CiscoPIX防火墙的问题集锦
添加时间: 2008-2-24 13:02:33 作者: Cisco指导 阅读次数:52 来源: http://www.d9soft.com
isakmp nat-traversal 120
还有客户端NAT打开，估计是NAT穿透的问题吧。
pix515的问题
具体现象是，DMZ和inside各接一台单机，DMZ的单机能用上网，其他不能，inside的机器什么都干不了。单机保证无问题。请各位帮忙看看配
置吧。 outside的地址和global的地址不同，有影响么？（没有空闲的连续地址了,只能用两个不同地址表示一下）
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password O53fPNRgHkA6IEsY encrypted
passwd TWjtI1emvjruV4SY encrypted
hostname jygatewall
domain-name 219.2.2.2
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sqlnet 1521
fixup protocol sip 5060
no fixup protocol skinny 2000
no fixup protocol smtp 25
names
access-list dmz_jygate_acl deny icmp any any
access-list dmz_jygate_acl permit udp any any eq domain
access-list dmz_jygate_acl permit tcp any any eq www
access-list dmz_jygate_acl permit udp any any eq 20
access-list dmz_jygate_acl permit tcp any host 219.150.1.1 eq 20817
access-list dmz_jygate_acl permit tcp any host 219.150.1..1eq 20820
access-list dmz_jygate_acl permit tcp any host 219.150.1.1 eq 8080
access-list dmz_jygate_acl permit tcp any host 219.150.1.1 eq 8383
access-list dmz_jygate_acl permit tcp any host 219.150.1.1 eq 32002
pager lines 24
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 219.150.1.2 255.255.255.224
ip address inside 192.168.168.1 255.255.255.0
ip address dmz 172.172.172.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 219.150.1.2
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (dmz,outside) 219.150.1.2 172.172.172.101 netmask 255.255.255.255 0 0
static (inside,dmz) 192.168.168.0 192.168.168.0 netmask 255.255.255.0 0 0
access-group dmz_jygate_acl in interface outside
access-group dmz_jygate_acl in interface dmz
route outside 0.0.0.0 0.0.0.0 219.150.1.3 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt security fragguard
no sysopt route dnat
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:594b9bbf77abf8a342afee1764e4f7cd
: end
nyb0319 (普通用户)
no static (inside,dmz) 192.168.168.0 192.168.168.0 netmask 255.255.255.0 0 0
改为static (inside,dmz) 172.172.172.1 192.168.168.0 netmask 255.255.255.0 0 0
加一条
static (inside,outside)
219.150.1.2 192.168.168.0
netmask 255.255.255.0 0 0
no access-group dmz_jygate_acl in interface dmz
crazytank (普通用户)
按照上面的提示改了，结果提示global address overlaps with mask
请各位大侠再帮忙看看啊
lcschina (活跃用户)
ip address outside 219.150.1.2 255.255.255.224
global (outside) 1 219.150.1.2
地址重叠！！！
加上 global (outside) 1 interface
去掉你的那个global
CiscoPIX防火墙的问题集锦(3) 第 [1] [2] [3] 下一页
上一篇文章: 思科系统公司WebVPN解决方案 下一篇文章: Cisco3550端口限速例子
相关文章: