PIX515配置实例 - 思科技术 - 51CTO技术论坛

社区导航: 专家门诊网络技术操作系统数据库程序设计系统应用考试认证 CIO及信息化站长交流综合交流下载基地 51CTO产品服务

【设为首页 | 收藏本站】

51CTO技术论坛» 思科技术 » PIX515配置实例 [ 打印] [ 订阅] [ 收藏] [ 推荐给朋友] [ 本帖文本页]

论坛跳转:

deake
新新人类

帖子 46
精华 0
无忧币 1290
积分 123
阅读权限 20

注册日期 2007-7-3

最后登录 2008-7-7

离线

[查看资料] [发短消息] [Blog]

发表于:2008-1-16 16:53　　标题：PIX515配置实例
＜上一帖 | 下一帖＞

前几天出差客户那里,调试一个PIX515E防火墙,客户那里只有一个公网IP,除了公司内部员工上网之外,还要发布WEB服务器,搭建FTP服务器.当时我就有点儿担心,怕完成不了这样的重任,就给思科CCIE打了一个电话,唉,很不好,人家让我对客户说再申请几个公网IP,没办法,只有自己试试看啦,到最后,经过自己的努力,终于大功告成了.现在机器也运行的有几个月了,一切都很正常,现共享出来,希望对大家能够有所帮助.
pix# show run
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0 nameif命名；将E0命名为安全级别为0 安全级别从0到100越来越高
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pix
fixup protocol dns maximum-length 512
no fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit tcp any interface outside
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 公网IP 子网掩码
ip address inside 192.168.1.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www 192.168.1.3 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp 192.168.1.3 ftp netmask 255.255.255.255 0 0
access-group 101 in interface outside
conduit permit icmp any any
route outside 0.0.0.0 0.0.0.0 218.69.18.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:a00877714ee2baf543d4a4a7744eb726
: end