Cisco PIX 525 Especificações descarregar pdf (Página 76)

2-16

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Configuring the PIX Firewall for Routing

A router that has interfaces in multiple areas is called an Area Border Router (ABR). A router that

redistributes traffic or imports external routes (Type 1 or Type 2) between routing domains is called an

Autonomous System Boundary Router (ASBR).

An ABR uses link-state advertisements (LSA) to send information about available routes to other OSPF

routers. Using ABR type 3 LSA filtering, you can have separate private and public areas with the

PIX

Firewall acting as an ABR. Type 3 LSAs (inter-area routes) can be filtered from one area to another.

This lets you use NAT and OSPF together without advertising private networks.

Note Only type 3 LSAs can be filtered. If you configure PIX Firewall as an ASBR in a private network, it will

send type 5 LSAs describing private networks, which will get flooded to the entire AS including public

areas.

If NAT is employed but OSPF is only running in public areas, then routes to public networks can be

redistributed inside the private network, either as default or type 5 AS External LSAs. However, you

need to configure static routes for the private networks protected by the PIX

Firewall. Also, you cannot

mix public and private networks on the same PIX

Firewall interface.

OSPF Features Supported

The following is a list of OSPF features supported by PIX Firewall Version 6.3:

• Support of intra-area, inter-area and External (Type I and Type II) routes

• Support for virtual links

• OSPF LSA flooding

• Authentication for OSPF packets (both clear text and MD5 authentication)

• Support for configuring the PIX Firewall as a designated router (DR) or ABR

• Support for configuring the PIX Firewall as an ASBR, with route redistribution between OSPF

processes including OSPF, static, and connected routes

• Support for stub areas and not so stubby areas (NSSA)

• ABR type 3 LSA filtering

• Load balancing among a maximum of three peers on a single interface, using Equal Cost Multipath

Routes (ECMP).

Note If using ECMP, note that the default cost for a Fast Ethernet link on the PIX Firewall is consistent

with a Cisco Firewall Services Module (FWSM) but differs from a Cisco IOS router.

Table 2-4 summarizes the OSPF commands that are supported or that are not supported in PIX Firewall

Version 6.3. For the detailed syntax of each command, refer to the Cisco IOS Release 12.2(3a)

documentation or to the Cisco PIX

Firewall Command Reference.

Ta b l e 2-4 Cisco IOS OSPF Commands Supported in PIX Firewall Version 6.3

OSPF Command

Supported OSPF Command Supported OSPF Command Supported

area authentication

yes

ip ospf dead-interval

yes

show ip ospf flood-list

yes

area default-cost

yes

ip ospf flood-reduction

show ip ospf interface

yes

area filter-list

yes

ip ospf hello-interval

yes

show ip ospf neighbor

yes

1 2 ... 71 72 73 74 75 76 77 78 79 80 81 ... 465 466

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 76

Comentários a estes Manuais

Manuais e produtos relacionados com Sistemas de segurança - controlo de acesso Cisco PIX 525