本站已运行

攻城狮论坛

搜索
立即注册用户登录
12下一页
返回列表 发新帖
作者: cankudewenrou
查看: 3637|回复: 14

主题标签Tag

more　+今日重磅推荐Recommend No.1

所有IT类厂商认证考试题库下载所有IT类厂商认证考试题库下载

more　+随机图赏Gallery

【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器

[安全] pix做vpn，vpn client拨入后不能访问内网

[复制链接]
cankudewenrou [Lv4 初露锋芒] 发表于 2013-8-6 04:46:44 | 显示全部楼层 |阅读模式
查看: 3637|回复: 14
开通VIP 免金币+免回帖+批量下载+无广告
现在的问题是内网地址可以ping通vpn client地址，可以ping通outside地址，但vpn client 不能ping通内网地址，outside地址不能ping通内网地址
3 f9 u. u$ U; }* o' v下面是配置：
0 A: K) F& G) O8 v: Ppix520(config)# sh run# @; }1 h- |1 b: c
: Saved3 S  G. o! m- i3 ^' i2 t
:
8 u0 o3 c6 o1 e7 |$ Q) OPIX Version 6.3(5)* |& k  V. q4 g3 t3 O4 f
interface ethernet0 auto" F6 N9 e3 J+ L8 ~4 n
interface ethernet1 auto
+ \9 a, a& I# Y) ]* L- pinterface ethernet2 auto2 P3 D* O/ j/ x- i  P2 |7 p5 U  y
nameif ethernet0 outside security0
5 u4 ^" c2 \5 k; K7 nnameif ethernet1 inside security1001 l' V: Y; d  c
nameif ethernet2 dmz security502 i  o3 O' X1 x. ?0 ^) o- }! A* O- q2 X
enable password KtzYd.GV6Ee0dpHi encrypted7 L6 U$ u$ v7 p. M  ^8 C1 n
passwd KtzYd.GV6Ee0dpHi encrypted* v9 h, x5 F+ R+ U+ q. c2 k# i# ?
hostname pix520: l9 a. v: a0 D: ^
fixup protocol dns maximum-length 512
( f! A. v, g8 ?fixup protocol ftp 213 H8 W; |7 s8 I* K
fixup protocol h323 h225 17207 \! |* v  y2 r/ e3 U
fixup protocol h323 ras 1718-1719
- W3 O4 T3 J) }, Qfixup protocol http 80' Z2 t4 U+ m$ [0 x
fixup protocol rsh 514/ S, R2 Y) @+ _
fixup protocol rtsp 554
3 y+ `6 O$ w; r7 K5 t. I$ dfixup protocol sip 50608 W0 Q/ @$ H3 |+ t/ B' F# ^
fixup protocol sip udp 5060
5 u% L+ B5 ], hfixup protocol skinny 2000
3 @2 {2 N' N# n; bfixup protocol smtp 25, P" W' j! W$ J  v7 h
fixup protocol sqlnet 1521; P6 O! Y& _% A. Q2 [9 ~
fixup protocol tftp 69
) n# u- G" k% Z3 w7 ]names" _5 a- U! P$ M9 Z, Q: [
access-list 100 permit icmp any any ( {# E# I" a0 ~/ x
access-list 110 permit ip host 192.168.1.2 172.16.16.0 255.255.255.0
! o+ [, z) `( Oaccess-list 110 permit ip host 192.168.1.1 172.16.16.0 255.255.255.0 7 `$ S' z" T5 b- s: x
pager lines 242 g# m% A6 U1 A" {0 Z2 u2 l- f
logging on
# ]$ D3 ^( s) F2 jmtu outside 1500
, Y/ `2 S  V$ rmtu inside 1500$ M: P* W. \9 v
mtu dmz 1500
& r- ~& u9 I3 tip address outside 10.166.17.24 255.255.255.224
3 _9 Q4 O" s: v: r2 uip address inside 192.168.1.1 255.255.255.248
+ `8 @  V9 {( j* l5 Lip address dmz 192.168.2.254 255.255.255.0
4 H2 Q5 w  S4 ]5 gip audit info action alarm( m6 I) h5 W$ M# x8 P0 x: o
ip audit attack action alarm
+ r/ u( V$ Y7 ]ip local pool vpn 172.16.16.1-172.16.16.107 \& \. B& }8 ]1 d  B0 j
no failover
, g1 R  p4 b. O" @- ^  U1 c8 Nfailover timeout 0:00:00, g( f1 T- V$ [- ~
failover poll 15
+ t& K8 F3 {0 h' xno failover ip address outside
3 G! ?8 o, g6 S: m$ Y! S# z$ xno failover ip address inside
, u) g  A3 ^7 ?" f3 X7 kno failover ip address dmz
7 |, F6 m# C7 s- g3 H4 F4 Tpdm history enable) Q) l8 E  w( u9 E; {5 E" c7 M1 ?
arp timeout 144006 h9 {+ f5 ^) J$ Y: M7 z& n$ Z2 o8 a; S
global (outside) 1 interface
+ n8 ]  C7 ?3 Q$ s9 D6 pnat (inside) 0 access-list 110
& |: z$ H4 s5 \  ^/ H, ?nat (inside) 1 10.166.21.197 255.255.255.255 0 0
$ C; x( j: g( q3 R& I* V! H8 Knat (inside) 1 10.166.21.229 255.255.255.255 0 0
: ^  [& o' h  n% R. P8 mnat (inside) 1 10.166.21.231 255.255.255.255 0 0
7 d: R2 {7 v0 b9 o& }9 F. Wnat (inside) 1 192.168.1.0 255.255.255.248 0 0
, [  t6 p$ A' v4 u! anat (inside) 1 10.166.17.0 255.255.255.224 0 0
* D( o/ c2 J; n1 Z& nnat (dmz) 1 192.168.2.0 255.255.255.0 0 0
4 C* [& f1 Q" P) ?% `0 g8 ]; e4 raccess-group 100 in interface outside8 q* \3 c* ]2 Y1 K3 Z. |! I# l! Y
conduit permit icmp any any " P! Q3 O7 P; e0 [$ ^
conduit permit ip 172.16.1.0 255.255.255.0 any
4 {- Z( Q0 v/ ^7 Mroute outside 0.0.0.0 0.0.0.0 222.171.24.161 1
. G5 _2 f4 k; ~" t7 Lroute outside 10.166.0.0 255.255.0.0 10.166.17.30 1' e( r, _7 q2 I  S7 K. C
route inside 10.166.21.197 255.255.255.255 192.168.1.6 1
" ~) t7 W6 V# R; O1 U& C4 ~3 qroute inside 10.166.21.229 255.255.255.255 192.168.1.6 17 ~& C3 D' l) ]/ `
route inside 10.166.21.231 255.255.255.255 192.168.1.6 1
+ J; O% ~' k1 ?timeout xlate 3:00:007 u9 h. J/ a7 Z2 f6 _- m8 D7 K
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
: q: Z# x4 y# P0 \  qtimeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:008 z) A$ g0 ]0 |0 n" K. S8 f  r# }
timeout sip-disconnect 0:02:00 sip-invite 0:03:00* ]/ M* f& l; s9 S' y
timeout uauth 0:05:00 absolute5 ^+ ]7 Z2 s5 `$ f' b: Y
aaa-server TACACS+ protocol tacacs+ 3 P! D+ D' n  o9 H
aaa-server TACACS+ max-failed-attempts 3 ) e1 [% \/ F- p( K( A8 y" o3 x9 z, w
aaa-server TACACS+ deadtime 10
1 T9 L- y* d  c. k2 S6 `aaa-server RADIUS protocol radius
% Y- H! x$ i3 j. Xaaa-server RADIUS max-failed-attempts 3 * A9 K  B3 U9 P3 P8 O
aaa-server RADIUS deadtime 10 + b$ @' a5 ?' f, G
aaa-server LOCAL protocol local * N. ?: E- w' G+ D6 ]% b* B
no snmp-server location
) ?9 |4 a) w; d) P) W+ m5 y( Zno snmp-server contact% t" J5 D+ A- a/ b. Q8 K( N
snmp-server community public) n) ^5 i+ U/ F. Q- f
snmp-server enable traps; O# {+ w. B1 m) m( l
floodguard enable, F% g" M2 ^( p* |3 {7 |
sysopt connection permit-pptp
# I  R; K6 n! utelnet 10.166.17.0 255.255.255.224 inside4 ~. c3 C  R+ U& k' v$ r0 I
telnet 192.168.1.0 255.255.255.248 inside
( G$ q' l# t4 G9 F: N2 V- I6 M# e1 Ztelnet 172.16.16.0 255.255.255.0 inside/ z0 O5 w- ~  \  A+ t! d
telnet timeout 5  m) f6 b# t8 E7 S
ssh timeout 56 J+ e* ?4 n( o
console timeout 10- ~+ [$ q, Z- c' J3 ?. x6 J6 r
vpdn group vpn accept dialin pptp9 f) R% W9 m" ^$ P, e" p
vpdn group vpn ppp authentication chap
5 Q; h  n% `5 @, k% ?vpdn group vpn ppp authentication mschap
$ G$ s2 x3 Q: C3 Kvpdn group vpn client configuration address local vpn
) c: q! `1 R/ N- _' jvpdn group vpn pptp echo 60
) ?' B; [$ a5 S. Gvpdn group vpn client authentication local
! Y; E( l$ E1 `, k" Nvpdn username hrbbvpn password ********* 2 N5 Y) n+ W4 O, @% F: F
vpdn enable outside
; g0 I! s+ a1 i1 L% Gterminal width 801 H9 U! j( k- @' u" w+ H1 o% U
Cryptochecksum:fe58163e929e292f23b07d8e0e890ac3
1 i& `0 A- Q& Z* P: [) p+ c: end
interface, password, protocol, outside

