【讨论】PIX基本配置,为什么联众登陆不上?大家遇到过吗?

如题!
$ ]( d9 E! k) ^# K3 JPIX只是基本配置,联众登陆不上,很奇怪,没有限制什么啊.

好像是fixup的问题，查查联众的端口是多少，再看看配置中的fixup

有可能,试试了。

no fixup protocol skinny 2000

联众登不上啊？那怎么炸40啊？把配置发上来我帮你看看！

......

引用:                                                                                                                                作者: karenzkk                                                                                                                                                                                                        no fixup protocol skinny 2000                                                                                                                就是这个。

PIX Version 6.3(5)
interface ethernet0 auto
) m( ^( J/ Y- h, L, Linterface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 0e53SZdxezxawxDG encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
  A( R5 j- B# `7 J+ }; Fhostname pixfirewall
domain-name ciscopix.com
% p' Z; H# K* p0 H* wfixup protocol dns maximum-length 512
# c  j8 \9 r. Y$ r5 C; H0 }fixup protocol ftp 21
fixup protocol h323 h225 1720
4 a8 q0 f# t& tfixup protocol h323 ras 1718-1719
2 ?4 o( v2 Z+ x" F- Cfixup protocol http 80
fixup protocol rsh 514
% r& _- |% O6 \0 L; Ufixup protocol rtsp 554
fixup protocol sip 5060
- R1 I8 P! `9 }9 f6 m; @$ K, Sfixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
* X0 C9 r% m" q7 l* Yfixup protocol tftp 69
names
access-list 102 permit tcp any host 222.191.123.6 eq www
, t; I- M. E) R% Z$ j$ oaccess-list 102 permit tcp any host 222.191.123.6 eq smtp
access-list 102 permit tcp any host 222.191.123.6 eq pop3
2 C$ ?" h# C, v6 T* W/ r" w$ V/ o! naccess-list 102 permit tcp any host 222.191.123.6 eq 56789
$ f* K9 l/ ?; u4 F# Q' Taccess-list 102 permit icmp any any
- I; E7 I9 w/ \7 V( W) \/ saccess-list 80 permit ip 192.168.11.0 255.255.255.0 192.168.11.0 255.255.255.0
) i" X3 ^' K- ]: ^- w1 G8 h2 xaccess-list 80 permit ip 192.168.12.0 255.255.255.0 192.168.11.0 255.255.255.0
access-list 80 permit ip 192.168.13.0 255.255.255.0 192.168.11.0 255.255.255.0
% w. R2 X, P( Oaccess-list 80 permit ip 192.168.14.0 255.255.255.0 192.168.11.0 255.255.255.0
* @$ B9 B9 [4 b0 A3 Eaccess-list 80 permit ip 192.168.15.0 255.255.255.0 192.168.11.0 255.255.255.0
access-list 80 permit ip 192.168.16.0 255.255.255.0 192.168.11.0 255.255.255.0
. c% u" @7 s- l- N4 a2 s# ~" kaccess-list 80 permit ip 192.168.13.0 255.255.255.0 192.168.200.0 255.255.248.0
access-list 80 permit ip 192.168.14.0 255.255.255.0 192.168.200.0 255.255.248.0
6 d% T9 K* ~8 Y0 e8 _access-list 80 permit ip 192.168.12.0 255.255.255.0 192.168.200.0 255.255.248.0
% f0 S: h8 v( z6 o1 h+ W4 _$ Vaccess-list 120 permit ip 192.168.13.0 255.255.255.0 192.168.200.0 255.255.248.

