今天我把配置做了改动，改了配置后，vpn拨入后能访问dmz里的主机，不能访问inside里的主机。dmz里的主机能访问外网和vpn client，但不能访问inside里的主机。inside里的主机可以对dmz里的主机和vpn client访问。
% p2 f" c( g4 w& B/ Y Q, P$ `. A% i7 B/ @
我的目的：想让vpn client拨入后能访问inside里的主机，或dmz里的主机能访问inside里的主机，都可以。' D% v- a( ~7 h) u3 W
* N- U9 l6 N( b: [, D
注：外网、dmz里的主机、inside里的主机都是直连到pix520上的，pix520的os是6.3（5）版本。& m6 c9 S! C! {7 o- Q( M8 K
: L2 C* g7 m0 h2 G
附配置：
- P+ c1 J, Q- zpix520# sh run
g0 A; j; t7 C/ @, ?4 z: Saved
; ~. K' ?8 W* E:
: v# h" F h4 N: MPIX Version 6.3(5)
4 n5 j% V3 y" e Y# yinterface ethernet0 auto
8 ], ?5 i9 q2 J( E9 j% `# F( einterface ethernet1 auto
; x! f0 e. k! Einterface ethernet2 auto
+ O4 P, o- E4 \' Z, J% lnameif ethernet0 outside security02 [' o3 E& S$ ~& b( x$ w# ?
nameif ethernet1 inside security1002 j0 e. v u- n3 P0 K
nameif ethernet2 dmz security503 R2 y9 H: s" `; T( s6 g; i
enable password KtzYd.GV6Ee0dpHi encrypted# w/ Z, C7 ?' g) b7 w
passwd KtzYd.GV6Ee0dpHi encrypted4 ]9 F; w% W6 `
hostname pix520- ~* q, L- j! a9 L! r
fixup protocol dns maximum-length 512
- K$ A1 H B# xfixup protocol ftp 21& e7 l9 M* ~3 `/ R8 E, Q
fixup protocol h323 h225 1720
* ^' `3 W! F3 H* k! c7 g8 k' }fixup protocol h323 ras 1718-1719/ Y$ S! u/ R6 T4 D( d+ e$ l& k
fixup protocol http 80
' j3 p3 V! L3 r, Ffixup protocol pptp 1723
0 A# c6 N6 M# N/ I8 W* ffixup protocol rsh 5145 G$ K, p7 ?+ _! \2 u+ Q
fixup protocol rtsp 554
( v) R9 |) U" kfixup protocol sip 5060
" w# p& A- A4 N% D" ofixup protocol sip udp 5060
- i, h( p8 s/ C- J% M3 \fixup protocol skinny 2000$ T) [1 {" i r$ |9 @$ p, F
fixup protocol smtp 25
, K3 Z6 Y' Y2 g: {0 y9 Wfixup protocol sqlnet 1521
, i9 B' G. a4 Y$ N& ~' y2 ?fixup protocol tftp 69
; B: z6 e0 b: @8 ^1 R! Ynames
3 A: g1 F+ G4 u9 Z' ?access-list 101 permit icmp any any
4 R% _; H" f# d) _- `access-list 101 permit tcp any any eq 3389
3 J& ]; q% X" P0 X* d7 A3 {1 Baccess-list 101 permit ip any any 8 P+ U6 y/ ~2 `! D3 p; n
access-list 100 permit icmp any any ' c# C! P; J% s& ~: A/ ?. i
access-list 100 permit tcp any any eq 3389 * O5 f4 e4 L6 O s7 M2 A
access-list 110 permit ip 192.168.2.0 255.255.255.0 192.192.192.0 255.255.255.0 1 G9 H1 D( V4 ?2 R. T8 h! Q: @3 ^; U
access-list 110 permit ip 192.168.2.0 255.255.255.0 172.16.16.0 255.255.255.0 $ T1 Z. r5 A! W$ B
access-list 111 permit ip 192.192.192.0 255.255.255.0 192.168.2.0 255.255.255.0 ) X# J' @# F# r8 }" l
access-list 111 permit ip 192.192.192.0 255.255.255.0 172.16.16.0 255.255.255.0 0 i" ^% s4 W2 \: H6 k
pager lines 24
% }( }1 G! m4 {: p" j4 klogging on
' G2 r5 U! o" Elogging monitor notifications- w+ Y- l7 X6 s* \" o
logging buffered errors3 ?$ \) I7 _2 w. r7 A3 J
logging history informational0 O4 k& O5 q/ M3 H0 y( k* Q& i' N+ z
mtu outside 1500$ h$ K! Y& o+ X" m
mtu inside 1500
: y+ ~ H: V5 ?# b9 C# z' smtu dmz 1500
" B5 _# h! j4 _, Xip address outside 10.166.17.24 255.255.255.224
; r9 ?/ |4 p6 ]ip address inside 192.192.192.1 255.255.255.0* L% S# t; j' J/ \0 `7 Y: ]4 q
ip address dmz 192.168.2.254 255.255.255.06 Q5 O! x: v# l4 H0 }( e5 t+ N
ip audit info action alarm3 V2 p' [" f8 X. g
