pixfirewall#show run
7 F F5 {$ P" f, b4 ]: Saved
' c3 r& ]7 V1 {( \/ Q4 o:
3 z* r* b( z3 W* LPIX Version 6.3(3)$ x+ K% D& L! j) A1 [1 C4 b" y
interface ethernet0 100full
/ t! f& C' X' u! y+ V5 Q) @interface ethernet1 100full
; |8 s" c' v/ e; H; @9 ?1 vnameif ethernet0 outside security0) u- d# c+ E( k: ]
nameif ethernet1 inside security100
/ ^( I* v3 B, M7 [% M& h7 v/ Fenable password 8Ry2YjIyt7RRXU24 encrypted
$ A/ q& F; m [! t& m; Gpasswd 2KFQnbNIdI.2KYOU encrypted
3 Y4 _0 S e( `6 U3 I6 H: Ghostname pixfirewall
( \! S6 W9 ?; `* w7 m) efixup protocol dns maximum-length 512
! y+ ^7 Z" Z4 y+ j* e! ^7 dfixup protocol ftp 21
9 ?. _# m; R' d0 @fixup protocol h323 h225 1720
2 N$ J5 j1 f, i6 Hfixup protocol h323 ras 1718-1719
' G9 R5 `/ h9 u+ J; kfixup protocol http 804 Q; t( ^- W- x; I
fixup protocol rsh 514
4 \( P/ e6 b- S+ wfixup protocol rtsp 554
* b. j2 v$ _3 z' H4 B) x4 I. N4 I4 Ifixup protocol sip 5060
& m2 d9 p' r1 X7 x) t' J$ Pfixup protocol sip udp 5060, b; p+ A5 ]! O6 `4 d
fixup protocol skinny 2000 t$ M- k ?- j! y* i
fixup protocol smtp 25
: _; W/ O& ]+ b! P7 ?5 Ifixup protocol sqlnet 15214 Z3 v' b# A8 o
fixup protocol tftp 69- |; g# [! x; i" f; L
names% {" v! I1 a' O# A
2 t8 S/ ^5 M8 a0 _( z!--- Do not use Network Address Translation (NAT) for inside-to-pool, b$ m/ d! l8 c. |8 y2 }
!--- traffic. This should not go through NAT.1 k/ i' ?5 \8 v! x
) p9 x, `. P0 ]" j2 _
access-list 101 permit ip 10.89.129.128 255.255.255.240 10.89.129.192 255.255.255.240
( G. c g" J9 G' P+ ]
. D' G) U& z9 ]8 p!--- Permits Internet Control Message Protocol (ICMP)
1 T- {" y4 }$ D$ Q4 W" \!--- Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)! [ C. R9 I2 J) F! {% B
!--- traffic from any host on the Internet (non-VPN) to the web server.
* E. A# I4 ?+ A: e8 U- t2 E, c+ C
+ [7 b$ T) { X6 `9 I, Kaccess-list 120 permit icmp any host 10.89.129.131# \& O: F$ h$ w3 o
access-list 120 permit tcp any host 10.89.129.131
+ [5 f4 D d: d' _- Q% Y6 f2 S9 t0 baccess-list 120 permit udp any host 10.89.129.131" N- U6 W3 }% d* U5 H4 P
. y _0 }/ H( M; L u8 S7 zpager lines 24
0 A( y$ @$ U; }4 J; l; Gmtu outside 1500: b+ Y l6 j5 q1 d8 O- _. A
mtu inside 1500
# J" O7 d8 g( s3 P) o* f1 Iip address outside 192.168.1.1 255.255.255.0* G x& z9 {8 }( j& t) l
ip address inside 10.89.129.194 255.255.255.240
$ V- ?; @; S, r+ \2 {6 ~8 gip audit info action alarm
* S; d& p( ?+ _$ v( B# D2 z9 Mip audit attack action alarm
# B8 y K( z0 L1 I
1 E( ` g3 q% T5 J!--- Specifies the inside IP address range to be assigned" l" h6 F3 W0 R3 D
!--- to the VPN Clients.
# \) c& u7 |, s& `# O8 `& [9 w
8 C8 G! G- |# M5 cip local pool VPNpool 10.89.129.200-10.89.129.204: z) K7 n+ z% V* f- a
no failover
1 Z- k6 v+ e; Mfailover timeout 0:00:00
! L F1 n0 K- Y2 Y5 z/ ffailover poll 15- Q# E4 W( V6 @# q; n4 x4 X* l
no failover ip address outside8 h4 L+ G# G/ C7 z) b; A
no failover ip address inside, ` ?5 i' ~& O" @: _# x
pdm history enable
# J; T& ]4 ?3 B( [, carp timeout 14400
, N3 N! e% ~7 H* n
( N0 C: s% b \& M!--- Defines a pool of global addresses to be used by NAT.% s+ { x* S( O/ C9 ^7 ^% E9 [
~; y8 q# g0 F- o: |
global (outside) 1 192.168.1.6-192.168.1.10
j; Y7 I [1 b+ I q7 Y$ b; B0 o: Y" \" p$ {0 }
nat (inside) 0 access-list 101: H! p. y& G3 [/ \& O/ f
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
+ \! |! P g/ v- v. T5 b3 H& ^" z" B
; l( L J7 Z8 _( M!--- Specifies which outside IP address to apply to the web server.$ E: L( R% x# P* [0 B9 N
- x! O0 D2 t3 b
static (inside,outside) 192.168.1.11 10.89.129.131 netmask 255.255.255.255 0 0
- j4 {( t f! E6 p9 S5 G( E" e* }; V0 o( O7 m
!--- Apply ACL 120 to the outside interface in the inbound direction.