; M! I% i3 h) G7 a3 W4 [4 p3 ~pager lines 24
! ], F. w7 `* J3 _& n6 M0 {% P; emtu outside 1500
mtu inside 1500
, V2 C/ B( |* Q! i  W& \- Xip address outside 222.191.123.6 255.255.255.252
- D; B8 l. G. }! zip address inside 192.168.11.254 255.255.255.0
ip audit info action alarm
! }( Y" |$ z2 z, P: ]3 z1 \ip audit attack action alarm
5 q' N/ i4 }) d5 A* Jip local pool dialer 192.168.11.200-192.168.11.220
no failover
failover timeout 0:00:00
* R8 X, F0 j$ J3 a+ ^failover poll 15
" G: _; X6 _: Tno failover ip address outside
no failover ip address inside
4 Q" z- ^# I$ i3 r. _pdm location 192.168.12.0 255.255.255.0 inside
pdm location 192.168.13.0 255.255.255.0 inside
7 e! I9 d" |  K0 e* i3 A4 ~pdm location 192.168.14.0 255.255.255.0 inside
pdm location 192.168.15.0 255.255.255.0 inside
9 E) I5 f7 ~' h: kpdm location 192.168.16.0 255.255.255.0 inside
, C. ]3 z& e$ n, Spdm location 192.168.18.0 255.255.255.0 outside
pdm location 192.168.11.0 255.255.255.0 inside
- w( O/ D3 p, F8 b' N% s1 p$ a$ jpdm location 192.168.18.0 255.255.255.0 inside
1 ?/ s" h/ p, a' x1 n( u7 [: mpdm location 192.168.12.3 255.255.255.255 inside
pdm location 0.0.0.0 255.0.0.0 inside
, `$ r; d, ~3 j1 l5 r! T1 epdm location 192.168.11.0 255.255.255.0 outside
pdm location 192.168.12.4 255.255.255.255 inside
1 H7 F* }, m, s' i# epdm location 192.168.200.0 255.255.248.0 outside
pdm history enable
% w' B6 [2 V* Garp timeout 14400
global (outside) 1 interface
' F0 Y/ X7 F! B* |/ t( ?nat (inside) 0 access-list 80
# k, r7 K" B( N) cnat (inside) 1 192.168.11.0 255.255.255.0 0 0
nat (inside) 1 192.168.12.0 255.255.255.0 0 0
) w( O9 x# i- T( f6 f0 ^: Sstatic (inside,outside) tcp interface ftp 192.168.12.3 ftp netmask 255.255.255.
55 0 0
static (inside,outside) tcp interface smtp 192.168.12.3 smtp netmask 255.255.25
.255 0 0
9 i4 `7 K/ K) `6 W' L$ d# tstatic (inside,outside) tcp interface www 192.168.12.3 www netmask 255.255.255.
0 G2 s- s2 D2 F; Z$ Q55 0 0
3 J  A3 b* b6 e! ?static (inside,outside) tcp interface pop3 192.168.12.3 pop3 netmask 255.255.25
.255 0 0
# M" i- S, h- X5 C3 ostatic (inside,outside) tcp interface 56789 192.168.12.3 615 netmask 255.255.25
.255 0 0
2 f7 z/ S+ P' _7 T6 E! w& f+ U5 |access-group 102 in interface outside
: ?6 z* ]8 X. }( jroute outside 0.0.0.0 0.0.0.0 222.191.234.5 1
- o  {# A( T( s- Droute inside 192.168.12.0 255.255.255.0 192.168.11.1 1
route inside 192.168.13.0 255.255.255.0 192.168.11.1 1
route inside 192.168.14.0 255.255.255.0 192.168.11.1 1
7 y( c) t) \+ e9 ~" P& [4 K, ?  M3 {; oroute inside 192.168.15.0 255.255.255.0 192.168.11.1 1
8 b( D8 @3 ~: [: kroute inside 192.168.16.0 255.255.255.0 192.168.11.1 1
route inside 192.168.18.0 255.255.255.0 192.168.11.1 1
3 i/ H3 L7 p# a# _, [, k" `0 ]timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
+ f# ]2 d  L& {# G! F3 @aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
) z% |. [1 C& U" e! y5 \. q, \6 haaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 inside
. W' S8 d: g8 `8 E8 M" ]no snmp-server location
no snmp-server contact
snmp-server community public
% \* h7 \3 A7 y6 W! X: Ano snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
5 B& C% y2 W4 d3 q; d" v; acrypto ipsec transform-set aaades esp-des esp-md5-hmac
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dynomap 10 set transform-set aaades
crypto map vpnpeer 20 ipsec-isakmp dynamic dynomap
crypto map vpnpeer 40 ipsec-isakmp
9 ]$ z' @  y- S: ycrypto map vpnpeer 40 match address 120
2 D) b0 k# o% icrypto map vpnpeer 40 set peer 222.191.232.34
crypto map vpnpeer 40 set transform-set myset
- D+ l: B& g- `' B' a7 jcrypto map vpnpeer client configuration address initiate
crypto map vpnpeer client configuration address respond
7 c% W7 @  ~3 u8 o$ U) s  Tcrypto map vpnpeer client authentication LOCAL
1 A6 ]. W- h' K+ f5 `1 V/ ~crypto map vpnpeer interface outside
& w4 K  i& Q5 r" q! aisakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp key ******** address 222.191.232.34 netmask 255.255.255.255
isakmp client configuration address-pool local dialer outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
; p% R( h! t* g8 b; H. R# _! f& kisakmp policy 10 hash md5
0 Z' c! c. x1 Z7 h# R8 t7 cisakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup weifu103user address-pool dialer
1 }: k4 b& @) H; @6 D* \vpngroup weifu103user idle-time 1800
- F( b, ?& z, B8 L% q* vvpngroup weifu103user password ********
telnet 0.0.0.0 0.0.0.0 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
) [( D. l. b& a0 [ssh timeout 5
8 q6 }9 d  W7 B. ~# z/ @console timeout 0
username weifu103 password 0KczsG6c9C2DHNWX encrypted privilege 2
username weifu password ObN5By5VruQxn1Fr encrypted privilege 2
username vpnuser password tAtXXvCxpjX0dUEC encrypted privilege 2
terminal width 80
Cryptochecksum:9c994cccc5b7fcc843383017fd2e4c69
: end
pixfirewall(config)# quit
. z& {$ a9 ~5 @' L0 s9 N1 A: xpixfirewall# quit

Logoff

5 @5 h5 _; u1 L% u' D( F1 W
; G; K/ g- P0 M/ r
) i5 @1 i/ n  I9 N) y% y( _失去了跟主机的连接。

no fixup protocol skinny 2000是什么意思?

连种用的是2000端口，而pix吧2000用做其他一个协议（skinny），你no一下就可以了。就这样简单