pixfirewall#show run& c8 r! \6 N9 y! P
: Saved
8 E( j* @ _7 C3 I/ Q4 J, j; [:2 r( p6 r2 z6 L: |- U) X; C5 z2 C
PIX Version 6.3(3); Z5 \& ]7 r0 n, Q: q$ x
interface ethernet0 100full
; Z) C: L9 y( v8 }6 g1 F' k6 A& w! ginterface ethernet1 100full6 D7 Y' h) a/ X3 y; e
nameif ethernet0 outside security0
m( ?6 D5 c4 j; ~nameif ethernet1 inside security100
. k6 O, ~( ?/ G4 yenable password 8Ry2YjIyt7RRXU24 encrypted8 ?7 C8 U" M2 H1 R7 b {
passwd 2KFQnbNIdI.2KYOU encrypted5 P1 T3 s3 {+ x# o7 |
hostname pixfirewall
$ A$ b# M" @/ X6 h4 ffixup protocol dns maximum-length 5125 c# x7 |$ Z0 ^' b* S
fixup protocol ftp 21
- L1 v; C, b$ J( v5 Tfixup protocol h323 h225 1720
" `! _2 ~8 F3 Y0 q8 hfixup protocol h323 ras 1718-1719
7 X4 O) @; p' V E4 F, Vfixup protocol http 80
+ [* P, z; P8 [. tfixup protocol rsh 5147 u0 `5 w4 |* z; x, f
fixup protocol rtsp 554
* ^( F* U1 a4 q/ [fixup protocol sip 5060
2 b6 n. z7 W) `. Ufixup protocol sip udp 50607 L4 i9 |! z/ b, I1 l5 c) a/ Q8 O
fixup protocol skinny 2000
+ [% g9 N; [3 W( ~0 k- q/ w5 X$ qfixup protocol smtp 25
5 a2 ^: ~) x afixup protocol sqlnet 1521' |0 m/ Q) v* j' ~4 u
fixup protocol tftp 69
k8 h% j- C* ^9 a: s+ jnames
' }4 ~* I& K; @% l6 a4 Z' z" D8 J, o3 a& _& c' t
!--- Do not use Network Address Translation (NAT) for inside-to-pool
: f: U3 Q* b' w!--- traffic. This should not go through NAT.
7 g5 Q; |5 e* g4 j) P; G( ^
/ \9 U- H" T$ [" Haccess-list 101 permit ip 10.89.129.128 255.255.255.240 10.89.129.192 255.255.255.240
* ?$ x K+ M0 I! \# A7 y7 U/ _( H
1 K* n. E5 z2 h7 O O2 t! N4 V!--- Permits Internet Control Message Protocol (ICMP)
$ v3 ~* X, ]: _!--- Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)
$ u7 w% ]$ v5 v2 H9 i7 _% V/ j!--- traffic from any host on the Internet (non-VPN) to the web server., k. d' Y' [/ b D. s) R
+ o. H1 M! }4 W2 Z U& X2 |; @access-list 120 permit icmp any host 10.89.129.131: N4 E" W8 M. ~4 O& K5 P# W+ N
access-list 120 permit tcp any host 10.89.129.131" [! Z9 Q0 h6 r. \2 f9 O, M: W
access-list 120 permit udp any host 10.89.129.131' z# n3 [/ _( \0 E- C' d# s
" ?3 @9 J) U( C0 c# x: I. k* Spager lines 24' U- |* V' p4 e1 W! E: V o( i
mtu outside 1500
( a; v2 I, h) fmtu inside 1500
5 m4 Y9 x; W' A4 P3 wip address outside 192.168.1.1 255.255.255.0
0 o7 m* {( |; Q/ E% U2 X3 aip address inside 10.89.129.194 255.255.255.240- [# Y& r9 j7 e9 @9 ?! f5 h
ip audit info action alarm6 f3 \' s+ Z* |$ [/ H- [/ [9 s! b
ip audit attack action alarm f8 d! z5 z1 K5 w+ [
7 I+ n7 F- P: R# y0 b!--- Specifies the inside IP address range to be assigned
- Z# H0 p& V8 z!--- to the VPN Clients.
1 P. W$ | |: O# Q( }
/ x$ @6 g& C2 V2 b. Q2 jip local pool VPNpool 10.89.129.200-10.89.129.204
4 K! }+ e$ A) J4 vno failover" l/ c1 {8 E- ~+ e# E$ a$ b( ?
failover timeout 0:00:00
0 J& T {4 ], B. C6 p! f# ?failover poll 15
) H% C+ U4 s, `/ ino failover ip address outside- R4 a/ I; Z$ s/ C6 y7 a
no failover ip address inside. X; P9 f W* B w x) n
pdm history enable; F3 {5 X v" q/ x0 a& y2 j
arp timeout 144000 A( k5 h2 p% s7 v8 L9 M
3 Q9 M3 ], n1 e/ u# r!--- Defines a pool of global addresses to be used by NAT.
* Q' F: [6 ]+ e
& w! Q. ?0 D$ x: D5 Dglobal (outside) 1 192.168.1.6-192.168.1.10: f' s% Z; h, N1 B$ y3 v
, ]% k; Z2 z6 o+ A- t
nat (inside) 0 access-list 1019 N) p. w6 i& T) G) G+ |( ?, N, k
nat (inside) 1 0.0.0.0 0.0.0.0 0 0$ a5 K, h& \' t S! l2 ~* n
. A; b+ l0 n: P; E8 s: L
!--- Specifies which outside IP address to apply to the web server.