5 q: ?& X6 U& J# g5 K
. d, o' S0 ]! k4 E( M( Haccess-group 120 in interface outside8 b. e2 x/ j1 i y- }2 W' `
: r$ |9 ~2 H+ d/ u+ N8 M' W: p!--- Defines a default route for the PIX.( y0 m' a! p6 H5 P) W7 k8 j8 m
( r7 O6 x! h' b! w, E: r/ M# o% u
route outside 0.0.0.0 0.0.0.0 192.168.1.3 1
/ }5 i2 V s2 t d0 K( R @. H1 u/ [' S M
!--- Defines a route for traffic within the PIX's8 d$ {$ w+ j" \- J4 I9 L
!--- subnet to reach other inside hosts.
3 S9 [- `1 _7 S) z- G
: v' w7 Y+ Y' f3 {; broute inside 10.89.129.128 255.255.255.128 10.89.129.193 1. w% S# m& Y Q( D. q7 ~
3 E7 |/ P0 w& N( X Jtimeout xlate 3:00:00 d6 y- g4 D( t& t2 L
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00* `- Q( C2 t" d0 a8 K9 P
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:005 n9 |6 s, V f, }; E
timeout uauth 0:05:00 absolute# p- ]; q1 G9 _0 ?
aaa-server TACACS+ protocol tacacs+
' M1 O" n, X7 R$ o3 oaaa-server RADIUS protocol radius
1 z. Z, m, d' \aaa-server LOCAL protocol local
! d% V* G0 P1 X3 B# |5 p, x# P7 X5 V9 B% {
!--- Authentication, authorization, and accounting (AAA)
! k- |9 j& }( K8 L- A0 m# z& B!--- statements for authentication. Method AuthInbound uses TACACS+.5 f- `8 w9 r+ F6 u
; b( Y, h6 ]$ t( V9 Saaa-server AuthInbound protocol tacacs+
0 K% ^" R8 U9 A$ @$ c. v& A) M* {4 u1 X$ G s! r6 F2 r8 B% k
!--- Specify the TACACS+ server and key.% n: h" M7 R5 u
% _5 P$ t9 o. R8 q$ }4 \0 v1 L5 {
aaa-server AuthInbound (inside) host 10.89.129.134 <deleted> timeout 10
! n/ x' b4 C' W( X. _& g
- r& M1 h& N6 O! R/ U' L0 T& a!--- Authenticate HTTP, FTP, and Telnet traffic to the web server.+ o) d ^8 ?% O
% h5 Q$ L2 O- ^; K' @2 O/ @
aaa authentication include http outside 5 ~9 ^& y. X8 E3 e+ B
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound" J* b3 {2 y& v* z4 d
1 ~3 o0 B5 G7 L6 c& E$ P9 H# Baaa authentication include ftp outside p# o( h' E7 q" }: A- ^
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound
4 ?0 Q/ z- f ^& p0 \4 ?7 G: ~* |0 d5 Y& p" x% u3 U
aaa authentication include telnet outside
0 {. B+ [' g- Y2 q# J10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound+ A9 F4 ]" g$ @# O& N0 D
9 e* {7 E# V* Z+ xno snmp-server location/ o0 n$ T' d8 D5 o/ S/ P9 r! O! e
no snmp-server contact
3 B. Z, s) w6 J% H6 `' t9 G' Xsnmp-server community public
/ F/ u1 V1 L* l% ?8 l! {no snmp-server enable traps
6 M& r" ^1 [( T+ e$ s0 q$ Ifloodguard enable
" m+ F2 h- p, s+ D3 t1 R9 C) m
& t0 {2 W7 f H( A!--- Trust IPSec traffic and avoid going through ACLs/NAT.$ O2 x. R. b( }7 ^9 C
- }0 E0 t5 d. ~2 j* w5 I
sysopt connection permit-ipsec1 o8 ^2 V2 _9 D- }0 ?6 {; V$ e. w
8 X( ^1 x9 @! u. ]; @5 M!--- IPSec and dynamic map configuration.2 @8 ?* o J4 C/ v8 q! d0 i6 i' u
. }/ e- H3 K2 n5 d8 u/ I0 U6 ycrypto ipsec transform-set myset esp-des esp-md5-hmac+ i+ f P# E7 z+ |4 ?7 {
crypto dynamic-map dynmap 10 set transform-set myset' P: N, G* s+ G6 _' s
crypto map mymap 10 ipsec-isakmp dynamic dynmap
' Z/ S' U% K* j% l, ^2 @7 T
, _, a/ |/ s' n. d% K6 z!--- Assign IP address for VPN 1.1 Clients.9 C9 j @* J- m3 c0 p! e
3 J* ^! s; i9 e% ^, O) {
crypto map mymap client configuration address initiate
; Q/ c/ u& \* Lcrypto map mymap client configuration address respond. B2 B U( u$ {2 N9 z
7 d" y9 [% |8 E9 c0 Z!--- Use the AAA server for authentication (AuthInbound).3 K. G% X; ?9 Z9 v! u" F
4 j, p P) D9 m
crypto map mymap client authentication AuthInbound6 H! c' N# B0 b0 Y4 ~; X, G
0 u t7 O- v8 R+ Q!--- Apply the IPSec/AAA/ISAKMP configuration to the outside interface.
