pixfirewall#show run3 x2 s0 R% x$ E0 U) J
: Saved
7 }+ u! x" ?1 V* x:$ ]& n9 W7 K) U
PIX Version 6.3(3)
: @; T, h( i6 Finterface ethernet0 100full
* I$ p& j# J8 ]# L! Ointerface ethernet1 100full" m2 w0 M' `/ O5 Y' e' ?
nameif ethernet0 outside security0
) g$ {1 N( N, fnameif ethernet1 inside security100
) S4 V) l9 _3 p' penable password 8Ry2YjIyt7RRXU24 encrypted
# I0 s* |7 P* ?0 j9 d5 ?' ]; `0 ypasswd 2KFQnbNIdI.2KYOU encrypted
& I% c u) B" y2 W' m1 k( K# Z% n% D5 Ehostname pixfirewall
6 {0 b# c7 m# p: E9 Gfixup protocol dns maximum-length 512
( m: R& a0 m2 o/ d3 d# L8 E4 S' {& R& zfixup protocol ftp 218 D8 m+ V4 ^% ~4 t3 V$ q6 z, f
fixup protocol h323 h225 1720! [8 S6 b" M7 W2 P4 s
fixup protocol h323 ras 1718-1719
~3 c* {& \* Xfixup protocol http 80
% y0 K, _: f* o% Y8 Z! z3 U0 Dfixup protocol rsh 514% b- v/ o9 W0 z, E2 |
fixup protocol rtsp 554
% T) F$ X( o$ e2 l0 |fixup protocol sip 5060, w9 G7 s3 b: `9 a( S5 D0 a5 {+ v
fixup protocol sip udp 5060
# ^* W B9 i8 ]) Ifixup protocol skinny 2000 ]& t8 ~+ X7 g! D8 l' c1 J( m$ o' j
fixup protocol smtp 25% W- ?) X; z" p+ n4 W: G- Y+ o3 W+ ?' H
fixup protocol sqlnet 1521
% c) S( F* i3 I. Afixup protocol tftp 69
S- Q: r% K# j( |) [6 Hnames
5 K) y6 S7 N1 q" o( }& ?
7 y2 t4 p5 R( Z+ T4 |!--- Do not use Network Address Translation (NAT) for inside-to-pool
) u: T, D% C7 m, E" Z!--- traffic. This should not go through NAT.
5 F1 J+ i- ^! T9 D6 w2 Y6 w' x9 B. c8 l; k
access-list 101 permit ip 10.89.129.128 255.255.255.240 10.89.129.192 255.255.255.240
, }1 C2 e/ N3 o; ?3 E" F6 S$ s& e8 }
!--- Permits Internet Control Message Protocol (ICMP)
( V4 X$ t8 a: g: @!--- Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)
' F! j9 k4 ^8 l& C7 y!--- traffic from any host on the Internet (non-VPN) to the web server.5 V) D' T* ^& Z$ t4 e4 P/ N: `
3 e# u( v& w7 }( a; `" n# \
access-list 120 permit icmp any host 10.89.129.1314 ~9 z9 W$ r0 o
access-list 120 permit tcp any host 10.89.129.131( c& R. x& k h! A
access-list 120 permit udp any host 10.89.129.131+ `* |: R" f5 C8 }
, T* V9 Q3 P% [- g" g, Wpager lines 24
* f# b1 j+ x# Fmtu outside 15006 e0 i# a5 h5 b4 k
mtu inside 15002 Y+ D j1 O- z! @% N& i
ip address outside 192.168.1.1 255.255.255.0
+ Y4 H2 \$ s# d( H Mip address inside 10.89.129.194 255.255.255.240% L& x- K( s( e
ip audit info action alarm( l5 s; D7 S. Z9 T" G5 l) P
ip audit attack action alarm
3 t( z! H6 g2 Y n2 R& @4 @; X9 Z
* p& q1 Q1 C5 T; y/ f!--- Specifies the inside IP address range to be assigned
, e3 V$ r8 d+ ?" N; j. v/ B5 e!--- to the VPN Clients.! M; v }8 E5 B
: Q( E( E0 B3 v; r+ c" j7 _
ip local pool VPNpool 10.89.129.200-10.89.129.204& R7 `0 j+ p; H. a# [. J5 @$ r* {. T
no failover
( e& X2 I1 r# Qfailover timeout 0:00:004 W5 g r2 u2 _9 o/ ?, _$ u
failover poll 15
; t1 S J" k. T; x9 x( ]no failover ip address outside) R& M# e% d; W7 Y- d* c; M& V
no failover ip address inside* [4 Z) K" e$ y
pdm history enable/ K3 _ ~. f, |: T
arp timeout 14400
! h6 k1 S% G H4 W! F! U' U2 ?% ?1 E1 i( E8 K" T" X
!--- Defines a pool of global addresses to be used by NAT.. v# w% F& @$ L' z9 b
; F2 l! H! m% q$ G
global (outside) 1 192.168.1.6-192.168.1.10$ _6 c+ o I U) J8 Q- t& ?+ b( u6 C
# C0 p6 z$ a. r; _+ Z/ gnat (inside) 0 access-list 101
5 ^3 ]" |0 x; L( K: [- ~( L1 P& e% B6 Xnat (inside) 1 0.0.0.0 0.0.0.0 0 0
- K! A. U, c3 [& G% L# {/ G8 R z, c1 J, c8 {# Z; J3 Q# K& v& G
!--- Specifies which outside IP address to apply to the web server.3 g! R8 V4 p2 u. }
5 q' U& C; y1 r
static (inside,outside) 192.168.1.11 10.89.129.131 netmask 255.255.255.255 0 0. `6 W: J0 G' v4 @
0 n- b4 e. v% U) `% j5 v
!--- Apply ACL 120 to the outside interface in the inbound direction.