" K8 `9 G6 S9 }' [& q7 [3 P* ?4 U0 v5 i' E# M
static (inside,outside) 192.168.1.11 10.89.129.131 netmask 255.255.255.255 0 0* a: M9 y7 W9 i
0 H5 _2 ?4 x( G7 ^& x/ }/ I
!--- Apply ACL 120 to the outside interface in the inbound direction.
. N/ _4 g( V9 ?8 u6 }/ p" L% I
@- y) f9 E0 d9 c! ]access-group 120 in interface outside
" d# f( i* H' Q& A: P1 C: w
5 a; h1 \; u. C!--- Defines a default route for the PIX.
' } n' y: `+ X$ f
) {4 d9 z# Y/ J$ e/ _( [5 kroute outside 0.0.0.0 0.0.0.0 192.168.1.3 1; G1 q9 y, W* V! d- [
! C! o' ]1 I1 d, u!--- Defines a route for traffic within the PIX's, x3 e& K. O* M( P
!--- subnet to reach other inside hosts.3 C) u7 u: \: _: G% ~ f) O3 d
3 R6 E/ v% s5 [3 \3 g1 e# H
route inside 10.89.129.128 255.255.255.128 10.89.129.193 19 E7 J8 v) V* G
( m" C6 L0 ?: D' {" ]timeout xlate 3:00:00
; J* i& S& i J T5 jtimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
7 {# g3 m( t7 ]timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
# d4 d! a; K3 Y+ m( Ztimeout uauth 0:05:00 absolute
, s9 Y) [! i' Zaaa-server TACACS+ protocol tacacs+! b/ W% {, S7 E! |! k8 }# g. ]* i
aaa-server RADIUS protocol radius$ h( W' n1 g. ?- V
aaa-server LOCAL protocol local- F% n) c7 U& t" B1 g
; k. c' N' E1 R, |0 r!--- Authentication, authorization, and accounting (AAA)
5 V' t7 j# Q- J!--- statements for authentication. Method AuthInbound uses TACACS+.
, X5 }6 V6 g7 |3 N4 F: x/ V' {
6 W2 T: Z* m- v6 n" `) G1 x; S _aaa-server AuthInbound protocol tacacs+2 h% M2 ~- ]5 b6 \0 [# K* M
6 l% G9 w$ Q' G
!--- Specify the TACACS+ server and key.* M3 Y; A4 c1 K1 h$ b
, z5 W. [, L0 I& w0 G4 F4 P
aaa-server AuthInbound (inside) host 10.89.129.134 <deleted> timeout 10% j6 p8 P! @: h$ t; u* ^
& L+ H( X/ e @, t0 h; Z!--- Authenticate HTTP, FTP, and Telnet traffic to the web server.: w- n0 ?* G- l- U/ j- k- w
" k# Y4 i. y. Q3 A
aaa authentication include http outside # t% W8 H! f$ f% Z
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound4 N9 v% B$ X/ E. ^( H! ^
( l/ i1 _- u# h. X7 c, Daaa authentication include ftp outside
$ L6 F3 ?0 w# H# V4 s, s- s 10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound
+ m! @" b- c5 t3 v$ X1 S$ B6 O' ?$ |. T) g; |
aaa authentication include telnet outside
0 l% @3 H, a! X" ^! C10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound
- j% }' @3 k/ x0 f- w+ v8 ^+ h6 I
no snmp-server location
" F6 L4 A# r6 e. Y! f- m$ j- t: zno snmp-server contact2 H8 D" x! m" v/ m7 M( K' n
snmp-server community public
7 I- Y7 T) W$ X- W4 t9 t# Ano snmp-server enable traps
$ _; h0 ?3 z+ h! ?5 d. _floodguard enable7 W ?3 b/ |, g% h+ _& _9 b4 C
5 S0 c2 J5 K, G) V2 c; Z6 v
!--- Trust IPSec traffic and avoid going through ACLs/NAT.- d. B$ x0 L, }: \! A9 G* S& q
6 j: o5 z% t& d5 wsysopt connection permit-ipsec
$ C; L7 R$ R3 l# H/ a
8 E# m, K. R2 r8 g/ }1 o9 j0 h!--- IPSec and dynamic map configuration.
+ j1 n6 _' U( S% |4 {
+ X/ L! j" d0 H# i* Scrypto ipsec transform-set myset esp-des esp-md5-hmac( X2 N1 S- g5 ]- d8 @& C* j+ _
crypto dynamic-map dynmap 10 set transform-set myset
' L; Y- k9 Y% w" ], ~" P. Tcrypto map mymap 10 ipsec-isakmp dynamic dynmap, n* r0 J) a9 h) B
% P: Y& @$ K' q9 H" p3 H! V; `!--- Assign IP address for VPN 1.1 Clients.