- [; [$ A' A; N! D4 a
6 V* T( o, A% s( Z. j2 X' p: ~crypto map mymap interface outside G7 ]6 a" O: B" Z* B
isakmp enable outside
7 x; K; y+ b2 |& K" ~, [$ }& a# \# M# v; c' W. |$ O4 f
!--- Pre-shared key for VPN 1.1 Clients.) @" ]/ n7 {$ J3 V) q! O, y' f
4 h1 L: `# O; o' k9 D
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
, Z) n. Z$ ]" L! ]% }3 f& P+ ?isakmp identity address
8 m. ^7 ]3 f* {" d1 _+ |3 z/ h; p _+ s# G4 s$ A' k' W+ D
!--- Assign address from "VPNpool" pool for VPN 1.1 Clients.
, x; r4 y3 l3 o! G3 c" f
" O9 q- y# B2 Q1 Pisakmp client configuration address-pool local VPNpool outside
8 `2 t4 B$ E# o5 N4 p7 O, V) P+ a: j/ G
!--- ISAKMP configuration for VPN Client 3.x/4.x.9 H* N1 m8 ~% e( v1 M
* R: D% R( j, C8 S M& q* H+ S
isakmp policy 10 authentication pre-share
$ l0 k6 Y$ n+ O# @isakmp policy 10 encryption des
/ t4 D! l! B2 disakmp policy 10 hash md5+ s; ]5 v1 k3 R' q/ `5 C
isakmp policy 10 group 25 p6 ^3 k% Q; b: j7 t
isakmp policy 10 lifetime 86400, M' g& _" b }1 o- T4 G
! Y) u; u$ G, F
!--- ISAKMP configuration for VPN Client 1.x.
1 p" j! v$ k% C+ X+ I* T1 x0 {+ h. ]6 [0 i/ [ X5 I3 @
isakmp policy 20 authentication pre-share
2 F6 _4 U3 U h5 @isakmp policy 20 encryption des
9 k# k6 k& M: u; Q1 e! _3 ?" Visakmp policy 20 hash md5. z/ T) p8 K: z2 D- H: E
isakmp policy 20 group 1! m9 `/ U. x# @- k6 e( t" R& y! W5 F
isakmp policy 20 lifetime 86400+ A; K' n: W/ O
$ y+ @. t: e" |7 {/ p9 T
!--- Assign addresses from "VPNpool" for VPN Client 3.x/4.x.
) Y; Z. n7 i$ G/ Y0 `3 ^6 W
" \+ N5 e# E0 E8 e# d4 k# Hvpngroup vpn3000 address-pool VPNpool
* n- c3 v5 J) b9 d* P
8 U0 m. M z! t) b2 O: Nvpngroup vpn3000 idle-time 18009 _* z* ^! w( G5 C8 u" f
* C _4 k6 k* W+ m ?$ V
1 w3 J, t/ e: q! b!--- Group password for VPN Client 3.x/4.x (not shown in configuration).
' ?7 @. @( K! l8 }; e1 K1 C d
. f7 g5 b9 Z3 D2 x# l, ivpngroup vpn3000 password ********& w1 B8 p) E9 H+ l- ^, ?% D& a
telnet timeout 5* P$ j( x& `$ t, ~% q, `5 a
ssh timeout 5
" S1 ~% q6 ~2 `5 h0 n8 N G3 w) zconsole timeout 0
1 k- q3 B, h$ V6 lterminal width 802 r6 k' M7 ~" e6 H% I
Cryptochecksum:ba54c063d94989cbd79076955dbfeefc' i2 y4 |7 S* u
: end; I: O* y# |- V; b/ y* T" K" O
pixfirewall# |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
