pixfirewall#show run& }& U* n- @: D! w4 Q. N; }3 Y! d
: Saved! |& y' V" I8 r# W# U3 l1 ^
:
/ [3 d0 J' N" X! t+ zPIX Version 6.3(3). D2 H- Z* d, z
interface ethernet0 100full
, b( X T4 t M6 L9 Sinterface ethernet1 100full
! O6 F& O: t/ o. D% T( L! ]- Gnameif ethernet0 outside security0
0 i& ?; n9 ^* Rnameif ethernet1 inside security100) z8 ~. o' G: t# _) W
enable password 8Ry2YjIyt7RRXU24 encrypted; ]& W$ C# t- t( [
passwd 2KFQnbNIdI.2KYOU encrypted% M0 k- a8 ~- y2 z# K; P2 p* k
hostname pixfirewall
' r% M p! Y4 g1 U. ?, Gfixup protocol dns maximum-length 5122 _( r' _4 Z4 ~( \
fixup protocol ftp 217 y: U& x- W; ]$ j
fixup protocol h323 h225 1720
7 v1 s2 a2 R H; u# |' i k- y6 Ifixup protocol h323 ras 1718-1719
* ?# y/ n# R# jfixup protocol http 80
- |8 r& w& x4 B G) e, n6 ]. Ifixup protocol rsh 514 g( W. V+ R7 n7 o$ G
fixup protocol rtsp 5541 f$ c2 O6 c" q( I" X
fixup protocol sip 5060+ u0 ^1 y( p1 ]" a/ _
fixup protocol sip udp 5060 Z! K" \( Y" q% ]! z
fixup protocol skinny 2000
5 Z, \0 ?3 K2 R5 M5 h! o2 {. \fixup protocol smtp 25, s4 |, b; x3 |) I
fixup protocol sqlnet 1521) k8 F+ K- f4 ?( ?
fixup protocol tftp 69
7 v8 S5 K. ^8 B0 t3 W/ d$ Unames
" E- q9 i# K0 \ z9 S& I9 i- V6 a) G) _4 `! R& E" D
!--- Do not use Network Address Translation (NAT) for inside-to-pool
+ B2 E7 G0 m* ~4 n8 R!--- traffic. This should not go through NAT.
( D1 |, N+ O# q# _& |# i
+ L, \! `: u8 Y1 }access-list 101 permit ip 10.89.129.128 255.255.255.240 10.89.129.192 255.255.255.240
4 r n2 q# ?4 y
% G* c7 y4 y7 K* p$ z3 K; H# X!--- Permits Internet Control Message Protocol (ICMP)5 k$ O3 w& f: ?! g. k3 ~$ A
!--- Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)
+ p0 Q) F6 x, n2 w, `( l! E/ ]# C- B!--- traffic from any host on the Internet (non-VPN) to the web server.- D" H- t: v$ F; c. E- d0 l
o6 k: [) n! K. h: W9 ^ ]; J5 L
access-list 120 permit icmp any host 10.89.129.131
6 i; i, j. _; X9 Z! B' `* s/ Daccess-list 120 permit tcp any host 10.89.129.131" l1 }3 o4 s/ S2 D) @1 n
access-list 120 permit udp any host 10.89.129.131) h' m- g0 E$ @/ F
1 Q" N! l% z$ X
pager lines 24
& s3 }" m9 e# a- T s' l, smtu outside 15000 z) E& {3 k5 L! x e3 }: [/ b
mtu inside 1500! ^2 n' s* I$ n6 p
ip address outside 192.168.1.1 255.255.255.0% B @# F6 ^0 v. M" Q/ c+ U
ip address inside 10.89.129.194 255.255.255.240( p9 X' O! D& n- w
ip audit info action alarm- u+ ^* E* W ~1 n+ d% Z
ip audit attack action alarm
8 \0 S; i; z5 s# B! j1 W) J) q. o% u: t1 d, Q
!--- Specifies the inside IP address range to be assigned
: Z g, R2 ?2 U3 H; D!--- to the VPN Clients.+ o0 t$ a5 T7 B8 m6 ^
( n) ~, ] {; d* S- dip local pool VPNpool 10.89.129.200-10.89.129.204 j. o6 I( Y# J$ N z8 ?7 K) k4 h
no failover1 h+ Z! O. e! }+ t- f& W
failover timeout 0:00:00 M/ g& v" U- Q `
failover poll 15& }) L9 i8 W; n) W% N
no failover ip address outside
$ O! l- e( Y9 l7 E5 {no failover ip address inside3 c2 o% _8 e- L6 T; q1 S$ f
pdm history enable* G) o% E$ O3 i* K& ?' @
arp timeout 144006 W4 F$ _# H" m' C
1 ]* O j. S) n, E" M* C
!--- Defines a pool of global addresses to be used by NAT.