相关帖子

CCNA考试 官方正规报名 仅需1500元
回复 论坛版权

使用道具 举报

yqboss [Lv4 初露锋芒] 发表于 2013-8-6 10:11:03 | 显示全部楼层
顶上去，帮我解决问题呀，都好几天了，还没解决。

2000人 活跃的 IT技术 & CCNA/CCNP 题库/战报/备考交流QQ群 2258097
回复 支持 反对

使用道具 举报

雪中送炭 [Lv4 初露锋芒] 发表于 2013-8-6 11:39:18 | 显示全部楼层
ip local pool vpn 172.16.16.1-172.16.16.106 I4 q) a& s% k- V2 a. Z
用pptp做vpn,地址池应和内网在同一个网段,而ipsec vpn则不存在这种问题，试试看行么.$ x4 U( c/ M3 y
7 c( y3 T3 C: ~! m6 ^" X8 v
qq:365238063
回复 支持 反对

使用道具 举报

sea_star [Lv4 初露锋芒] 发表于 2013-8-6 12:33:19 | 显示全部楼层
楼上的，别误引人家.
回复 支持 反对

使用道具 举报

chen135124 [Lv4 初露锋芒] 发表于 2013-8-6 12:34:41 | 显示全部楼层
[QUOTE=yqmqk123;1552253]ip local pool vpn 172.16.16.1-172.16.16.10
: ]: K5 I2 {# u2 b7 ~用pptp做vpn,地址池应和内网在同一个网段,而ipsec vpn则不存在这种问题，试试看行么.7 M( }; [5 d/ J& k; x

" i  j% U1 I5 `/ e3 Cqq:365238063[/
+ e3 _( Q1 O/ `1 c) O* w7 X( B# H: f
/ U/ T) ]: I2 o9 A+ A. z: a5 c* V6 {5 r$ R9 w! m$ x: T; U
VPN地址池的地址无论跟内网地址在同一网段或不同网段都不行
回复 支持 反对

