An Outside User Visits a Web Server on the DMZ
Figure 15-3 shows an outside user accessing the DMZ web server.
Figure 15-3 Outside to DMZ
User
Figure 15-3 Outside to DMZ
User
- 209.165.201.2
Dest Addr Translation
- Web Server 1G.1.1.3
CO o j Cisco Security Appliance Command Line Configuration Guide
The following steps describe how data moves through the security appliance (see Figure 15-3):
1. A user on the outside network requests a web page from the DMZ web server using the global destination address of 209.165.201.3, which is on the outside interface subnet.
2. The security appliance receives the packet and because it is a new session, the security appliance verifies that the packet is allowed according to the terms of the security policy (access lists, filters, AAA).
For multiple context mode, the security appliance first classifies the packet according to either a unique interface or a unique destination address associated with a context; the destination address is associated by matching an address translation in a context. In this case, the classifier "knows" that the DMZ web server address belongs to a certain context because of the server address translation.
3. The security appliance translates the destination address to the local address 10.1.1.3.
4. The security appliance then adds a session entry to the fast path and forwards the packet from the DMZ interface.
5. When the DMZ web server responds to the request, the packet goes through the security appliance and because the session is already established, the packet bypasses the many lookups associated with a new connection. The security appliance performs NAT by translating the local source address to 209.165.201.3.
6. The security appliance forwards the packet to the outside user.
Continue reading here: An Inside User Visits a Web Server on the DMZ
Was this article helpful?
