Re: [freebsd] ASA a la Cisco PIX

[Maxim Ignatenko]

On Wed, 05 Oct 2011 12:23:21 +0300, Andrey Lakhno wrote:

On 10/05/11 11:40, Victor Sudakov wrote:

Victor Sudakov wrote:

Гениально!

check-state
permit ip from any to any recv INSIDE xmit DMZ keep-state
permit ip from any to any recv INSIDE xmit OUTSIDE keep-state
permit ip from any to any recv DMZ xmit OUTSIDE keep-state

Правила c xmit будут работать только на outgoing пакетах.
Как быть с incoming ?

check-state же