使用道具 举报

thomaslts [Lv4 初露锋芒] 发表于 2013-8-6 13:04:50 | 显示全部楼层
: Saved5 c& b0 N3 e1 Q( y
: Written by enable_15 at 05:21:42.610 UTC Fri Jan 1 1993
1 j4 ]7 A. r4 I3 W. H/ Q# L' @7 JPIX Version 6.3(1)# }9 a; J- x1 p4 z& b
interface ethernet0 auto
9 i2 l- g! ~! n- _& ginterface ethernet1 auto- l" w5 ?. H" g7 |7 ?, n- S  ?
interface ethernet2 auto
/ J) }/ o' [, t. C5 Dnameif ethernet0 outside security0! t) j$ }0 M" V0 k; |5 e# k( p
nameif ethernet1 inside security100
, G6 N. ^) k8 S: rnameif ethernet2 intf2 security4! t; Z4 u5 r- c' T- s& E
enable password BBW5rMAbR8M/iSky encrypted, [& ^/ y" h" Y7 i9 P7 d- a" m
passwd BBW5rMAbR8M/iSky encrypted
7 t( |& k" H* Fhostname pix515
7 E7 m. E% m& h& O1 B/ o+ k: r/ |2 ~  Efixup protocol ftp 21
, }0 T3 `# C1 B6 v1 ?6 S3 r( Efixup protocol h323 h225 1720
* E) k9 ]4 a& m8 A& `" zfixup protocol h323 ras 1718-1719
. A/ I2 C2 o# j; s* M2 c4 z# \; nfixup protocol http 809 j( s7 n: B* J3 ]" _
fixup protocol ils 3896 P* H$ X0 l, b
fixup protocol rsh 514# n6 g: A: H$ ~/ f
fixup protocol rtsp 554
2 ]2 @( D$ \6 jfixup protocol sip 5060
! C' d$ S! {3 D( rfixup protocol sip udp 5060
8 S2 g0 _! m, }9 }' n$ c% ofixup protocol skinny 2000
# }! q- f1 N# E# i- ?6 N( T. ~9 Lfixup protocol smtp 25  ]& ~* H) G. m% \  T1 x
fixup protocol sqlnet 1521
3 @& b( n8 k/ \% A$ p* ~names1 I) W2 d4 r3 I+ t
access-list 101 permit ip 192.168.188.0 255.255.255.0 192.168.1.0 255.255.255.0 , N4 j' |8 y9 I+ [  j
pager lines 241 P( `# b- l. r- F" H8 s5 Q
mtu outside 1500, n* ]% h0 B. @  B* x* \8 f
mtu inside 15000 Y2 E% E! {: y+ g( K
mtu intf2 1500
; d6 F/ Y3 H. H8 t: M, r; X1 p. h) mip address outside 192.18.121.251 255.255.255.0
  ~9 _/ g8 a, f/ V  gip address inside 192.168.188.50 255.255.255.0
9 `' H: K, O* K  ?" ^3 U7 sno ip address intf26 F1 @% R7 z& I+ b9 Y6 Z* }  `& \& H
ip audit info action alarm
; L6 K! h; o: V( Iip audit attack action alarm+ z/ c0 L' h0 F3 d( T
ip local pool bigpool 192.168.1.1-192.168.1.254% g" Y, F0 R6 y# [8 k, L
pdm history enable0 h/ o% u  D' Y# R( W9 a8 Y
arp timeout 144006 `% }7 v8 ^5 y4 G( v4 `  H) R
global (outside) 1 192.18.121.80-192.18.121.90 netmask 255.255.255.0
6 y4 I* ~6 d6 v  Pnat (inside) 0 access-list 101* q; z8 b9 b' ^. t7 z2 Z6 ?
nat (inside) 1 192.168.188.0 255.255.255.0 0 04 g- G; o1 |% H. h- z5 ~
