Command 1: nameif Command 1: nameif
• The nameif command assigns a name to each
perimeter interface on the PIX Firewall and specifies its security level.
The command nameif assigns a name to each perimeter interface on the PIX Firewall and specifies its security level (except for the inside and outside PIX Firewall interfaces, which are named by default). The syntax for the nameif command is as follows:
nameif hardware_id if_name security_level
hardware_id Specifies a perimeter interface and its slot location on the PIX Firewall.
There are three interfaces that you can enter here: Ethernet, FDDI, or Token Ring. Each interface is represented by an alphanumeric identifier based on which interface it is and what numeric identifier you choose to give it.
For example, an Ethernet interface is represented as e1, e2, e3, and so on; a FDDI interface is represented as fddi1, fddi2, fddi3, and so on; and a Token Ring interface is represented as token-ring1, token-ring2, and token-ring3, and so on.
if_name Describes the perimeter interface. This name is assigned by you, and must be used in all future configuration references to the perimeter interface.
security_level Indicates the security level for the perimeter interface. Enter a security level of 1−99.
© 2002, Cisco Systems, Inc. www.cisco.com CSPFA 2.1—5-22
interface hardware_id hardware_speed
pixfirewall(config)#
Command 2: interface Command 2: interface
• The interface command configures the type and capability of each perimeter interface.
pixfirewall(config)# interface ethernet0 100full pixfirewall(config)# interface ethernet1 100full
• The outside and inside interfaces are set for 100 Mbps Ethernet full-duplex communication.
The interface command identifies hardware, sets its hardware speed, and enables the interface. When an additional Ethernet interface card is installed on the PIX Firewall, the PIX Firewall automatically recognizes the additional card.
The syntax for the interface command is as follows:
interface hardware_id hardware_speed [shutdown]
hardware_id Specifies an interface and its slot location on the PIX Firewall. This is the same variable that was used during the nameif command.
hardware_speed Determines the connection speed. Possible Ethernet values are as follow:
■ 10baset—Set for 10 Mbps Ethernet half-duplex communication.
■ 10full—Set for 10 Mbps Ethernet full-duplex communication.
■ 100basetx—Set for 100 Mbps Ethernet half-duplex communication.
■ 100full—Set for 100 Mbps Ethernet full-duplex communication.
■ 1000sxfull—Set for 1000 Mbps Gigabit Ethernet full-duplex operation.
■ aui—Set 10 for Mbps Ethernet half-duplex communication with an AUI cable interface.
■ auto—Set Ethernet speed automatically.
The auto keyword can only be used with the Intel 10/100 automatic speed sensing network interface card.
■ bnc—Set for 10 Mbps Ethernet half-duplex communication with a BNC cable interface.
Possible Token Ring values are as follow:
■ 4mbps—4 Mbps data transfer speed.
You can specify this as 4.
■ 16mbps—(Default.) 16 Mbps data transfer speed. You can specify this as 16.
shutdown Administratively shuts down the interface.
Although the hardware speed is set to automatic speed sensing by default, it is recommended that you specify the speed of the network interfaces. This enables the PIX Firewall to operate in network environments that may include switches or other devices that do not handle auto sensing correctly.
Note When a FDDI or Token Ring interface card is installed using the interface command, you must define the FDDI or Token Ring interface card because the PIX Firewall does not automatically recognize it. Starting with PIX Firewall software version 6.0(1), FDDI, PL2, and Token Ring interfaces are not supported.
© 2002, Cisco Systems, Inc. www.cisco.com CSPFA 2.1—5-23
ip address if_name ip_address [netmask]
pixfirewall(config)#
Command 3: ip address Command 3: ip address
• The ip address command assigns an IP address to each interface.
pixfirewall(config)# ip address dmz 172.16.0.1 255.255.255.0
Each interface on the PIX Firewall must be configured with an IP address. The syntax for the ip address command is as follows:
ip address if_name ip_address [netmask]
if_name Describes the interface. This name is assigned by you, and must be used in all future configuration references to the interface.
ip_address The IP address of the interface.
netmask If a network mask is not specified, the default network mask is assumed.
After configuring the IP address and netmask, use the show ip command to view which addresses are assigned to the network interfaces. If you made a mistake while entering the information, reenter the command with the correct information.
© 2002, Cisco Systems, Inc. www.cisco.com CSPFA 2.1—5-24
nat [(if_name)] nat_id local_ip [netmask]
pixfirewall(config)#
Command 4: nat Command 4: nat
• The nat command shields IP addresses on the inside network from the outside network.
pixfirewall(config)# nat (inside)
1 0.0.0.0 0.0.0.0Network address translation (NAT) enables you to keep your internal IP
addresses—those behind the PIX Firewall—unknown to external networks. NAT accomplishes this by translating the internal IP addresses, which are not globally unique, into globally accepted IP addresses before packets are forwarded to the external network.
The syntax for the nat command is as follows:
nat [(if_name)] nat_id local_ip [netmask]
if_name Describes the internal network interface name where you will use the global addresses.
nat_id Identifies the global pool and matches it with its respective nat command.
local_ip The IP address that is assigned to the interface on the inside network.
netmask Network mask for the local IP address. You can use 0.0.0.0 to allow all outbound connections to translate with IP addresses from the global pool.
When you initially configure the PIX Firewall, you can enable all inside hosts to access outbound connections with the nat 1 0.0.0.0 0.0.0.0 command. The nat 1 0.0.0.0 0.0.0.0 command enables NAT and lets all inside hosts (specified as 0.0.0.0) access outbound connections. The nat command can specify single hosts or ranges of hosts to make access more selective. 0 can be used in place of 0.0.0.0.
© 2002, Cisco Systems, Inc. www.cisco.com CSPFA 2.1—5-25
When an outbound IP packet that is sent from a device on the inside network reaches the PIX Firewall, the source address is extracted and compared to an internal table of existing translations. If the device’s address is not already in the table, it is then translated: a new entry is created for that device and it is assigned a global IP address from a pool of global IP addresses. After this translation occurs, the table is updated and the translated IP packet is forwarded. After a user-configurable timeout period (or the default of two minutes), during which there have been no translated packets for that particular IP address, the entry is removed from the table, and the global address is freed for use by another inside device.