Cisco PIX 525 Especificações descarregar pdf (Página 439)

D-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Appendix D TCP/IP Reference Information

Using Subnet Masks

Uses for Subnet Information

Use subnet information to ensure that your host addresses are in the same subnet and that you are not

accidentally using a network or broadcast address for a host.

The network address provides a way to reference all the addresses in a subnet, which you can use in the

global, outbound, and static commands. For example, you can use the following net static command

statement to map global addresses 192.168.1.65 through 192.168.1.126 to local addresses 192.168.2.65

through 192.168.2.126:

static (dmz1,dmz2) 192.168.1.64 192.168.2.64 netmask 255.255.255.192.

Subnet mask information is especially valuable when you have disabled Network Address Translation

(NAT) using the nat 0 command. PIX

Firewall requires that IP addresses on each interface be in different

subnets.

However all the hosts on a PIX Firewall interface between the PIX Firewall and the router must be in the

same subnet as well. For example, if you have an address such as 192.168.17.0 and you are not using

NAT, you could use the 255.255.255.192 subnet mask for all three interfaces and use addresses

192.168.17.1 through 192.168.17.62 for the outside interface, 192.168.17.65 through 192.168.17.126

for the perimeter interface, and 192.168.17.129 through 192.168.17.190 for the inside interface.

Using Limited IP Addresses

Another use for subnet mask information is for network planning when an Internet service provider (ISP)

gives you a limited number of IP addresses and requires you to use a specific subnet mask. Use the

information in this appendix to ensure that the outside addresses you choose are in the subnet for the

appropriate subnet mask.

For example, if your ISP assigns you 192.168.17.176 with a subnet mask of .240, you can see in

Table D-7, subnet number 12 for the .240 mask, that hosts can have IP addresses of 192.168.17.177

through 192.168.17.190. Because this only yields 14 hosts, you will probably use one for your router,

another for the outside interface of the PIX

Firewall, one for a static for a web server, if you have it, one

for a static for your mail server, and the remaining 10 for global addresses. One of these addresses should

be a PAT address so that you do not run out of global addresses.

Addresses in the .128 Mask

Table D-4 lists valid addresses for the .128 subnet mask. This mask permits up to 2 subnets with enough

host addresses for 126 hosts per subnet.

Ta b l e D-4 .128 Network Mask Addresses

Subnet Number

Network

Address

Starting Host

Address

Ending Host Address Broadcast Address

1 .0 .1 .126 .127

2 .128 .129 .254 .255

1 2 ... 434 435 436 437 438 439 440 441 442 443 444 ... 465 466

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 439

Comentários a estes Manuais

Manuais e produtos relacionados com Sistemas de segurança - controlo de acesso Cisco PIX 525