conduit permit tcp any any
0 w" ~  @  i+ s' M! F. j9 Dconduit permit icmp any any , W* D+ F; ]. A. Q6 T& E1 e" p
conduit permit ip any any
% r0 U& |# W" Croute outside 0.0.0.0 0.0.0.0 192.18.121.251 1
9 \, u6 P: Q3 {4 e  a" Itimeout xlate 3:00:00' ]9 A1 j3 |; M9 u' K
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00' v2 z2 P+ @4 l
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00$ Q  q( x& ~% A/ }
timeout uauth 0:05:00 absolute! [4 s' J: A  o; u- n1 E, @
aaa-server TACACS+ protocol tacacs+ 6 \) l1 o0 x* g/ l. X
aaa-server RADIUS protocol radius
: F) `( a3 N7 v. c% qaaa-server LOCAL protocol local $ C# j& L' i4 s; O
http server enable- r# p, |$ ]* y/ e1 C# `0 I
no snmp-server location" M1 F% P1 T+ R7 L. `+ i
no snmp-server contact, ^4 E" ?9 Z* O1 [# D5 N6 {, a
snmp-server community public* A2 a2 \; c* }1 a* M0 o
no snmp-server enable traps' j7 {% T# [0 k$ ]3 S, f
floodguard enable
: {# }9 Y* n5 D# [telnet 0.0.0.0 0.0.0.0 inside& w7 \7 C* {+ ^! {4 X
telnet timeout 5' J2 _6 H" t/ e0 H# F( H
ssh timeout 5
5 c: B6 I) E/ g$ T1 Nconsole timeout 0: X# i; z" {; x) w3 t" |* K
vpdn group 1 accept dialin pptp
% U2 X9 {3 ~$ F( `& }vpdn group 1 ppp authentication pap: A' y0 m9 c% P6 e; k# h
vpdn group 1 ppp authentication chap% X6 D$ H1 j) t3 m1 `  B! M
vpdn group 1 ppp authentication mschap
/ F5 Q( ]' ]; ]! i- dvpdn group 1 ppp encryption mppe auto
; P7 K0 [+ ?6 z7 C/ w) jvpdn group 1 client configuration address local bigpool
7 h/ K9 K& J4 Rvpdn group 1 pptp echo 60
" L6 n; X6 }/ A2 {+ e# z( h8 Ovpdn group 1 client authentication local" q+ Y  s1 L9 Z6 e: E# S
vpdn username cisco password cisco ( s5 y0 G/ k6 }, U9 D- ~
vpdn enable outside% `- |6 P5 Y+ r$ Y
terminal width 80( W, x+ {2 W3 }
Cryptochecksum:fa58cbeb1dd1dc3d2681a13b218aab88
2 W0 W" C( T) s- ]$ c  y1 N; u0 G: end
, V! G. I5 e+ t: ~7 F/ x" U这是我在pix515E上做成功的实验.
  l' g7 W) e2 H6 ?" F外网:192.18.121.x2 K2 |5 m) N. \3 w3 Y. R1 [: h
内网：192.168.188.x
) p! O3 v4 j# d% g8 a9 _* qＶＰＤＮ：192.168.1.Ｘ. n1 J0 \5 j- {1 D# e/ j
ＰＩＸ：内网口接PC
1 x' y! R6 `* \PC：LAN IP 192.168.188.x& k! Y0 e( A9 w/ @% }! G
       网关：192.168.188.50
7 F: n* q, z+ \8 O       DNS:当地的DNS* n; {$ Z3 b2 B- x& \
说明:把192.18.121.x网段当外网段，因为这个网段接另一个路由器可以上网的。你看看有没有帮助吧
回复 支持 反对

