发信人: guest (论坛过客), 信区: sysop
标  题: 请帮忙看看我这个PIX525配置有没有问题，谢谢！
发信站: 中国Cisco技术论坛 (2007年08月22日16:48:07 星期三), 站内信件

PIX Version 7.0(4) 
hostname TEST 
enable password 8Ry2YjIyt7RRXU24 encrypted 
names 
! 
interface Ethernet0 
nameif outside 
security-level 0 
ip address 172.17.12.171 255.255.255.0 
! 
interface Ethernet1 
nameif inside 
security-level 100 
ip address 192.168.1.1 255.255.255.0 
! 
interface Ethernet2 
shutdown 
no nameif 
no security-level 
no ip address 
! 
passwd 2KFQnbNIdI.2KYOU encrypted 
ftp mode passive 
pager lines 24 
mtu outside 1500 
mtu inside 1500 
ERROR: Command requires failover license 
ERROR: Command requires failover license 
no asdm history enable 
arp timeout 14400 
global (outside) 1 interface 
nat (inside) 1 0.0.0.0 0.0.0.0 
route outside 0.0.0.0 0.0.0.0 172.17.12.1 1 
timeout xlate 3:00:00 
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00 
timeout uauth 0:05:00 absolute 
no snmp-server location 
no snmp-server contact 
snmp-server enable traps snmp authentication linkup linkdown coldstart 

telnet timeout 5 
ssh timeout 5 
console timeout 0 
! 
class-map inspection_default 

match default-inspection-traffic 
! 
! 
policy-map global_policy 
class inspection_default 
inspect dns maximum-length 512 
inspect ftp 
inspect h323 h225 
inspect h323 ras 
inspect netbios 
inspect rsh 
inspect rtsp 
inspect skinny 
inspect esmtp 
inspect sqlnet 
inspect sunrpc 
inspect tftp 
inspect sip 
inspect xdmcp 
! 
service-policy global_policy global 
Cryptochecksum:323486547ca84e42284f585743fc50ab 
: end 

TEST(config)# 

为什么我CONSOLE到PIX上可以Ping出去，也可以Ping通内网，但下接PC机只能
Ping通192.168.1.1，不能上网（注意：这个测试环境是我的OA办公网，172.17.
12.171这个地址是可以上网的)。
--
※ 来源:·中国Cisco技术论坛 bbs.ccxx.net·[FROM: 219.148.206.41]