ip audit attack action alarm
- z' U+ q0 r3 E8 bip local pool vpn 172.16.16.1-172.16.16.254
?; `# v0 E9 ?$ X$ Nno failover: v5 U' ]4 p. d# Y
failover timeout 0:00:00
( |3 H) r( s% x+ Xfailover poll 15
7 i: c) k! ?* }2 ~+ r' O$ F3 x" H8 Ano failover ip address outside
' Y$ A" k. i9 M# Zno failover ip address inside
R* I- g! V8 \no failover ip address dmz
W, z0 } _0 e+ R5 b6 dpdm history enable
5 m* k: t0 B0 X( }; F' Barp timeout 14400- r9 w+ F! P) J& N' J
global (outside) 1 interface5 ]( L9 O4 G; S6 T
nat (inside) 0 access-list 111/ K8 o! l( F1 F. U
nat (inside) 1 192.192.192.0 255.255.255.0 0 0
2 F1 J1 S/ R0 S- M' w9 }8 bnat (dmz) 0 access-list 1101 L3 G- d4 s( j- V$ d) Q
nat (dmz) 1 192.168.2.0 255.255.255.0 0 0
; }! r6 a/ X! L- Vstatic (inside,dmz) 192.192.192.2 192.192.192.2 netmask 255.255.255.255 0 0
7 S1 w4 ~6 N2 o' M) waccess-group 100 in interface outside& e0 f; X7 j4 E
access-group 101 in interface dmz
: s$ v( G ^, T4 d; a. ]6 nroute outside 0.0.0.0 0.0.0.0 10.166.17.30 1
/ c4 O/ o0 P( Z5 s/ B+ Atimeout xlate 3:00:00
/ i& H# \4 z$ X- Q7 stimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:001 `2 m7 t8 L1 U( u9 r n/ `" G
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00" @( p# s" z* R+ ~- c
timeout sip-disconnect 0:02:00 sip-invite 0:03:002 I; m u( w9 A5 d2 p. v. |
timeout uauth 0:05:00 absolute: S7 A9 b' Y- z) {0 z8 I
aaa-server TACACS+ protocol tacacs+ 2 @/ ?+ G3 L- |5 i
aaa-server TACACS+ max-failed-attempts 3 3 Q( g2 S, H% X3 U
aaa-server TACACS+ deadtime 10 # m+ j3 H) ~5 \& t
aaa-server RADIUS protocol radius . l1 D3 U; F" _9 C2 C# v3 g
aaa-server RADIUS max-failed-attempts 3
4 `3 a' ^ t2 g3 j1 k1 {* a3 e! Laaa-server RADIUS deadtime 10 . z6 `/ o2 g2 ]% c- Y
aaa-server LOCAL protocol local
+ b* @+ |1 x* l3 c W/ Qno snmp-server location
9 G& ~% w& U+ i, N, P$ p0 `/ x) p! ^* gno snmp-server contact
- ^9 s) _. _* bsnmp-server community public2 \2 X3 f1 N9 @" m- |+ J r
no snmp-server enable traps; d! q; y$ E E7 W0 q
floodguard enable& A/ G7 d, O, Q0 g+ M% G
sysopt connection permit-pptp
; S7 x: v3 q7 ksysopt noproxyarp outside0 M9 Q* A2 |0 r( ^# L% }3 [: K
sysopt noproxyarp inside8 J$ b- T. i7 z# f0 H
telnet 192.192.192.0 255.255.255.0 inside% ?8 A3 n$ F2 L5 O
telnet timeout 5# y# v- {- |9 a1 d1 x' [1 N
ssh timeout 5: C, r. ^* P; l
console timeout 0
( K$ ~8 z! b( A: Hvpdn group xxzx accept dialin pptp/ @6 c% e4 o) x0 X! Q- D* l2 }1 T6 ]
vpdn group xxzx ppp authentication chap
3 L, ^ X8 @6 o0 l ^vpdn group xxzx ppp authentication mschap
6 ~) P! N/ d: E8 V' A0 l, \5 i2 fvpdn group xxzx client configuration address local vpn( w$ C! T0 I4 J% y
vpdn group xxzx pptp echo 60
" B6 i3 E9 j) i8 ]2 {vpdn group xxzx client authentication local
6 E: s0 W6 ~, [4 A; p; dvpdn username hrbbxxzx password *********
( w3 k% t, { h& b3 ^" Rvpdn enable outside
, h0 ]: t, R1 B2 sterminal width 80
! }: h% O9 G- ?7 K1 aCryptochecksum:ca107db971e827731294bffc5e00dc392 T/ o$ w, s* p1 o
: end% C" L2 u j! _0 B
pix520# |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