使用道具 举报

udpink [Lv4 初露锋芒] 发表于 2013-8-6 13:32:04 | 显示全部楼层
vpdn group 1 ppp encryption mppe auto 5 I, \0 y' j. c5 d& @* s* d
兄弟，这句话在show run的时候能显示出来吗？我条设置我确实做过，但在show run中没有显示出来。
回复 支持 反对

使用道具 举报

111222 [Lv4 初露锋芒] 发表于 2013-8-6 13:41:30 | 显示全部楼层
今天我把配置做了改动，改了配置后，vpn拨入后能访问dmz里的主机，不能访问inside里的主机。dmz里的主机能访问外网和vpn client，但不能访问inside里的主机。inside里的主机可以对dmz里的主机和vpn client访问。7 b$ T0 X1 z+ B
1 c6 J! Z2 _* _* r8 g
我的目的：想让vpn client拨入后能访问inside里的主机，或dmz里的主机能访问inside里的主机，都可以。0 V3 {7 a3 q7 N' `9 \4 s  `/ T+ ^

  m* b: g6 d6 X' h' n1 G0 d5 _注：外网、dmz里的主机、inside里的主机都是直连到pix520上的，pix520的os是6.3（5）版本。
; S* L( \  Q' i& J: I
( j' T# x8 V7 @! d) z5 x附配置：4 K7 p/ R& e6 r7 o' P) x
pix520# sh run, d# V0 [* @4 U% o
: Saved. K3 [4 P5 y; `5 x( \& d
:
2 a: p' w) c$ F; U7 `+ q$ g" w9 JPIX Version 6.3(5)
# A9 ]- |. J8 j( I( M9 V: O/ Zinterface ethernet0 auto
' k- X$ R: Q6 C/ }* _interface ethernet1 auto2 a( j; V, {; G" o3 f6 w" A4 Z; \
interface ethernet2 auto5 ~! ?5 V& E4 Q
nameif ethernet0 outside security0) J2 b: X" z3 ~- @9 m1 u6 \& x: w
nameif ethernet1 inside security1000 V& o0 I, m( E/ x
nameif ethernet2 dmz security50
& _7 g/ U2 S8 B. Denable password KtzYd.GV6Ee0dpHi encrypted
( ?! J& L' l+ l% i6 B3 Ppasswd KtzYd.GV6Ee0dpHi encrypted
2 E( Q+ u, D# ]+ W/ lhostname pix520
4 [8 J2 j* j- R7 t- P3 Q/ [6 Rfixup protocol dns maximum-length 512: h7 s- A6 h1 n  f2 C2 |5 d% [3 f- i
fixup protocol ftp 21
* C4 y& ]9 U+ x" @- tfixup protocol h323 h225 1720
) _# c9 q$ Q9 |9 T" @fixup protocol h323 ras 1718-1719) t6 {! b2 ~$ U9 s  Q
fixup protocol http 80+ I# j4 w% Z1 d; T  g& R2 h
fixup protocol pptp 1723
! a2 g* D) E: q; Gfixup protocol rsh 514
7 z/ G* ]/ g# J6 q9 i5 zfixup protocol rtsp 554
3 z1 N& @" `: F- I; _) Sfixup protocol sip 5060
* n/ J0 M# E2 a9 U" K) Ifixup protocol sip udp 5060: c' V; r) j8 a- g9 T
fixup protocol skinny 2000
! ^* O7 V* E8 u$ J$ Bfixup protocol smtp 25: w( F7 N5 r: T& a1 k
fixup protocol sqlnet 1521( `3 _1 ^) P* y- P* l9 `/ O
fixup protocol tftp 69& {: F# o4 r8 P- g7 r% D. x7 [
names! M' H: z4 Z- J- F- }  u' o4 @
access-list 101 permit icmp any any ( M- {. R/ a1 }; M
access-list 101 permit tcp any any eq 3389 7 l2 O+ B7 R+ P! H# m- q" [
access-list 101 permit ip any any
. U5 o; c' Q  R* i6 U2 Y3 jaccess-list 100 permit icmp any any
2 S0 O# t" e1 |. p0 [1 [8 t# faccess-list 100 permit tcp any any eq 3389 : J: N* A# W: X3 b- A( ~
access-list 110 permit ip 192.168.2.0 255.255.255.0 192.192.192.0 255.255.255.0 5 V" z' \: w) t& e
access-list 110 permit ip 192.168.2.0 255.255.255.0 172.16.16.0 255.255.255.0
! r# ]+ U$ M5 x6 Z- Jaccess-list 111 permit ip 192.192.192.0 255.255.255.0 192.168.2.0 255.255.255.0
* g& G# F; N8 k7 J$ Laccess-list 111 permit ip 192.192.192.0 255.255.255.0 172.16.16.0 255.255.255.0 * g6 V" F4 e" m( P
pager lines 241 C9 X9 U( i7 t+ o3 t9 m
logging on
' s3 `$ K. }5 U7 S3 e$ n2 H" slogging monitor notifications, [$ D+ w  w% O3 j% o7 p( e! J
logging buffered errors
! B& Q& X5 x! I9 {! }- llogging history informational3 I6 T# A8 q4 X' }) W
mtu outside 15001 F7 i8 c. |- i$ j3 `2 D; c
mtu inside 15003 w0 F! X  q+ s, _1 D  l6 _" n. D
mtu dmz 1500
) _+ U$ C  f$ P0 {9 x2 G# V- kip address outside 10.166.17.24 255.255.255.2244 q4 o0 n. c& k
ip address inside 192.192.192.1 255.255.255.01 Y! Y8 I/ l# v1 l
ip address dmz 192.168.2.254 255.255.255.07 R- S( ^4 x5 Z. B; Y
ip audit info action alarm
* n' p6 Y1 I. }6 R  R" qip audit attack action alarm
