PIX配置好之后内网不能上网？

公网ip是112.64.141.122，网关是112.64.141.121，内网ip是192.168.2.0网段，PIX我设置ip是192.168.2.3配置如下：
; U" g" I. a& N- Y# D9 APIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
& z: C, H. ?! B! T; D# S. Wnameif ethernet0 outside security0
) ?" O$ F% M# G. O: j8 d- Ynameif ethernet1 inside security100
/ m* U& m" w/ V: A* penable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
- J  @' r6 |, o3 ahostname pixfirewall
* s8 q7 l' a8 U( P  D4 Pfixup protocol dns maximum-length 512
+ H& Y6 Z& b( \  Afixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
4 I# Y7 Z% c1 |9 R$ ifixup protocol rtsp 554
) n  c! V% m3 Q4 Ifixup protocol sip 5060
# P0 k1 k5 y4 U' ?- D! {+ ]5 ufixup protocol sip udp 5060
fixup protocol skinny 2000
! ?4 q. R' H2 V, a, Kfixup protocol smtp 25
fixup protocol sqlnet 1521
" w' u) a5 m3 T( N; o0 Afixup protocol tftp 69
- H4 A. [+ w5 B; unames
6 J8 D! @: U7 g4 E# E5 |( daccess-list 80 permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
* f2 T. ~5 @, p& R5 Gaccess-list 101 permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list 101 permit icmp 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
% A" z: k' I$ b) J* ^/ Kaccess-list 102 permit icmp any any
+ X8 c+ D/ X5 I/ }1 Taccess-list 103 permit ip any 112.64.141.0 255.255.255.0
pager lines 24
" v# B  B2 R9 G0 t# @& o0 d% {mtu outside 1500
8 D; a- V. S; Z4 P# ~/ |- dmtu inside 1500
ip address outside 112.64.141.122 255.255.255.0
ip address inside 192.168.2.3 255.255.255.0
ip audit info action alarm
# D% w* {. e% t+ I8 dip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
3 {" @8 q3 z4 l  o. ~6 ^, |access-group 80 in interface outside
conduit permit tcp host 192.168.2.6 eq www any
conduit permit udp host 192.168.2.6 eq domain any
route outside 0.0.0.0 0.0.0.0 112.64.141.121 1
0 W3 M0 w" O/ z- ]: U; f$ }1 Jtimeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
. R: z4 N9 j# n4 K/ Z( qtimeout uauth 0:05:00 absolute
8 N# a& W7 E! [2 C0 A$ U" M4 C' eaaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
1 V2 C8 a4 U6 Naaa-server LOCAL protocol local
no snmp-server location
. ]3 T9 J8 e& t8 H% y: \9 u8 Sno snmp-server contact
snmp-server community public
1 S3 O0 E8 }) y6 I& V6 gno snmp-server enable traps
floodguard enable
telnet timeout 5
. S1 u! ], f" T  Q7 \, M7 tssh timeout 5
% m% ^% _, B( ]& x9 g# G, econsole timeout 0
; M% b; V4 c) A" z, l: fterminal width 80
Cryptochecksum:ee1c51874b492520381d3ff1d5185008
6 q/ h9 E! S2 r, l: end

pix上ping 网关是否通?
如果是客户端不能上网,dns对吗?

PIX ping网关通的。DNSserver有的。不过不知道要在pix里面配置

access-list 80 permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
你这个控制列表是什么目的，而且你把它绑到外口进方向，其他的流量你不都挡住了？

谢谢，我去试试

下面这样还是不行。
' `& I1 B, P: y: APIX Version 6.3(3)
! t: j9 [5 P4 z2 L2 ~2 J) ginterface ethernet0 auto
interface ethernet1 auto
9 J) l6 r% |$ w3 ]interface ethernet2 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security4
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
0 j$ Y) K/ C8 Uhostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
- Z$ P: w2 a7 W1 H3 Ifixup protocol h323 h225 1720
  n0 I. ?2 I, M8 H6 ~1 C: O" ]4 vfixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
1 d- Q) e$ a; n7 m5 q* Ifixup protocol sip 5060
0 V- F# @  O( V6 I- vfixup protocol sip udp 5060
& d5 e$ D4 K: Bfixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
. H: `" |+ r. {; E, Zaccess-list 80 permit ip any any
3 P  ~0 j8 p6 maccess-list 101 permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
! p9 k4 {" I9 Z4 {$ saccess-list 101 permit icmp 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
8 h7 [; ?/ l  |" [. vaccess-list 102 permit icmp any any
access-list 103 permit ip any 112.64.141.0 255.255.255.0
# R( }( W, q6 J" Qpager lines 24
5 @' L3 a; M: J. S" H4 [, hmtu outside 1500
mtu inside 1500
mtu intf2 1500
) }) |- y" T- J% r! l" Pip address outside 112.64.141.122 255.255.255.0
ip address inside 192.168.2.3 255.255.255.0
no ip address intf2
ip audit info action alarm
3 [" Y( ^$ d4 g. j$ mip audit attack action alarm
pdm history enable
) P( B$ Q/ c) R( m7 o2 j' I1 v+ T' \arp timeout 14400
% F+ h! l8 h% L3 R' _* N& _global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
+ q9 [! n, P+ U* b; Troute outside 0.0.0.0 0.0.0.0 112.64.141.121 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
# f: Z2 l3 o% \timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
( a  z9 V% o2 B- Z5 O( I6 Ptimeout uauth 0:05:00 absolute
: ]  C2 S7 @1 c+ n; A1 aaaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
: y+ g6 {) W" y+ G2 Raaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
8 Z* }3 b7 A4 `3 P6 ~telnet timeout 5
0 U0 [7 Y' k3 x5 h8 w$ xssh timeout 5
8 b1 [/ H/ Y/ `/ dconsole timeout 0
terminal width 80
Cryptochecksum:fc9dccbcea300e72b9fc0d1cf3c73f00
7 t- b) [: k6 z2 H$ @: end