% a" B! U2 L) H6 Z" i* m8 i a1 W m, a4 R0 c& W
crypto map mymap client configuration address initiate% s% a* }: ^; D
crypto map mymap client configuration address respond3 v+ _ n/ D" T$ R" J, K
+ ]: ~. g0 n: j8 `' |!--- Use the AAA server for authentication (AuthInbound).
$ G/ A& R/ T" ]) S% y( |
) ~- a K8 u( @* x" ecrypto map mymap client authentication AuthInbound0 d" f* p) z6 V1 V3 d4 q% Y; t
7 w7 U2 c I0 Q$ i!--- Apply the IPSec/AAA/ISAKMP configuration to the outside interface., W. y1 V: L3 B* S
8 J' w( r/ e5 s" F U- O( r4 mcrypto map mymap interface outside1 D& y" ~1 p( s' G5 G( S$ C( A0 _5 l
isakmp enable outside. }' p- S* M5 r9 X+ b k' d. U
3 ^6 |7 }* Z6 M& Q!--- Pre-shared key for VPN 1.1 Clients.4 a$ w( n9 V) H0 Z- a# F) K e
: ^4 @+ |" J) O8 G- h9 B4 B9 s' B5 }: e
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
1 ~5 g2 V! W" ^- O2 P8 i5 qisakmp identity address
. o1 e$ ?. G7 M- z3 |0 a- Q5 W: g0 k' Y- u0 e1 s
!--- Assign address from "VPNpool" pool for VPN 1.1 Clients.
2 O! u# x% E9 {
, M, \, v5 q5 k5 K; `' Pisakmp client configuration address-pool local VPNpool outside6 L6 Z: i; C8 O- s2 c2 m8 f
1 ` l9 u" T$ i2 F$ K
!--- ISAKMP configuration for VPN Client 3.x/4.x.* ?+ o. e8 {& i0 z8 ^7 y
9 i+ w6 \) _8 K" {! V+ Z$ @% U
isakmp policy 10 authentication pre-share
. l* ^! s2 z2 Xisakmp policy 10 encryption des
9 M' J% x2 p- Y8 g3 Lisakmp policy 10 hash md5* M) C \5 r5 Q
isakmp policy 10 group 2+ Q5 c# b2 }" N4 F! i; ]% _) O
isakmp policy 10 lifetime 86400
! e, J8 a) }+ Q
. e& U* {+ B1 I) K' u/ t6 v: e6 ?5 ?" T0 t!--- ISAKMP configuration for VPN Client 1.x.
2 H* F' j |* {: @, g9 k, i7 t
: k( K7 m7 O4 ]7 misakmp policy 20 authentication pre-share
1 v# c. }& Y) g9 Y2 o y3 n9 ^9 [2 Cisakmp policy 20 encryption des
8 t& _* Q5 X, jisakmp policy 20 hash md5
1 z1 U C' r- F3 k& R5 Misakmp policy 20 group 1
4 Y- ]% q+ M9 c4 A1 L, T: W: ^" Sisakmp policy 20 lifetime 86400; i. o; e0 [9 w3 n
9 a% w" |3 \: s5 H+ A* P
!--- Assign addresses from "VPNpool" for VPN Client 3.x/4.x.( g1 j) A: {4 G4 k0 q& k
2 [: r5 L4 G+ a* V* ^
vpngroup vpn3000 address-pool VPNpool
! ?* y4 y% P2 J, P. O' P% k0 N- [/ }7 S- x9 f: f
vpngroup vpn3000 idle-time 18004 W1 ]5 y9 J' ~- @% U
' O/ c- Y _& U, [+ z7 K7 n3 l6 Q
5 K) [& W1 h7 B- o8 @0 a!--- Group password for VPN Client 3.x/4.x (not shown in configuration).
9 \( B9 f4 }& I9 ^! V5 n9 Q) H8 H; a" k* a9 ]; d" w" V
vpngroup vpn3000 password ********8 D7 Z$ L. V& E( f
telnet timeout 5
' Z8 H8 b8 ? e2 L% qssh timeout 5( U2 Q$ Z! u+ x4 d
console timeout 0
2 u0 ?* y- Y. [terminal width 80( N8 o5 S& @( b/ n' s
Cryptochecksum:ba54c063d94989cbd79076955dbfeefc
* j9 H6 v0 A/ j M: end
. U" ?! Y1 {2 n$ r$ d7 hpixfirewall# |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
