discarded, and if all matches, the response signal is allowed to be transmitted to the source of the sending request