Cisco 7604 Configuration Guide - Page 109

Chapter 5 Configuring the Firewall Mode Routed Mode Overview For multiple context mode, the FWSM first classifies the packet according to either a unique interface or a unique destination address associated with a context; the destination address is associated by matching an address translation in a context. In this case, the interface would be unique; the www.example.com IP address does not have a current address translation in a context. 3. The FWSM translates the real address (10.1.2.27) to the mapped address 209.165.201.10, which is on the outside interface subnet. The mapped address could be on any subnet, but routing is simplified when it is on the outside interface subnet. 4. The FWSM then records that a session is established and forwards the packet from the outside interface. 5. When www.example.com responds to the request, the packet goes through the FWSM, and because the session is already established, the packet bypasses the many lookups associated with a new connection. The FWSM performs NAT by translating the mapped address to the real address, 10.1.2.27. 6. The FWSM forwards the packet to the inside user. An Outside User Visits a Web Server on the DMZ Figure 5-2 shows an outside user accessing the DMZ web server. Figure 5-2 Outside to DMZ User Outside 10.1.2.1 209.165.201.2 FWSM 10.1.1.1 Dest Addr Translation 209.165.201.3 10.1.1.13 Inside DMZ Web Server 10.1.1.3 92890 OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 5-3