环境： pix515e下接3560g下接2960
' U/ H( Z! D% }4 y) s. U( T, c g/ H3 N! O, M
目前在3560上划分了一个vlan 172.16.1.1，但其下面的主机无法上网，希望大家帮助！！！2 [5 ~- C3 `, |
. O1 u$ E' y; n目前网关路由在pix上作的，3560上没有起三层接口，就划分了一个vlan 172.16.1.1
% l8 u1 K B# E7 s) k
$ h$ y F1 v" a; W& O4 L) R! Q/ [6 Spix配置如下：PIX Version 7.2(2)
- y$ j/ R, u2 d$ ~1 k!) |* G" `8 e0 K2 Y& l* |, o, [5 S
hostname pixfirewall
% C8 x3 }3 j2 _9 \ |enable password PLBb27eKLE1o9FTB encrypted
. r* y6 m3 [4 bnames
9 _* U- X/ N' s$ m9 X!
4 t) r$ G! K6 [- rinterface Ethernet0" t# d8 n. k! t1 \5 `1 n4 A
speed 10, |4 M. |: v0 {( J! u
duplex full4 l2 \# s. {2 O: q
nameif outside T+ V) l q/ f* u1 s6 s! ?. S
security-level 0
! Y3 }8 n! e) K3 x* V% }ip address 61.50.220.51 255.255.255.0' e8 d: {6 j, N9 o1 _
!
- b) [" w5 P0 u: B# @4 f4 U* n7 kinterface Ethernet1
& A* u* L4 |5 f8 F% A- a" _7 Bnameif inside
6 \) [ l3 F8 A& isecurity-level 109 c$ G; `; ~& {. b% ? \
ip address 192.168.1.1 255.255.255.0
" e/ I* ]6 e9 `. t# n!% S' {* a q* n% f5 T m0 [' e' r. ?
passwd 2KFQnbNIdI.2KYOU encrypted3 K: Q9 r1 c* v, D$ M* l* e
ftp mode passive1 H! c. V0 A R6 g
access-list 101 extended permit tcp any host 123.124.10.33 eq smtp7 H0 ?1 n' p; r
access-list 101 extended permit tcp any host 123.124.10.33 eq pop3
2 v' x1 N7 X3 P7 Z7 v( N! Vaccess-list 101 extended permit ip any host 123.124.10.33
) h" i4 u6 T& t, O7 |# f' Gaccess-list 101 extended permit icmp any any
% G8 s7 i0 k, h/ kaccess-list 101 extended permit tcp any host 61.50.220.50 eq telnet% h. j1 S( ?. Z9 d( g
access-list 102 extended permit ip any any$ b0 z& {0 j, j
pager lines 24) F4 Q* h' B, m) i: u5 d. z3 Q2 }
mtu outside 1500% c0 F h Q& z# I9 g. k! N% I) ^
mtu inside 1500$ z$ @' l9 B3 p" T3 V$ Q
no failover# k" T( j9 a3 h j: O
icmp unreachable rate-limit 1 burst-size 1
7 J( f5 X6 D9 k& i2 w! lasdm image flash:/asdm
& x$ t3 L% R) |! eno asdm history enable
6 w* h' j7 k6 o( U5 s; Garp timeout 14400
3 t0 x1 u# J: z+ q9 v2 M+ yglobal (outside) 10 interface
. \/ x* ?" J' y7 [5 \) ?. Q( Jnat (inside) 10 172.16.1.0 255.255.255.0" F- a2 ]* l8 S% c# t
nat (inside) 10 192.168.1.0 255.255.255.0
" s) m+ B+ B% `" n: {static (inside,outside) tcp interface telnet 192.168.1.2 telnet netmask 255.255.
4 s" Z7 l* j; \/ {255.255
, o& E$ ]) D' ~. }static (inside,outside) 123.124.10.33 192.168.1.13 netmask 255.255.255.255 dns
4 V. M, x5 A2 [access-group 101 in interface outside \# K [ v J0 ]$ A7 W# c
route outside 0.0.0.0 0.0.0.0 61.50.220.50 1
! D; m4 p6 w+ [2 q) D) Utimeout xlate 3:00:00
5 c+ X: W3 o3 J' l8 _2 L) m I% Dtimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
4 U# t2 t7 E- l; u) P6 t! b8 Ztimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:003 ]! C, g$ p* a, g
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
/ {% c; ]6 d! R0 btimeout uauth 0:05:00 absolute
& m( b, j) o9 @# Cusername cisco password 3USUcOPFUiMCO4Jk encrypted
0 d8 {" @: v ~0 N3 T. I6 paaa authentication ssh console LOCAL
g M1 D/ k; U, Z3 Ono snmp-server location
, V! o2 p @: T l. {8 hno snmp-server contact) u2 o" T8 F$ x, ` V$ l/ S1 k
snmp-server enable traps snmp authentication linkup linkdown coldstart
8 p# j9 k+ x4 Q, `telnet 0.0.0.0 0.0.0.0 inside8 K. d; Q: V1 l
telnet timeout 5
0 }" ?" C* t" kssh 0.0.0.0 0.0.0.0 outside
/ @% l3 F2 s$ x# d. u! sssh timeout 5
/ M: \6 y( f. L0 a$ a% e7 ^console timeout 0+ F( P( }7 L0 x2 l2 A: \) X
!# i m- m" t. k& ]& E4 _
class-map inspection_default
' v% {* p2 m1 @/ G5 R+ S* Tmatch default-inspection-traffic! w! k' F" h. S+ D' w5 r
!
5 I, l7 s) p0 c# k" g!
, Z6 X1 P- w1 t# L; Epolicy-map type inspect dns preset_dns_map: j: I) N3 `* i6 ~4 C) }( a1 Q8 k
parameters
0 v$ @* a2 S! o! h& w2 R; l; ^. T9 L message-length maximum 512$ H4 H0 B# ~2 V, X
policy-map global_policy3 s3 x) C& l) A
class inspection_default
7 x1 L6 V6 y/ i inspect dns preset_dns_map" c" H1 B! r2 C) O
inspect ftp" \) X$ G+ e" e9 k; `7 L9 r
inspect h323 h225: ]0 D3 L" \2 w) {: A$ y
inspect h323 ras6 a* E* G" B' E! D5 ?- z
inspect netbios7 U' D. l. b% E2 s% y" g) l0 J
inspect rsh2 D1 |9 U a- s2 u( e. _
inspect rtsp
3 b6 u: X4 W& g" f/ O) I inspect skinny9 Y; W8 N# b: [+ U) d5 l, ^+ f
inspect esmtp
2 K) U# Z6 g0 a; T: T inspect sqlnet& `7 v: ?) j. b8 u
inspect sunrpc8 e2 i O; d% r% z1 N
inspect tftp$ L8 t6 \9 P6 L% N: f, R8 v
inspect sip8 ~# X) h$ L: Q2 J! F+ U
inspect xdmcp
5 C" M4 @% Y" y!, n7 s9 i u$ |5 ?1 F3 y9 u& f
service-policy global_policy global" @9 A" N( p3 M: r# z+ Y( y8 p4 d
prompt hostname context
7 n! }4 F, F+ qCryptochecksum:8d068ef288ac87a931be0633f63c429c& ?: b; f! M) N0 M' o- {& d
: end
% N$ ?& ~. R: M" w5 a* u/ n0 l4 a+ v4 u W* k
7 M5 b. v! a# G3 A- l: V
& u$ W2 l7 {6 {0 N
8 y4 v: z$ I+ W S5 l* T6 L/ x- `7 m7 g( u+ [0 p
! B' O0 u7 D& U$ M6 f7 ^; V0 y: P6 b+ c2 Z
) Y' j' i; Y/ A" Z
! A/ J! ^* U& g交换机配置：
: Q l+ T5 x* @( h
5 V5 R- _. g6 t# K6 bversion 12.2
5 j8 ?! k; i" o4 Y/ w3 jno service pad
1 l% T( \) y& t9 a8 f; J) H* wservice timestamps debug uptime; X' a# b8 @/ z- D/ X& b
service timestamps log uptime- d8 q5 B J5 a9 P; L) T# R
no service password-encryption
1 ?; x' b& Y2 q6 X!5 y9 p# l* i+ j1 W" z& G
hostname masterswitch
4 @$ ~: B6 v4 |( t! Y!
; E( y: f6 ~+ h: s7 m- oenable secret 5 $1$G4g3$e/d6Co33we5VtbUqKwQSo.
/ K: C- ?/ |' b0 Y8 O( Q3 N!0 Y$ w4 o; w! s
no aaa new-model* f, R. k2 V* y2 E# L3 M& h4 @ _
system mtu routing 1500
) G) ^. o8 U# j$ |" d1 h$ tip subnet-zero
2 D& Q- A: } q* Y! ~ip routing5 z6 e- W( l% Z6 ]
!8 a' K3 R+ }2 x5 m6 x
!
% s/ I" W5 w: G!
6 g5 t- l# i3 Z! L$ w& V# R!; N \! B0 @0 `) x$ y# |0 z
no file verify auto% n: T6 A/ J+ M0 u
spanning-tree mode pvst
: c3 K& i# \& p: Aspanning-tree extend system-id, ]: G4 ?! |* b; `& X0 O. j1 q
!. m2 S ^+ A% s, g
vlan internal allocation policy ascending% V8 A: B9 S( p0 k
!6 B# p; L1 {, L8 k
!! S) a) {" k ]; x+ F2 O3 u" |+ o
interface GigabitEthernet0/1' v9 _! q4 r0 R2 u* W$ w% n. g# r
!% w' T* U- c8 V# |1 |1 Z5 f$ G
interface GigabitEthernet0/2
9 M+ `; [6 j- M/ d!
# y+ m# L! o* G- Q' h, S. Y* ]% jinterface GigabitEthernet0/3
; O8 ^( c" q. y7 R# m!
4 R" I! s& q1 J# g& Finterface GigabitEthernet0/4
1 t2 _5 L) z$ ~9 h: Y!