; L$ N8 p/ P) O* w
3 r3 @# O! p8 l" P2 mglobal (outside) 1 192.168.1.6-192.168.1.10
2 _6 e8 d6 V5 k, V6 U1 @
- t: Q2 L* o2 Pnat (inside) 0 access-list 101
( [9 P) ?- c/ R/ e* vnat (inside) 1 0.0.0.0 0.0.0.0 0 0
# W' J4 D/ r# p% ~- f' E" q2 C; M; n+ p$ d' b" S; \
!--- Specifies which outside IP address to apply to the web server.0 Y3 z+ L( k' |, N+ d$ l6 n
' s# o/ L7 v% P9 ]' s; I6 [& M( Xstatic (inside,outside) 192.168.1.11 10.89.129.131 netmask 255.255.255.255 0 0
4 s/ r- H# k4 _1 \2 I9 r" F. Y5 \7 O
R4 C3 c" b8 _' A!--- Apply ACL 120 to the outside interface in the inbound direction.
1 X6 J1 \% C! k- m5 T5 K! I4 h# z3 L
/ u% h1 |# M# v( Y$ taccess-group 120 in interface outside7 |' U" d) q' x* M* B6 L! N
# W+ k% V% T' o& o Q: e) A
!--- Defines a default route for the PIX.
, z) M5 F6 M+ X% ?) X- n& P1 l- b
6 u+ U; E# U3 u$ Q4 S0 y4 M0 eroute outside 0.0.0.0 0.0.0.0 192.168.1.3 1; E; ^& p0 C$ L, M# v. M/ ]: p
. S: R6 ? T2 A+ e5 d+ Z
!--- Defines a route for traffic within the PIX's% i: D; [4 h# E1 w/ c0 m) B% X( }
!--- subnet to reach other inside hosts.: a$ \, u/ D- n
_2 ?# k. Q+ f- d. b* Y' \$ H! proute inside 10.89.129.128 255.255.255.128 10.89.129.193 1
* z6 {' W5 `/ ? o& P+ n! V' M4 Y2 x; y) ^9 {2 S3 S8 b! m+ W
timeout xlate 3:00:00
& r$ r& v9 v" z, etimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
. T) l2 t, k ^- J3 O6 V" F. L2 l+ \timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00+ f) k- d4 H' _* @6 C+ t
timeout uauth 0:05:00 absolute
3 _6 `1 w4 i6 D; v" b' D* vaaa-server TACACS+ protocol tacacs+
- n2 Z% w4 J% M: faaa-server RADIUS protocol radius6 D# S% j2 `! ]0 m+ I) r/ A. \; ^
aaa-server LOCAL protocol local
/ U. v8 U% p" N5 u& u
6 j/ N3 C& [6 A) R& T!--- Authentication, authorization, and accounting (AAA)
4 G1 A! Q0 ]: Q m; } W4 h!--- statements for authentication. Method AuthInbound uses TACACS+.9 } }: |. A( J. {9 _, [: S
& n, Q' D( z; V# }
aaa-server AuthInbound protocol tacacs+
# c+ G- A5 O. A, x: M' Q1 ~$ {# a' Z3 W2 Y p& V: n K( f
!--- Specify the TACACS+ server and key.( k$ U9 J& W" r% j5 f/ t
( O4 [) y$ u7 N8 F8 i$ d" i5 eaaa-server AuthInbound (inside) host 10.89.129.134 <deleted> timeout 10/ S9 \3 ~$ }9 a% C }& U; v. |
) k" W1 L/ M4 g! Z( L' `
!--- Authenticate HTTP, FTP, and Telnet traffic to the web server.2 r& z9 a) |) ~
2 h, g% U6 F$ q5 @, e) Baaa authentication include http outside
8 j: r$ ~& {8 N$ [: i: e7 \) h10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound
7 }$ l% {, G' ^' i5 C3 t3 B2 C2 d3 e
aaa authentication include ftp outside
+ K# y. M4 B9 ]7 X) c% P1 W# W 10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound& S5 K- g, o( t! m6 M
' [9 T9 Q o7 {0 z% g% J. n
aaa authentication include telnet outside ! ~' a) x0 W: w- M& L
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound' }6 b$ p: a0 l; J' E9 r
, u, z1 G' h w+ R1 t1 Nno snmp-server location$ }$ S6 j# i' D5 ^
no snmp-server contact
3 F* v+ ?. [2 m0 t6 j; m3 Osnmp-server community public
% s5 z8 ~/ ^: v& b5 Vno snmp-server enable traps
: Y) _6 Z( |/ S% W9 Ifloodguard enable" N: Y6 p% V0 k3 e6 h9 _
/ K8 W. ]+ Y0 N; P8 _& i# n1 T, f!--- Trust IPSec traffic and avoid going through ACLs/NAT.
1 I! v8 ?7 U z7 }0 }
; _ [ o1 E* } e L2 Esysopt connection permit-ipsec
3 C/ _) R0 n2 i9 q, b/ G- x+ U9 V' k8 e
3 g! D/ p1 p! s( F7 m* U4 X!--- IPSec and dynamic map configuration.