# a. B# f: P+ O, E7 B
6 J2 P h+ B1 t" a7 V& h. J2 yaccess-group 120 in interface outside: E# l% p8 b$ I% n) \3 O: p
. r; p" m2 ]2 `; e!--- Defines a default route for the PIX.
0 W' u9 }# A6 O1 Y: M8 @$ @# n$ M& l3 T ~4 S- D( {- E
route outside 0.0.0.0 0.0.0.0 192.168.1.3 1
# J/ Q/ ]( G' r/ d" W
* r5 L9 d2 C5 t8 Z!--- Defines a route for traffic within the PIX's
- s' P& W; P W6 z4 t4 t( @! m8 R) _!--- subnet to reach other inside hosts.6 `6 K. k) y- n9 S
: \! c8 M# r7 j+ t- Mroute inside 10.89.129.128 255.255.255.128 10.89.129.193 1% s) V, ~2 ]8 _- H/ t9 @0 [
2 ]4 f+ y3 P, i4 {
timeout xlate 3:00:00/ h. L% ?6 b# f3 g! B
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:005 A6 u% g) t; ?1 U1 v, R* @6 p# ~
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
% z9 u- A& v9 f8 M& i2 Vtimeout uauth 0:05:00 absolute
* H9 ?( N7 ^, }aaa-server TACACS+ protocol tacacs+
" I! C) R' L' [* M: Q4 n* kaaa-server RADIUS protocol radius2 a+ l5 c- t" Z0 D2 `& h/ j- f
aaa-server LOCAL protocol local7 L* a- H7 `$ {( m$ V- L) J. P
# s3 _9 A. i! x8 j0 H9 Y" t
!--- Authentication, authorization, and accounting (AAA), x3 @, [, B% M& Z9 x2 V
!--- statements for authentication. Method AuthInbound uses TACACS+.
9 w9 R# p' j3 s! E4 I1 n8 z
# \: k m/ f" v* Z3 z! Z9 waaa-server AuthInbound protocol tacacs+
) |: A( V" [( ~1 K$ c3 R; q) p3 M2 L) p' G2 T
!--- Specify the TACACS+ server and key.
( ?& u2 Z3 W3 G0 Y0 ?. [
F( }* m. y) j4 s6 q7 g/ Caaa-server AuthInbound (inside) host 10.89.129.134 <deleted> timeout 10, g& ^/ S) h+ `+ Q& O/ ~
" @2 F+ m+ c) y2 f0 H!--- Authenticate HTTP, FTP, and Telnet traffic to the web server. _ w0 u E3 B
/ a0 |4 |* ^4 H8 @( qaaa authentication include http outside
5 b4 Y; K5 J8 \+ M+ G+ _10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound
1 s/ X6 U! k( ^% w( q' V0 @' x% r1 i# k
aaa authentication include ftp outside
4 y: b; h/ I: I9 G- ^ 10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound
& L9 B6 p+ M |' j
- {1 h( }: m9 a/ h8 _aaa authentication include telnet outside
- z* ] u" B- R- M10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound! {: Y* x% Y" g1 ?; b$ [$ a
0 s- V8 Q# a4 `( ]$ lno snmp-server location4 h" e& Z+ S( ^' ~. o# H1 \
no snmp-server contact, q. T. M. G/ J" ~
snmp-server community public+ t$ a' V4 ^( i
no snmp-server enable traps6 f+ _# W9 P$ t
floodguard enable/ n( V% O* \! q2 f2 D
) Y P2 ?, N- v9 `# t!--- Trust IPSec traffic and avoid going through ACLs/NAT.9 `; `- u$ w+ m% K3 p6 @! K# ~+ y
/ J) j; ]+ E+ y; }6 Isysopt connection permit-ipsec1 H# a P) f, X d5 g* C7 E b
+ P) u# q3 g: _
!--- IPSec and dynamic map configuration.