% Y) X" N1 s7 x6 }# ]( k- R* D0 Cinterface GigabitEthernet0/5+ f2 L+ F1 {' l
!
; ]1 c0 {7 Y! I5 [4 d& U" Qinterface GigabitEthernet0/6
# I2 l$ S$ @' k" L. Q, L' }!" x3 H9 W4 a4 c2 C, f. q+ b6 `5 I1 i
interface GigabitEthernet0/7
/ I) d! H$ w) X0 d!; j* N+ z1 }/ G& R* ^! ^
interface GigabitEthernet0/80 \2 @- |. |8 ?
!
7 O6 M/ h8 W" z0 x: E; ]5 `9 c- Ninterface GigabitEthernet0/94 U% l$ P: Z" P6 }8 z
!) T6 U6 |% E( N3 O6 F2 Y* L; w
interface GigabitEthernet0/10: T7 Z6 l- S! a' n% \% S
!
. A2 d) m4 Q/ q8 k/ _" f3 sinterface GigabitEthernet0/11
0 P( ~5 L9 X% jswitchport access vlan 2
# l$ d8 D7 x l0 I* z0 ]switchport mode access
( Y# o: V0 o& F- U9 B$ A!
. ?* a0 _5 ]. ^/ G9 e& I4 [interface GigabitEthernet0/12
9 b B5 N' p4 J& C!
- @ N) W' R7 v! j3 F+ w sinterface GigabitEthernet0/137 m& N; D& C; f# y' l8 ]6 o
!3 P1 {2 Q8 z6 M
interface GigabitEthernet0/14
4 [9 r T; Q2 h- P! H2 j!1 p. D, a h `; N, a& w$ Y5 M
interface GigabitEthernet0/151 Q+ Z+ l2 d. T/ X
!" Y. A( T! s: X- n, ?2 t
interface GigabitEthernet0/165 H; B9 g& N/ @; y4 b, [
!0 X Z; u9 C, @ Z1 {& ^/ o) I
interface GigabitEthernet0/17
( A* b4 z2 q2 A1 `. Z!- k% [; ^ ^5 C5 x, r0 t
interface GigabitEthernet0/18
& u) P3 v. q+ p. f7 X!
7 P3 v+ L* I) pinterface GigabitEthernet0/19% L+ D% N% O; G
!& m4 w6 V! s. b: V. M
interface GigabitEthernet0/20/ H1 k+ P4 Q# C8 L
!
* h- c+ V2 B1 Vinterface GigabitEthernet0/21/ H0 A' Y5 { k& ^7 [3 c
!! F9 F% j0 Q, y: i6 j$ Z
interface GigabitEthernet0/22
2 `6 K$ B( [/ B5 t!
0 e: ~. {# r7 A& H. O- a% sinterface GigabitEthernet0/23$ b2 Q: _& w, }7 V
!2 Q" Q5 C7 w: R# P
interface GigabitEthernet0/24
/ {7 b# P: \- x2 I7 V5 {!: B$ M1 F f I$ C* `# Q
interface GigabitEthernet0/25
. P5 H; b) M; b$ j: h4 i) B!0 \% K @) L( \- e& X% z
interface GigabitEthernet0/26
, N% p- g& b- _/ W! W3 y# P% }6 ^9 y& P6 K1 ?
interface GigabitEthernet0/27
% B5 h5 g. e R" l: T4 k- l. p) Q!3 Z% H( Y+ k: u/ ^1 v9 s
interface GigabitEthernet0/288 k6 W4 W0 R0 ~4 n9 O( j; ~
!, e& C/ y4 ^* W7 W& ~4 }
interface Vlan1
, {, u) ] V; v9 a Vip address 192.168.1.2 255.255.255.0( g1 |. H$ e2 L( L
! v6 b( y, u3 o! L
interface Vlan20
) P: f% ^" `" y4 O& d, \4 |5 m3 k6 hip address 172.16.1.1 255.255.255.0& v9 u4 x' [- z% e
!- k: z# I9 K7 t7 ~4 t: }
ip classless
( c: p& n" a$ Z6 {9 O0 hip http server/ K2 l+ M7 Z" p( }' k1 F- Y
!
" m" m# S3 L, E8 [/ W!
1 \! q) P4 I! w& n8 ^3 W2 w; `!6 q# W5 M7 M+ w4 O" |- t" O- W6 Z
control-plane$ m% W# i6 M- J, h g' q) D
!
8 w" \5 c$ q: d* X" c3 e!
3 C8 E5 D9 n q2 x! n# S9 j7 fline con 0
2 M4 e' V. t) X! T' zpassword 123
/ w) y) K) o9 K3 j3 Tlogin Z; T2 @) \- [6 v3 D; W( a3 v
line vty 0 4% @+ Y% w1 u: c0 ?" [; J
password 123456
6 i, a1 A4 N' H6 Klogin- F$ V @/ N) y( e2 q" u: t
line vty 5 155 Y# l" F$ H* Z! @: Z: C7 {
login
7 {+ Y* U/ O1 f9 H!
+ r' O1 o1 L5 Wend |
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
