发信人: kelvinsu (kelivn), 信区: Security
标  题: Pixfirewall配置问题
发信站: 中国Cisco技术论坛 (Fri May 26 18:10:41 2006)

下面是网络要求及配置方法，从办公网PING服务器或服务器PING办公网都能通，但是数据
库连不上，大家看看有没有什么错误，谢谢。

设备：PIX506E

要求：办公网（outside）内的两台机器允许访问服务器，并允许SQL数据库的连接，服务
器（inside）可以访问办公网。

IP地址：  pix outside：13.49.16.254 255.255.255.0
          pix inside：10.0.0.1 255.255.255.0
        server 真实ip：10.0.0.2 255.255.255.0
  server 办公网访问IP：13.49.16.130 255.255.255.0
   办公网允许访问IP地址：13.49.16.151 255.255.255.0

配置思路：外口接入办公网，内口就接一个服务器，给服务器绑定一个办公网IP地址并开
放所有端口，然后作访问控制列表，让办公网允许的机器访问。

所用命令：
ip address outside 13.49.16.254 255.255.255.0
ip address inside 10.0.0.1 255.255.255.0
interface e0 auto
interface e1 auto
static (inside,outside) 13.49.16.130 10.0.0.2 netmask 255.255.255.255
conduit permit ip 13.49.16.130 255.255.255.255 any
conduit permit icmp any any 
route outside 0.0.0.0 0.0.0.0 13.49.16.3
access-list outside_acl permit ip host 13.49.16.151 any 
access-group outside_acl in interface outside

防火墙show running-config输出：
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_acl permit ip host 13.49.16.151 any  
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 13.49.16.254 255.255.255.0
ip address inside 10.0.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
static (inside,outside) 13.49.16.130 10.0.0.2 netmask 255.255.255.255 0 0 
access-group outside_acl in interface outside
conduit permit icmp any any 
route outside 0.0.0.0 0.0.0.0 13.49.16.3 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server LOCAL protocol local 
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:032b5fccbc06b37cdc9e592d7aee7277
: end
--

※ 来源:．中国Cisco技术论坛 bbs.ccxx.net [FROM: 211.94.136.98]