环境： pix515e下接3560g下接2960" U, M- H. j+ w$ [1 K
+ D) v- i! P5 F" F& m7 G9 w2 ?
目前在3560上划分了一个vlan 172.16.1.1，但其下面的主机无法上网，希望大家帮助！！！* G$ I6 m& U$ d4 S, d9 U. [
( J& N# r" |" c6 R/ B C2 x目前网关路由在pix上作的，3560上没有起三层接口，就划分了一个vlan 172.16.1.1
L6 r& q4 _+ h q- o; j
0 `7 I* |, e" W) X" `& b7 M6 tpix配置如下：PIX Version 7.2(2)
7 L, V" I2 l' }+ I/ u4 D& s!9 h9 |" a- T0 |/ R
hostname pixfirewall
' {, x7 a. l r" [4 D' i8 W# Xenable password PLBb27eKLE1o9FTB encrypted
4 S, R0 A$ i* M& Mnames$ ?& J6 x$ h5 q
!
. _ |4 a% Z6 e2 D5 y3 cinterface Ethernet0, W, W' S4 s7 l4 D
speed 10
m4 E+ ?6 b J( K1 }duplex full
9 o5 j( V' L& K. n& E! }$ tnameif outside+ } S: s* y6 u( T# R2 Z
security-level 0
2 {: S+ I! W8 q4 C, z1 Q* iip address 61.50.220.51 255.255.255.0
- D. V0 c( s) e- F9 y) l$ [!# O- D" e' t0 `* F( a/ U9 u
interface Ethernet1
8 \1 G. \" d2 x" }& ?7 Lnameif inside
1 v. g: @4 ~" J6 t1 G) @security-level 102 V; d6 K& \. X/ W) M k5 G
ip address 192.168.1.1 255.255.255.0
& n, m9 r, ~6 l( S ^5 g!' A7 i: F' P# f% `/ D
passwd 2KFQnbNIdI.2KYOU encrypted0 a+ g" H' [1 I. w( P: y
ftp mode passive
; n- W- S. ]( ~/ iaccess-list 101 extended permit tcp any host 123.124.10.33 eq smtp2 }! F! V6 D1 Z& o4 |
access-list 101 extended permit tcp any host 123.124.10.33 eq pop3
% B: r8 a. z9 baccess-list 101 extended permit ip any host 123.124.10.33$ Z9 d2 B3 L& S- l. h
access-list 101 extended permit icmp any any* q) b/ O. t4 ~9 J: @2 X
access-list 101 extended permit tcp any host 61.50.220.50 eq telnet
* D4 v6 Q' O, F Yaccess-list 102 extended permit ip any any
+ O0 n0 B X% a Jpager lines 24$ X# c5 b/ s4 b7 A! ~
mtu outside 1500" H: u1 S+ l) L' U8 f% r0 p6 E
mtu inside 1500
$ t- e# ?2 g, s1 [% g7 \no failover7 g; D+ ]9 `. ?" n
icmp unreachable rate-limit 1 burst-size 1
+ T, e5 Q' Q( T2 F5 m& F7 z, M. Aasdm image flash:/asdm
0 d, a3 K3 J4 P. ?no asdm history enable$ {# x- u! @9 @3 n
arp timeout 14400/ I$ d" |$ O7 {: U$ d# b, ^3 f' `
global (outside) 10 interface1 F0 g* w, L- A, o0 }. @' q$ C& i3 f
nat (inside) 10 172.16.1.0 255.255.255.0: f" T$ J% t% M4 _4 @/ f+ t8 }2 S! A
nat (inside) 10 192.168.1.0 255.255.255.0! q! N8 X8 T& w. y6 W, ^
static (inside,outside) tcp interface telnet 192.168.1.2 telnet netmask 255.255. h+ \# Q# N9 ~4 L" O
255.255/ u9 A4 z' q2 s
static (inside,outside) 123.124.10.33 192.168.1.13 netmask 255.255.255.255 dns: d' g: G6 {! u
access-group 101 in interface outside
$ f2 q' L& j2 M/ @, f3 t3 e/ Lroute outside 0.0.0.0 0.0.0.0 61.50.220.50 1
; C; H# A( A" P r5 d+ u6 n" V) dtimeout xlate 3:00:00' [" n# D9 N. M* r8 p
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
9 b% ~, n V- i _7 etimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
3 W j# p: B$ Rtimeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 S& `8 q- S' b \% d
timeout uauth 0:05:00 absolute
. M; w- v2 ~; B* `( b) u- uusername cisco password 3USUcOPFUiMCO4Jk encrypted
% y% c% C2 x8 a z5 N1 p7 Taaa authentication ssh console LOCAL2 J( w8 I) {: f* J: X' z. D
no snmp-server location7 P3 I( k' {+ g( C6 ?6 W
no snmp-server contact
" y3 a- o, S& C+ b* E/ c1 ~snmp-server enable traps snmp authentication linkup linkdown coldstart
% s+ c/ }' q3 U/ S7 Xtelnet 0.0.0.0 0.0.0.0 inside
7 K! s! A' u0 W0 |6 |0 _" E! Itelnet timeout 5! P1 o' M( E& s5 P* t; t
ssh 0.0.0.0 0.0.0.0 outside
l) ~- U0 C, k: }* cssh timeout 5
: c. C9 s" p" K; B9 p+ econsole timeout 0+ N& o @- u1 p j( A K6 q
!' F# j L+ l* m2 \3 m r$ r, u
class-map inspection_default# t; _* `3 K, X
match default-inspection-traffic0 y8 L' Y$ e6 ^1 n
!
