GroupStudy.com GroupStudy.com - A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
Re: ip nat reversible posted 01/05/2008
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]


Actually read that before I post the question. The problem is in
http://www.groupstudy.com/archives/ccielab/200610/msg00401.html

I also feel it is wrong, as it would be a major security issue if the
outside-to-inside can be established without inside-to-outside entries are
created.

I feel it does extra validation only because in the documentation, at
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t
/123t_14/gtnato2n.htm

it mentions:

Restrictions for NAT Routemaps Outside-to-Inside Support

Only IP hosts that are part of the routemap configuration will allow
outside sessions.

Outside sessions must use an access list.

Joseph.

On Jan 5, 2008 3:48 PM, Gary Duncanson <gary.duncanson@xxxxxxxxxxxxxx>
wrote:

> Joseph
>
> I found this in the archives. does it help some?
>
> Gary
>
> http://www.groupstudy.com/archives/ccielab/200610/msg00361.html
> ----- Original Message -----
> From: "Joseph Saad" <joseph.samir.saad@xxxxxxxxx>
> To: "Cisco certification" <ccielab@xxxxxxxxxxxxxx>
> Sent: Saturday, January 05, 2008 10:59 AM
> Subject: ip nat reversible
>
>
> >I have been banging my head against the config guide for "ip nat
> route-map
> > reversible" for over 2 hours now.
> >
> > The example is not helping at all, but what I understood (along from all
> > the
> > previous GS posts) is that it provides extra security by validating the
> > outside IP address against an ACL in the route-map rather than simply
> > allowing access to the "Cached Translated entry".
> >
> > Anyone have a more solid idea on how to test this feature or what it
> > really
> > achieves.
> >
> > Joseph.
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html