Simple NAT Question

[Guest_imported]

This is a basic question but recent happenings on a new installation have made me question my understanding of NAT.
My understanding is that all inside traffic is allowed out by default as long as there exists a translation rule, but no inbound traffic from the internet is permitted unless specifically granted in an access list applied on the outside interface.
Hence a translation like:
nat inside 1 10.1.80.0 255.255.255.0 0 0
would permit all people on the 10.1.80.0 network to access the internet, say for http, but if there were no e.g. access-list 101 permit tcp any host 10.1.80.0 255.255.255.0 eq

http://www they

would not get a reply.
Is this correct?
I have internal users who have access to the internet when my feeling is that they shouldn't.
There may however be some interaction between the access list I have on the outside interface and the one I have on the dmz interface.
Many thanks
Rob

 

[yizhar]

HI.

For outbound connections, you need both NAT and GLOBAL, not only NAT.
The return traffic is permitted automaticaly by the pix using statefull inspection of the traffic and creating dynamic access-lists (you don't see them in the configuration).
So you should NOT create access-list for return traffic.

You can limit outbound traffic using access-list on the inside interface, or with AAA but the last isn't a simple solution for users nor for the administrator.

For new-bie, I suggest using PDM for managing the pix access and translation rules.

You can also use pixcript for creating basic sample configuration:

http://teachers.sivan.co.il/yizhar#pixcript

And, you'll find this link very usefull:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/

Bye

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Guest_imported]

Thank you for the detailed response. I have been under a mis-apprehension about NAT. I was of course using the global command with the nat command but did not realise that the replies to outgoing traffic permitted by the above 2 commands were allowed back through the firewall without further permission. Hence I have a lot of redundant entries in the access-list/access-group allocated to the external interface as I thought I had to specifically allow them back in.
Unfortunately PDM is not much good if you are using IPSec. Since I added the IPSec commands PDM does not seem to be able to parse them and won't display the page any more.
I have used your Pixscript before with success though.
Many Thanks
Rob

 

[yizhar]

HI.

PDM can work fine with most configuration even with IPSec, ignoring the commands it can not parse.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar