一个公网ip，pix515e，怎样才能pat，web,ftp

一个公网ip，pix515e，我想让内部使用pat上网，已经做好了，但是怎样做，外部可以访问我内部的web,ftp服务器。我从很多网站下载了一些资料，想给大家共享，可是不会做，有人说作端口映射，我需要具体的命令，以及命令解释。
谢谢大家。

如果你的公网地址做pat了，那好象不能做。。我调过pix,但没找到关于端口影射的命令。只能加地址。。

有人说首先
7 q* Q6 t& }# ?3 f+ X8 V/ qaccess-list nonat permit ip 172.16.20.0 255.255.255.0 172.16.10.0 255.255.255.0
5 E! b, A" c$ O/ n$ V! X/ C6 }nat (inside) 0 access-list nonat
就可以，可是我不明白，
大家能不能再看看，谢谢

up,我不想让这个贴子沉了
谢谢各位

Building configuration...
6 s2 o8 a5 c  Y/ R: Saved
:
- t$ R. O" t& ]) }" g: kPIX Version 6.2(2)
9 t8 }8 [, F$ x# |# W  knameif ethernet0 outside security0
/ }/ F4 H. ]: @nameif ethernet1 inside security100
1 {3 j* @0 _& L) R  yenable password EFPY5czS4EGa8TNi encrypted
passwd EFPY5czS4EGa8TNi encrypted
( b% Z" y0 f! M9 _( z% h  Xhostname PIX515E
) J! K# z- b7 |% Hdomain-name abc.com
: V6 a1 X3 P: B+ ?# P. ifixup protocol ftp 21
fixup protocol http 80
* ^; f! ?# ^. |# d7 Ofixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
# t7 x4 \/ R" jfixup protocol ils 389
fixup protocol rsh 514
: ]4 l! g3 t7 z( A8 _fixup protocol rtsp 554
0 Z3 S( b0 y9 cfixup protocol smtp 25
* b( I9 g* |1 _" ^& v1 v6 Gfixup protocol sqlnet 1521
fixup protocol sip 5060
no fixup protocol skinny 2000
names
access-list acl_inside permit tcp host 192.168.30.37 any
! S- m( a  K6 _( haccess-list acl_inside permit tcp host 192.168.30.23 any
3 J3 r3 }) Q7 [' Xaccess-list acl_inside deny tcp any any eq 2000
access-list acl_inside deny tcp any any eq 3000
access-list acl_inside permit ip any any
pager lines 24
: T8 m3 r, p' Rinterface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
# m( y5 V/ k# _! L' @% wmtu inside 1500
: `  R  F7 B/ x9 x2 Pip address outside 210.123.23.250 255.255.255.252
3 R) `" Y; U) a& `% H+ Bip address inside 192.168.0.250 255.255.255.0
( U/ y% T) k/ K& Bip audit info action alarm
ip audit attack action alarm
, ^. j/ e% I5 X7 v: h1 Yno failover
failover timeout 0:00:00
5 ?: i4 V# R3 d) Rfailover poll 15
2 J8 }5 Y0 E4 D1 g' F5 Afailover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
pdm location 192.168.0.0 255.255.255.0 inside
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group acl_inside in interface inside
route outside 0.0.0.0 0.0.0.0 210.123.23.249 1
5 ^9 \* w4 a2 N# @2 D' f$ A( i: O, t; zroute inside 192.168.0.0 255.255.0.0 192.168.0.7 1
timeout xlate 3:00:00
7 p3 n3 K- X5 b" Ztimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323

0:05:00 sip 0:30:00 sip_media 0:02:00
, P" e' r/ U2 b: Y; U) N' W7 I- ztimeout uauth 0:05:00 absolute
: k3 Z  ^# l& n* v# b, L1 Caaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
0 F3 p$ J9 e; x( d3 paaa-server LOCAL protocol local
7 x" W! E4 X  h) hhttp server enable
6 J# e% F7 t0 q, k( w, Dhttp 192.168.0.0 255.255.255.0 inside
4 |7 |$ Z; ]& r" b# @9 @1 Gno snmp-server location
0 h- `: a, m' Y* Ono snmp-server contact
2 B3 b) O+ g$ m! ~* {3 A. W( isnmp-server community public
no snmp-server enable traps
# w: r% L( h  Vfloodguard enable
no sysopt route dnat
telnet 192.168.0.0 255.255.255.0 inside
* W0 M5 _# n7 [3 c: Itelnet timeout 5
7 J4 M. A! ^$ P0 Mssh timeout 5
terminal width 80
Cryptochecksum:6f7058a31a7dfdc771f14aff23f9f997
. o$ D7 S' I+ v; P7 d: end
* U& ^  d0 z. i& e6 ][OK]
! T  u+ H; V" x8 a" w. }2 J+ g% k
, r. Z7 T3 \/ Y8 h以上是我现在的配置

global (outside) 1 interface
nat (inside) 1 0 0
6 b2 X* b! G3 v) q7 ^
static (inside,outside) tcp interface 80 内部主机IP 80
- K' t; _6 q# t7 J: D) Rstatic (inside,outside) tcp interface 21 内部主机IP 21
.
.
.
6 D+ I- M! F) X$ i; u- v
access-list outside permit tcp any host 210.123.23.250 eq www
access-list outside permit tcp any host 210.123.23.250 eq ftp

/ G. z% L  o# L access-group outside in interface outside

PIX515E(config)# access-list acl_out permit tcp any host 210.123.23.250 eg 80
ERROR: extra command argument(s)
Usage:  [no] access-list compiled
' q0 G, n( O( F; K& z[no] access-list <id> compiled
+ B4 A+ e! J. B" i! r) O[no] access-list <id> deny|permit <protocol>|object-group <protocol_obj_grp_id>
8 s" N- T/ G, m( g7 }0 B8 I9 ]                <sip> <smask> | object-group <network_obj_grp_id>
                [<operator> <port> [<port>] | object-group <service_obj_grp_id>]
* V3 Q) o+ e' h5 W                <dip> <dmask> | object-group <network_obj_grp_id>
! t$ Y6 {) G/ P/ @  F                [<operator> <port> [<port>] | object-group <service_obj_grp_id>]
- [6 j7 _0 J$ z* O# H[no] access-list <id> deny|permit icmp
8 \$ i$ ]$ w. z7 K                <sip> <smask> | object-group <network_obj_grp_id>
6 j' _! g$ x! s                <dip> <dmask> | object-group <network_obj_grp_id>
" K7 @  p- Z2 l3 G0 {1 t                [<icmp_type> | object-group <icmp_type_obj_grp_id>]
PIX515E(config)# access-list acl_out permit tcp any host 210.123.23.250 eg www
3 d9 h  C3 W! z1 D8 v! fERROR: extra command argument(s)
Usage:  [no] access-list compiled
[no] access-list <id> compiled
[no] access-list <id> deny|permit <protocol>|object-group <protocol_obj_grp_id>
. E5 G3 y* p- G0 w: p: r& Z                <sip> <smask> | object-group <network_obj_grp_id>
                [<operator> <port> [<port>] | object-group <service_obj_grp_id>]
                <dip> <dmask> | object-group <network_obj_grp_id>
                [<operator> <port> [<port>] | object-group <service_obj_grp_id>]
" W. d4 b  N  r[no] access-list <id> deny|permit icmp
' X1 W9 s6 z/ o, R' `! ~                <sip> <smask> | object-group <network_obj_grp_id>
. x. {+ a3 s$ E  x6 ]5 G' G                <dip> <dmask> | object-group <network_obj_grp_id>
                [<icmp_type> | object-group <icmp_type_obj_grp_id>]

PIX515E(config)# access-list acl_out permit tcp any host 210.123.23.250

可以的
那么上一个错在什么地方

错在：PIX515E(config)# access-list acl_out permit tcp any host 210.123.23.250 eg www
8 R# J5 ^) }: I" q4 m' @eg eg 应该是eq www

global (outside) 1 interface
, B9 Z& P6 P. Z% Pnat (inside) 1 0 0
) z& B5 W. R8 A
9 W/ r7 ~1 O  n  Tstatic (inside,outside) tcp interface 80 内部主机IP 80
" x1 o  a* l% x3 q. I7 dstatic (inside,outside) tcp interface 21 内部主机IP 21
.
.
$ I& L9 }1 l' V+ w! {, \' u- P.

. p5 A0 a% B7 ^, @+ }, N- o* Saccess-list outside permit tcp any host 210.123.23.250 eq www
6 ~  n* d) ]' g+ {$ \( xaccess-list outside permit tcp any host 210.123.23.250 eq ftp

access-group outside in interface outside
& f5 j) s$ ^5 D4 B, H对不起，我敲的时候把eq错敲为eg了。
用以上的方法就可以了

还有一个问题，这是外网虽可以了，但是内网不能，我的意思是说：
外网可以进入http://210.123.23.250
: C! h" d6 N5 X/ n% [) S但内网不能。
: _/ n* b: {: ]" Y3 b4 G还需要做什么
谢谢