Brocade Communications Systems 12.4.00a Manual De Usuario
82
ServerIron ADX Security Guide
53-1002440-03
Using ACLs and NAT on the same interface (flow-based ACLs)
2
Using ACLs and NAT on the same interface (flow-based ACLs)
You can use ACLs and NAT on the same interface, as long as you follow these guidelines:
•
You must use the ip strict-acl-tcp command when configuring ACLs and NAT is configured on
the same Layer 2 Switch. (Refer to the instructions below on how to use this command.)
the same Layer 2 Switch. (Refer to the instructions below on how to use this command.)
•
Do not enable NAT on an interface until you have applied ACLs (as described below) to the
interface. If NAT is already enabled, you must disable it, apply the ACLs, then re-enable NAT on
the interface.
interface. If NAT is already enabled, you must disable it, apply the ACLs, then re-enable NAT on
the interface.
•
Enable the strict TCP mode.
•
On the inside NAT interface (the one connected to the private addresses), apply inbound ACLs
that permit TCP, UDP, and ICMP traffic to enter the device from the private sub-net.
that permit TCP, UDP, and ICMP traffic to enter the device from the private sub-net.
You can use a standard ACL to permit all traffic (including TCP, UDP, and ICMP traffic) or an
extended ACL with separate entries to explicitly permit TCP, UDP, and ICMP traffic.
extended ACL with separate entries to explicitly permit TCP, UDP, and ICMP traffic.
NOTE
You do not need to apply ACLs to permit TCP, UDP, and ICMP traffic unless you are applying other
ACLs to the interface as well. If you do not plan to apply any ACLs to a NAT interface, then you do not
need to apply the ACLs to permit TCP, UDP, and ICMP traffic.
ACLs to the interface as well. If you do not plan to apply any ACLs to a NAT interface, then you do not
need to apply the ACLs to permit TCP, UDP, and ICMP traffic.
Here is an example of how to configure device to use ACLs and NAT on the same interfaces. In this
example, the inside NAT interface is port 1/1 and the outside NAT interface is port 2/2.
example, the inside NAT interface is port 1/1 and the outside NAT interface is port 2/2.
The following commands enable the strict TCP mode and configure an ACL to permit all traffic from
the 10.10.200.x sub-net. A second ACL denies traffic from a specific host on the Internet.
the 10.10.200.x sub-net. A second ACL denies traffic from a specific host on the Internet.
protocol-unreachable
3
2
reassembly-timeout
11
1
redirect
NOTE: This includes all redirects.
NOTE: This includes all redirects.
5
x
router-advertisement
9
0
router-solicitation
10
0
source-host-isolated
3
8
source-quench
4
0
source-route-failed
3
5
time-exceeded
11
x
timestamp-reply
14
0
timestamp-request
13
0
ttl-exceeded
11
0
unreachable
NOTE: This includes all unreachable messages
NOTE: This includes all unreachable messages
3
x
TABLE 5
ICMP message types and codes
ICMP message type
Type
Code