& Y, W! p4 F+ y) K/ O# }!
( B0 ^% {9 u# spolicy-map type inspect dns preset_dns_map
9 l R1 N5 p: z) w$ a7 N- I& Bparameters
$ p I. u3 [6 c! p/ c% }% f6 l message-length maximum 512+ ^1 t! t+ @6 y2 ?$ j) d
policy-map global_policy3 q2 P* M+ Q6 |5 k, j# J6 p
class inspection_default+ x. y) r5 ~. a% n8 I
inspect dns preset_dns_map
/ u5 p t$ T4 w) q inspect ftp
. x, x D( l( O inspect h323 h2253 u4 f0 p5 k% U( x# x# V) Y
inspect h323 ras
; Z4 h, p' E& S4 g* c' m inspect netbios
6 {9 i! Q: E* U# H% ^: E inspect rsh
" A9 u* } m. x9 `& n- q inspect rtsp4 U3 T% T0 X" q4 N# F, @
inspect skinny1 K( m& S. q! s6 z4 y) k
inspect esmtp! }4 l% w7 f4 _" B T
inspect sqlnet4 f& }3 T8 S+ c% Z2 Q
inspect sunrpc
' c2 H/ j( Y3 _7 ?8 ]; u6 a( n0 S. o inspect tftp2 u2 Y$ b9 k8 R. k2 w
inspect sip
) U# x3 N; o j0 S6 N inspect xdmcp4 G1 ^$ O- v9 b$ \/ ?5 }8 Z
!. S2 K+ T7 W' H
service-policy global_policy global
; f6 | }3 S1 m8 [prompt hostname context1 Z$ W. C- g; C! O
Cryptochecksum:8d068ef288ac87a931be0633f63c429c
6 J% o1 M# Q/ v5 v; q6 Z: end
. }! b, K9 M- V* P: h3 E- j0 @$ X2 B' _$ y$ J$ H
7 \& Z2 ]' [& s, ~4 l5 r
J2 L u- ?/ ~- C/ s0 Y
: Q& f! p% C0 H' d6 _
3 y( p+ w# f8 f, `2 w
( [ Z3 N' n1 c$ w# A7 q( O9 |4 s
; g, L o7 L/ l1 X3 H0 [6 s( I( B5 w% u1 Q7 t* o: u' n
3 S6 `* L" |6 K
交换机配置：' F" X+ f% U' A7 _" }1 g
! m" I5 E6 J9 B- `1 wversion 12.2% C4 i) ?- d# R5 [' ~7 L! o# \4 i
no service pad' x: r- [) ~/ M! o9 B9 A1 D
service timestamps debug uptime. L. _. D5 t& E* X, g
service timestamps log uptime
. O9 v2 Q& C; Y1 v- ~no service password-encryption
& F8 U; p$ P8 U. Q" c q/ L) q!1 c9 s$ x9 o" s/ w
hostname masterswitch6 c) `# E, b7 }
!
' K. S: Y3 o( b& A$ ~' genable secret 5 $1$G4g3$e/d6Co33we5VtbUqKwQSo.
) Y! X) G' R* v9 Q!
5 n- E7 l5 b* Y9 ono aaa new-model4 a; T, W3 j* C) G0 W; J* b
system mtu routing 1500( N( R% u" {: C
ip subnet-zero
' d& e* o) z5 O9 b' A" qip routing5 K, T) G* h& x1 P& t, F( \
!
8 V4 w9 a+ q+ i& n r!8 a2 ?0 m- C/ k: s4 R0 d
!
+ s8 [1 X" r, v# p/ c!+ S6 E9 F3 g' ^+ [
no file verify auto. ?' W3 u2 r6 A* t4 [5 L. @
spanning-tree mode pvst
! H( I4 ?% H& @* Q& Fspanning-tree extend system-id
4 Z* [/ q' u" R8 x4 F!
! B, D5 y* C# f ~vlan internal allocation policy ascending
0 M/ B6 m4 q' m Y( ~, `!
6 Z' K0 s( `7 b; g0 t# [ V2 k, |!
- e; a0 S: L( B" Rinterface GigabitEthernet0/1
" I( b- z) N _9 h0 X8 d!9 y2 h& P ?5 w- e
interface GigabitEthernet0/26 p2 H( Z) m) x! k$ T1 g7 R8 J
!
! h% N# ^0 I, { {interface GigabitEthernet0/3
; i: ]6 h) T- r) @9 m ~/ p+ Y!: U/ K2 [3 h& B/ S: _0 s5 C
interface GigabitEthernet0/4
/ p: e, D% H8 ?7 l2 K+ P& y!/ h( s9 o M% E+ q: O# V* L
interface GigabitEthernet0/5; w3 y% W' i/ X4 r/ a& Z
!1 v; n% Q4 Z( {0 u; m4 G
interface GigabitEthernet0/6; I" d) u( F5 n( D3 O( r
!