, E; f2 s$ \" ], q6 eip local pool vpn 172.16.16.1-172.16.16.254
" b; U  Z$ j" l5 N9 j1 gno failover# h4 n$ Z0 g& l, N
failover timeout 0:00:00/ u4 r% e7 T" z6 y4 f7 r
failover poll 15
; r8 u6 J# m0 Z* k3 r9 J, X5 F( V, dno failover ip address outside
! O2 F) Y% Y! N; ]- z* pno failover ip address inside
9 p5 [3 o: J0 E1 M3 \2 ino failover ip address dmz
. ?9 Q2 J* Y, U" J+ y7 l( Qpdm history enable. r) y0 V2 J+ O  a6 y
arp timeout 14400
) \' N6 K; N/ I, a4 k) Mglobal (outside) 1 interface4 u7 z7 g8 d- \2 w$ X
nat (inside) 0 access-list 111
) A6 u: S2 V3 R, Gnat (inside) 1 192.192.192.0 255.255.255.0 0 0
9 A2 H$ O/ T& R3 r6 Qnat (dmz) 0 access-list 110
; B& t+ P5 z# d, z) X' Bnat (dmz) 1 192.168.2.0 255.255.255.0 0 0
+ [4 P* _8 B: T' L7 tstatic (inside,dmz) 192.192.192.2 192.192.192.2 netmask 255.255.255.255 0 0
$ t  e) }+ i! J! @6 `access-group 100 in interface outside/ R. [4 m9 v- H# ~# ]0 {7 y& u
access-group 101 in interface dmz- M8 O9 T, A8 u- G; v
route outside 0.0.0.0 0.0.0.0 10.166.17.30 1. ?0 m5 h# T8 Z7 [) [4 m2 q
timeout xlate 3:00:00% G5 r4 X9 ]# i
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00$ l6 z3 t, R& I3 {7 I. L
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00- i4 E- w5 M5 Y( C/ F) W  a! U
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
4 U1 I( L+ i& A, e% K6 Ztimeout uauth 0:05:00 absolute6 w8 G4 R; ]9 s% i; [2 w1 Y
aaa-server TACACS+ protocol tacacs+
! {7 ~, t# P$ G' i% Waaa-server TACACS+ max-failed-attempts 3
5 z1 T/ T" A7 h  Caaa-server TACACS+ deadtime 10
5 n( t$ O) r8 l' Faaa-server RADIUS protocol radius
* ?" _7 }, F( V/ o8 v* H1 J0 J: r% @aaa-server RADIUS max-failed-attempts 3 0 k2 A6 u+ f+ q$ F% h5 S6 Q+ K! D
aaa-server RADIUS deadtime 10
7 p, \! W+ m: P4 e$ waaa-server LOCAL protocol local 3 c) a& n8 Q; Q
no snmp-server location
0 L& s# o2 B7 Q- t* sno snmp-server contact
, E5 @$ N  I( x  \snmp-server community public
/ \  K; S5 V# q/ G# mno snmp-server enable traps0 r: a9 d- S0 v6 _  c( i
floodguard enable
" h- h" ?: u4 isysopt connection permit-pptp
4 R# k/ ~# N( n. ^0 {sysopt noproxyarp outside
+ S6 ], ~' i3 z0 n  o% asysopt noproxyarp inside
) B0 n$ _- s6 stelnet 192.192.192.0 255.255.255.0 inside, C" K/ ]5 S" P9 P& @
telnet timeout 5& U( ^' v  T: K2 O; s
ssh timeout 5  A: a! g6 w) }9 M1 T( v7 I1 `. u
console timeout 0
, G0 Z! g( ^) u) k9 gvpdn group xxzx accept dialin pptp' O% _) j# l& w4 i0 ]
vpdn group xxzx ppp authentication chap, G4 ~# A6 q; x( v# T# r# Z6 E  a' F4 o
vpdn group xxzx ppp authentication mschap; n) n1 p) `& V5 D
vpdn group xxzx client configuration address local vpn
- v, g- M6 Z3 k& j1 s& @vpdn group xxzx pptp echo 600 N# W* a5 u9 p' z. M# q5 ]
vpdn group xxzx client authentication local8 N. r9 J5 Q, D! i4 p/ D- ~
vpdn username hrbbxxzx password ********* / p' V% H; Z9 W0 [
vpdn enable outside) m7 Z0 m$ K% y+ q' O$ V
terminal width 80
9 h* z% e. X. C( {% Y. t; ~Cryptochecksum:ca107db971e827731294bffc5e00dc39' s8 Y- k1 B, O
: end4 {; m( P3 N0 J
pix520#
回复 支持 反对

使用道具 举报

bbbbbbbbb [Lv5 不断成长] 发表于 2013-8-6 14:26:30 | 显示全部楼层
顶上去
回复 支持 反对

使用道具 举报

unreal [Lv4 初露锋芒] 发表于 2013-8-6 15:04:10 | 显示全部楼层
帮顶.  同样的问题
回复 支持 反对

使用道具 举报

下一页 »
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

QQ|无图浏览|手机版|网站地图|攻城狮论坛

GMT+8, 2026-10-15 12:15 , Processed in 0.116188 second(s), 15 queries , Gzip On, MemCache On.

Powered by Discuz! X3.4 © 2001-2013 Comsenz Inc.

Designed by ARTERY.cn