) q3 q; m1 O2 ~* D, a# o; A1 X
$ B. K+ Z( ]0 E; }crypto ipsec transform-set myset esp-des esp-md5-hmac
( n1 q, L, X) w4 ?2 c$ l0 @$ Ecrypto dynamic-map dynmap 10 set transform-set myset
. Y0 S0 y4 X& Q* R* e8 }crypto map mymap 10 ipsec-isakmp dynamic dynmap6 S1 X+ [% a1 U* O, z0 x
+ C" I+ w+ S+ k$ F* z0 X! D2 v!--- Assign IP address for VPN 1.1 Clients.
: D: _" s1 w" Q% G
! K4 m0 W2 O7 |crypto map mymap client configuration address initiate
! v- f) Z6 A. w0 k! Zcrypto map mymap client configuration address respond! N8 x6 D/ I: x% s5 _7 n4 k' u. m
N0 Z, a8 Y2 J!--- Use the AAA server for authentication (AuthInbound).5 Y6 _% J8 r9 a
. ]4 |/ w+ X* Bcrypto map mymap client authentication AuthInbound/ \+ @2 S2 }0 a* a2 {# X
0 _6 w) D& J4 j2 L
!--- Apply the IPSec/AAA/ISAKMP configuration to the outside interface.5 d2 Q/ ~- S, ^# [/ G1 K% E
+ d+ Y8 d) Z( \' r+ M1 f t! l
crypto map mymap interface outside g) {# c) A& R) U6 u& H
isakmp enable outside
$ S/ O( V. R* C% z0 @, _( ^4 N* w( S6 E3 y' N1 ~, Q2 y7 v/ c ^$ b6 ~ ]
!--- Pre-shared key for VPN 1.1 Clients.
& [5 G3 q: G# u) C% l; a. r9 X, f! B0 Q; c, x
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
0 | g# X6 G/ L6 R! P1 G1 q( wisakmp identity address2 @% y4 S- a0 n2 B; T
- z* @& |* ]8 |
!--- Assign address from "VPNpool" pool for VPN 1.1 Clients.
/ A6 Q- K" ]& f0 }0 E* d9 z* ?; E( k7 V q/ q5 X
isakmp client configuration address-pool local VPNpool outside# n+ [; w0 R, Y9 u/ M$ L l
' J. n1 ~( `( \' r!--- ISAKMP configuration for VPN Client 3.x/4.x./ v; Y! h. r$ ~4 Q+ M" L! W
/ {$ c% j7 A/ @' r2 |
isakmp policy 10 authentication pre-share
2 \' Z$ b V% c) Wisakmp policy 10 encryption des$ ~+ F: `: m! |/ O" O0 t
isakmp policy 10 hash md5
# n4 w: n, H* t: W6 E- g' Misakmp policy 10 group 26 Y/ ~ C0 o, E- V# j$ Y( E" D4 @8 _/ g# w
isakmp policy 10 lifetime 86400
( w e2 q2 U" K) U/ F; T
_" G* \; M* a( O!--- ISAKMP configuration for VPN Client 1.x.: o7 _1 _, m/ ~- ]: P
2 M! U$ B( e0 ?' ?" M8 kisakmp policy 20 authentication pre-share
7 f. Q' Q6 F3 { H bisakmp policy 20 encryption des) J% f, P3 Y2 x+ }3 g% I0 D
isakmp policy 20 hash md5$ l3 {) P( F( s& G$ l4 G- Q
isakmp policy 20 group 1
3 B& o$ X! y. M( E! visakmp policy 20 lifetime 864003 i3 u' _% u6 p- }, o% Y9 V% [
& c; d) Z6 M" j& U!--- Assign addresses from "VPNpool" for VPN Client 3.x/4.x.
" x/ Q& E& D8 u/ t) Y5 q8 N
8 X/ p( y2 J8 b9 x' svpngroup vpn3000 address-pool VPNpool& d8 [' v3 k5 O" O
- e3 i) l; e6 t% H
vpngroup vpn3000 idle-time 1800
. c. ?' X5 r6 V5 @ L% M5 z" J6 R9 M1 G# b
6 e0 b( J, U3 e8 [5 Q* v
!--- Group password for VPN Client 3.x/4.x (not shown in configuration).
6 h/ y3 A4 z1 r- F9 i6 Q( f8 I5 ?; F( \: `. ]( K
vpngroup vpn3000 password ********
3 |- z a' }9 @+ ^$ Ftelnet timeout 5$ [, s- {7 e: d# Q3 h z
ssh timeout 5
! Q. v) I, `5 v1 s$ n8 rconsole timeout 06 }% X0 O6 w% y8 f" c2 _
terminal width 80/ ~& ~4 K+ |$ ~2 u; i: V) I
Cryptochecksum:ba54c063d94989cbd79076955dbfeefc
4 C/ w: C I! \: end) G. s5 R. A$ d# m* f
pixfirewall# |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