" V# Z* ~0 m! q1 @8 A9 winterface GigabitEthernet0/7+ H* T! W- l. D3 T9 x+ ~& }
!
$ u' S/ {! x! O% E; f& ointerface GigabitEthernet0/8) z4 X9 A8 ^8 f$ L0 W6 \; s, X$ K
!! D0 ?+ S2 F* |
interface GigabitEthernet0/99 ~6 U3 A9 J+ ^3 N' ]3 T( C/ _1 x5 u
!
& I& f8 g3 F3 Z" k3 Ninterface GigabitEthernet0/10
A0 _+ c! N2 o5 F2 a- x K7 h!
# r+ V3 Q5 Q8 X Binterface GigabitEthernet0/11* b) K5 N* U8 U0 l
switchport access vlan 2( ~: y- w' v+ c' u- f. p
switchport mode access9 c& S6 u( ]6 ~' j; j
!
$ d E- _# V3 e, i* d: Kinterface GigabitEthernet0/124 s* h, z5 _4 I0 M8 F/ z: p( q
!
: ]. `+ V! M$ p# Uinterface GigabitEthernet0/13
8 F5 `8 t; D5 ~- L4 l; O0 C+ z!# z6 B5 e) a( L! I
interface GigabitEthernet0/14
1 M1 J. r* X3 F7 c) H2 _3 ~: V!3 D j/ U3 P! V2 B4 y9 D f
interface GigabitEthernet0/15! y |$ e& r @4 I# G
!% W- c, K- z/ r% E0 m4 s4 y1 t
interface GigabitEthernet0/163 i; e7 X8 l/ t6 I
!8 \. G# s9 q/ w; U3 ]2 J; k( R
interface GigabitEthernet0/17
: D. Z8 T% B' W& I# h!
, t' o9 u7 C$ `& E3 g% {* [6 hinterface GigabitEthernet0/182 P, Q6 O7 J7 n9 m8 e# l
!
" F# R: B0 B6 E! V6 ainterface GigabitEthernet0/19
6 z) e# B, `% O!
5 Z5 {# f5 q: a) D% A& @5 @, e' Ninterface GigabitEthernet0/20/ y) s# S! J1 d
!( C, ~9 T( R9 [6 F6 n- W) I3 x; W- [
interface GigabitEthernet0/21
9 u: A l4 X( x* I; g4 s4 }!' a8 i! a( y& ?5 D7 |
interface GigabitEthernet0/22) ^# z7 b) T0 y, ]5 Y1 Y6 a0 s, {
!* K1 Y5 B; m0 h: \
interface GigabitEthernet0/23
! t: O( p( M1 Z3 q!) d7 I' W9 L1 N7 n5 F) v+ e
interface GigabitEthernet0/24
8 y7 a* ~. N- `* u! e!4 w( @9 Q8 K4 }; b' n' {. c
interface GigabitEthernet0/25
7 l* W1 {# }' }( e& L/ R: u% \7 \, n!
3 T; [1 p- j, f( J: v4 winterface GigabitEthernet0/26
5 J1 b! P" H' _3 i!" B9 v1 z' W- w% Q, A
interface GigabitEthernet0/27, {4 W4 V ^' G& ?. p2 ~' s# X
!1 q1 b4 s- A9 c8 @
interface GigabitEthernet0/28
, L: r& _+ x" b% K!
6 z V( {$ H! _5 v Sinterface Vlan10 J! D2 {$ C: e. E- w! a( u$ n
ip address 192.168.1.2 255.255.255.0
! r" v$ _6 c# F/ m, i) ^!* j! F( ]& H: V! G& g g$ O1 Q* Q3 X
interface Vlan20
7 x: ^. w! _6 j# ~/ Rip address 172.16.1.1 255.255.255.0
' ~! a( D+ Q* ~/ `2 u!
# B C5 [' A4 e' ]7 w$ w5 F! ^ip classless
% Z; z% c7 R7 @" C; eip http server3 r& h; j* H4 M# S7 I; A
!
8 P; B* Z) _- B( o6 D% U5 {!# X2 u. i4 F) D( I8 N: H. C
!
8 }" t/ ]3 o: @control-plane
9 [) a1 { {5 b5 q& v0 c) l! S& ~! w2 r3 L8 C# z. |, ?
!& F7 Z. k7 M, M8 p/ ^* P; Z- V
line con 0
$ W* ^' Z3 l) ^3 N; F0 m$ @password 123
9 l5 J+ n h. n# i# N( klogin. {, ` z% |4 W% A
line vty 0 4& m3 T3 B- L" _* r$ i1 r4 s5 s
password 123456" H. r! b- I: x$ h
login; }) l2 M1 v5 _3 p- s" @
line vty 5 15
* q# a+ |" ?! `5 \0 C. |4 j+ W) \login9 N; m0 b+ L: t5 v% r- c
!
4 r* y7 e0 f6 t9 fend |
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