9 E' n, U" Z& e: Z7 Q" ~2 H4 E7 X& L" g. @+ P+ W1 Z
crypto ipsec transform-set myset esp-des esp-md5-hmac
! i6 e( t8 R: c# |2 { F4 wcrypto dynamic-map dynmap 10 set transform-set myset$ U8 y" ^% c( u2 F5 [! W
crypto map mymap 10 ipsec-isakmp dynamic dynmap2 k7 B- v* Z1 m/ ^
; j- Z' \0 p7 x!--- Assign IP address for VPN 1.1 Clients.2 e& c5 {, m' L: O7 o. y8 g/ J3 s
& N8 p" L8 ^" Y' e
crypto map mymap client configuration address initiate$ `5 \4 i: u8 Q
crypto map mymap client configuration address respond+ }" M5 ?8 M/ x5 ~. C$ ~
+ T, R# W% F( r6 Q- ^. e
!--- Use the AAA server for authentication (AuthInbound).
# r3 e6 V/ f" p1 V" C% k* w: Q' \/ `4 y2 [- D' s% a& T
crypto map mymap client authentication AuthInbound' z. I2 [8 ^, o( V
% F1 c/ t- E+ a5 b* v!--- Apply the IPSec/AAA/ISAKMP configuration to the outside interface.
8 W, d7 q& ^; K1 b. l% n; u
& [9 ~6 a& D& S5 b# R) \crypto map mymap interface outside
' }* g9 }7 I5 Cisakmp enable outside
, W) G* a( n4 W% M- v+ C q4 h
( k4 w" z I: L! ?' L) F. w8 Y!--- Pre-shared key for VPN 1.1 Clients.. ` `4 E* r3 D- v4 N( y
) u1 l) i; g5 I9 z g! d. |1 Oisakmp key ******** address 0.0.0.0 netmask 0.0.0.0& l& m" D2 w5 q( W! Y* l% l
isakmp identity address$ S. g2 i1 Y6 l) l: m3 ?1 o
: I3 T& k& x' n. Z!--- Assign address from "VPNpool" pool for VPN 1.1 Clients.( r2 f$ T8 J2 N; a, V
' p8 H5 C- F/ w/ Q1 Uisakmp client configuration address-pool local VPNpool outside* x" ^9 r1 e; R" }( u! i' {; v1 u
3 y8 s9 F p, X
!--- ISAKMP configuration for VPN Client 3.x/4.x.
% h) |" K0 {1 @7 l" j! u% E( j2 ~/ p( J
isakmp policy 10 authentication pre-share
# W1 N* E! v8 j: S& D6 Lisakmp policy 10 encryption des
0 ?8 ~% o8 H# w+ w: kisakmp policy 10 hash md51 ]& z% c& N, m& S3 N
isakmp policy 10 group 2- O: W& H+ ^6 w
isakmp policy 10 lifetime 86400
' e$ ?& n9 V$ r1 f* T) n
6 h" H3 W5 `# R9 Z& A2 x!--- ISAKMP configuration for VPN Client 1.x.7 q U$ V4 i9 c! ?3 p1 c( z6 v
, H- X" `& q. Y3 \) V1 x+ G
isakmp policy 20 authentication pre-share: p4 Q1 i: r2 Z: `
isakmp policy 20 encryption des, i7 \+ Y6 ~2 ` Q
isakmp policy 20 hash md5
$ l$ Q* V) R+ Gisakmp policy 20 group 1
. i, ]: W2 h) `; t* T: \. }2 aisakmp policy 20 lifetime 86400# i8 N( V1 _, q8 K# r5 S
8 }% i& D. B$ w) b!--- Assign addresses from "VPNpool" for VPN Client 3.x/4.x.8 E# j) p/ h" z6 `
. I. P% m7 {4 F* svpngroup vpn3000 address-pool VPNpool
. w7 h9 T* j! P0 E) M; i2 S
3 \, H6 ^1 u! N7 q5 d$ yvpngroup vpn3000 idle-time 1800
/ y& t8 A0 @5 n2 f% o: x) y, n% w W; l9 q6 c* H
3 P2 [4 `1 E! }" U!--- Group password for VPN Client 3.x/4.x (not shown in configuration).' Y/ E d5 ]; q/ S m( Y9 k" S
9 h& P* X" m) |# N7 [2 L. f$ s. ^7 w
vpngroup vpn3000 password ********+ m: ]* Z3 S' U% p$ t
telnet timeout 5
4 ~: T' q4 n qssh timeout 5
9 f7 S9 U9 _; w2 J4 ?$ [6 ^console timeout 0
x9 }! y5 Y/ A) Z" p& W8 a3 g4 Fterminal width 80- g6 v7 e- G& K1 c) W
Cryptochecksum:ba54c063d94989cbd79076955dbfeefc0 o: ^& G( U! q/ g' y7 K
: end
+ F8 Z* d" H( spixfirewall# |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
