Cisco 7604 Configuration Guide - Page 110

Routed Mode Overview Chapter 5 Configuring the Firewall Mode The following steps describe how data moves through the FWSM (see Figure 5-2): 1. A user on the outside network requests a web page from the DMZ web server using the mapped address of 209.165.201.3, which is on the outside interface subnet. 2. The FWSM receives the packet and because it is a new session, the FWSM verifies that the packet is allowed according to the terms of the security policy (access lists, filters, AAA). For multiple context mode, the FWSM first classifies the packet according to either a unique interface or a unique destination address associated with a context; the destination address is associated by matching an address translation in a context. In this case, the classifier "knows" that the DMZ web server address belongs to a certain context because of the server address translation. 3. The FWSM translates the destination address to the real address 10.1.1.3. 4. The FWSM then adds a session entry to the fast path and forwards the packet from the DMZ interface. 5. When the DMZ web server responds to the request, the packet goes through the FWSM and because the session is already established, the packet bypasses the many lookups associated with a new connection. The FWSM performs NAT by translating the real address to 209.165.201.3. 6. The FWSM forwards the packet to the outside user. An Inside User Visits a Web Server on the DMZ Figure 5-3 shows an inside user accessing the DMZ web server. Figure 5-3 Inside to DMZ Outside 10.1.2.1 209.165.201.2 FWSM 10.1.1.1 Inside DMZ 92887 User 10.1.2.27 Web Server 10.1.1.3 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 5-4 OL-20748-01