看的出来你内网有2,3网段，这2个网段是分别连防火墙的2个口，还是通过三层交换再连防火墙？如果这样的话，你要在防火墙上加到2,3网段的回包路由。但是看你定义的控制列表应该是你2个网段分别接在防火墙2个口上，那你定义的防火墙内网口好像只有一个吧？

引用:                                                                                                                                作者: linya0318                                                                                                                                                                                                        下面这样还是不行。
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
! I! ]. c6 `* N+ i( w0 X& |nameif ethernet0 outside security0
nameif ethernet1 inside security100
) X5 F) s, T3 u6 p% T3 t* D7 Bnameif ethernet2 intf2 security4
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
/ p- ~. a+ n! m- i+ s9 Ghostname pixfirewall
( b1 F3 Y7 U$ L  Q! Ofixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
6 v0 t. R& k$ y9 Z6 A2 W' Y' @fixup protocol h323 ras 1718-1719
2 v' ?3 }, _# o) k* O3 v! V3 ?fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
6 F0 y' u4 K* _' t3 z& \( Vfixup protocol sip 5060
- h4 h; c5 O% g. _6 x, ]fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
' N/ E1 k3 G2 O+ F+ w6 nfixup protocol tftp 69
% X0 h- p2 {; w; o( u2 Snames
access-list 80 permit ip any any
8 d1 s  d6 \1 R/ s, |* K% C* s( maccess-list 101 permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list 101 permit icmp 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
) V: Y) T9 g, M8 A5 S5 Paccess-list 102 permit icmp any any
& N, A7 c' j& _, zaccess-list 103 permit ip any 112.64.141.0 255.255.255.0
pager lines 24
mtu outside 1500
7 e# h% K0 Q$ m2 K7 mmtu inside 1500
mtu intf2 1500
ip address outside 112.64.141.122 255.255.255.0
ip address inside 192.168.2.3 255.255.255.0
% W* k! ~% v. v! Uno ip address intf2
ip audit info action alarm
ip audit attack action alarm
5 {! \9 M; {9 X; Y2 s; ~' Zpdm history enable
" k8 S1 p  B7 Z( e' P; Marp timeout 14400
9 ?7 @6 S' e/ g3 {$ a- L& L1 Xglobal (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
* r/ X  I; i+ B2 C+ B5 k0 P) R# y8 zroute outside 0.0.0.0 0.0.0.0 112.64.141.121 1
# s* F- M4 k! M9 y9 {$ C, Atimeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
8 n; j# H% Y6 R8 |/ F. Qaaa-server RADIUS protocol radius
$ v$ c% u3 a7 u" U& G" ]aaa-server LOCAL protocol local
no snmp-server location
. {9 k& S5 d# `/ }! Z+ a) wno snmp-server contact
: v5 P9 G1 w' x) Tsnmp-server community public
no snmp-server enable traps
floodguard enable
9 Y% e4 K; w& j7 wtelnet timeout 5
ssh timeout 5
console timeout 0
/ z" N7 {1 Z  Z* Aterminal width 80
( N4 O8 K* A; X8 y8 ?4 m" ~Cryptochecksum:fc9dccbcea300e72b9fc0d1cf3c73f00
: end                                                                                                               
) W0 A9 `) U3 o, T& C- [
; a6 v/ l' Z. ^! S) A
没看到  access-group

一个来自湖南的四人诈骗团伙，先从网上搜索县级党政干部的资料、照片，之后再利用电脑合成“艳照”，2010年7月下旬至8月上旬，四人分别来到安徽、江西、山西、河北、重庆五省市2011年安全工程师考试答案，将这些“领导艳照”与敲诈信件一同寄给敲诈对象。
4 l, y' _) n; S  I
2 N/ r. P# x$ G短短一个月的时间，四人“收获颇丰”，有五人共给他们汇去了33万元。但是让他们没想到的是，另外注册会计师答案43封敲诈信寄出后，当事人很快向当地公安机关报案。去年8月9日，犯罪嫌疑人胡某被黄山市屯溪区警方在杭州抓获。日前一级建造师答案，此案经过两级法院审理，胡某、张某被判处有期徒刑七年、有期徒刑六年零五个月。另两人另案处理。

这是什么东东啊