cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
262
Views
0
Helpful
2
Replies

How these command works?

g.rodegari
Level 1
Level 1

Hi,

what are the usage guidelines of these commands:

- "sysopt route dnat",

- "established" command (If I use nat or global+acl, why I would use this command?)

THX,

Graz.

2 Replies 2

yusuff
Cisco Employee
Cisco Employee

The sysopt route dnat command specifies that when an incoming packet does a route lookup, the incoming interface is used to determine which interface the packet should go to, and which is the next hop.

The established command works as shown in the following format:-

established A B C permitto D E permitfrom D F

If there exists a connection between two hosts using protocol A from src port B destined for port C, permit return connections through the PIX Firewall via protocol D (D can be different from A), if the source port(s) correspond to F and the destination port(s) correspond to E.

For example:

established tcp 6060 0 permitto tcp 6061 permitfrom tcp 6059

In this case, if a connection is started by an internal host to an external host using TCP source port 6060 and any destination port, the PIX Firewall permits return traffic between the hosts via TCP destination port 6061 and TCP source port 6059.

Another example:

established udp 0 6060 permitto tcp 6061 permitfrom tcp 1024-65535

In this case, if a connection is started by an internal host to an external host using UDP destination port 6060 and any source port, the PIX Firewall permits return traffic between the hosts via TCP destination port 6061 and TCP source port 1024-65535.

Another example:-

The following example occurs when a local host 10.1.1.1 starts a TCP connection on port 9999 to a foreign host 209.165.201.1. The example allows packets from the foreign host 209.165.201.1 on port 4242 back to local host 10.1.1.1 on port 5454.

established tcp 9999 permitto tcp 5454 permitfrom tcp 4242

Another example:-

The next example allows packets from foreign host 209.165.201.1 on any port back to local host 10.1.1.1 on port 5454:

established tcp 9999 permitto tcp 5454

HTH

R/Yusuf

Now I've understood!

thank you very much!

Bye,

Graz.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: