一個(gè)很全的關(guān)于PIX的配置及注解

第第頁(yè)一個(gè)很全的關(guān)于PIX的配置及注解一個(gè)很全的關(guān)于PIX的配置及注解

發(fā)表于：2023-06-23來(lái)源：：點(diǎn)擊數(shù)：標(biāo)簽：

:Saved:PIXVersion6.3(1)interfaceethernet0auto設(shè)定端口0速率為自動(dòng)interfaceethernet1100full設(shè)定端口1速率為100兆全雙工interfaceethernet2auto設(shè)定端口2速率為自動(dòng)nameifethernet0outsidesecurity0設(shè)定端口0名稱為outside安

:Saved

:

PIXVersion6.3(1)

interfaceethernet0auto設(shè)定端口0速率為自動(dòng)

interfaceethernet1100full設(shè)定端口1速率為100兆全雙工

interfaceethernet2auto設(shè)定端口2速率為自動(dòng)

nameifethernet0outsidesecurity0設(shè)定端口0名稱為outside安全級(jí)別為0

nameifethernet1insidesecurity100設(shè)定端口1名稱為inside安全級(jí)別為100

nameifethernet2dmzsecurity50設(shè)定端口2名稱為dmz安全級(jí)別為50

enablepasswordDv0yXUGPM3Xt7xVsencrypted特權(quán)密碼

passwd2KFQnbNIdI.2KYOUencrypted登陸密碼

hostnamehhyy設(shè)定防火墻名稱

fixupprotocolftp21

fixupprotocolh323h2251720

fixupprotocolh323ras1718-1719

fixupprotocolhttp80

fixupprotocolils389

fixupprotocolrsh514

fixupprotocolrtsp554

fixupprotocolsip5060

fixupprotocolsipudp5060

nofixupprotocolskinny2000

fixupprotocolsmtp25

fixupprotocolsqlnet1521

允許用戶查看、改變、啟用或禁止一個(gè)服務(wù)或協(xié)議通過(guò)PIX防火墻，防火墻默認(rèn)啟用了一些常見(jiàn)的端口，但對(duì)于ORACLE等專有端口，需要專門(mén)啟用。

names

access-list101permitip

access-list101permitip

access-list101permitip

access-list101permitip

建立訪問(wèn)列表，允許特定網(wǎng)段的地址訪問(wèn)某些網(wǎng)段

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyicmpany

access-list120denyudpanyanyeqnetbios-ns

access-list120denyudpanyanyeqnetbios-dgm

access-list120denyudpanyanyeq4444

access-list120denyudpanyanyeq1205

access-list120denyudpanyanyeq1209

access-list120denytcpanyanyeq445

access-list120denytcpanyanyrange135netbios-ssn

access-list120permitipanyany

建立訪問(wèn)列表120防止各個(gè)不同網(wǎng)段之間的ICMP發(fā)包及拒絕135、137等端口之間的通信（主要防止沖擊波病毒）

access-list110permitip

pagerlines24

loggingon

loggingmonitordebugging

loggingbuffereddebugging

loggingtrapnotifications

mtuoutside1500

mtuinside1500

mtudmz1500

ipaddressoutside24設(shè)定外端口地址

ipaddressinside54設(shè)定內(nèi)端口地址

ipaddressdmz設(shè)定DMZ端口地址

ipauditinfoactionalarm

ipauditattackactionalarm

iplocalpoolhhyy-54

建立名稱為hhyy的地址池，起始地址段為：-54

iplocalpoolyy-54

建立名稱為yy的地址池，起始地址段為：-54

nofailover

failovertimeout0:00:00

failoverpoll15

nofailoveripaddressoutside

nofailoveripaddressinside

nofailoveripaddressdmz

nopdmhistoryenable

arptimeout14400

不支持故障切換

global(outside)13-8

global(outside)1-

global(outside)10

定義內(nèi)部網(wǎng)絡(luò)地址將要翻譯成的全局地址或地址范圍

nat(inside)0access-list101

使得符合訪問(wèn)列表為101地址不通過(guò)翻譯，對(duì)外部網(wǎng)絡(luò)是可見(jiàn)的

nat(inside)100

內(nèi)部網(wǎng)絡(luò)地址翻譯成外部地址

nat(dmz)100

DMZ區(qū)網(wǎng)絡(luò)地址翻譯成外部地址

static(inside,outside)00netmask5500

static(inside,outside)258netmask5500

static(inside,outside)netmask5500

設(shè)定固定主機(jī)與外網(wǎng)固定IP之間的一對(duì)一靜態(tài)轉(zhuǎn)換

static(dmz,outside)netmask5500

設(shè)定DMZ區(qū)固定主機(jī)與外網(wǎng)固定IP之間的一對(duì)一靜態(tài)轉(zhuǎn)換

static(inside,dmz)netmask00

設(shè)定內(nèi)網(wǎng)固定主機(jī)與DMZIP之間的一對(duì)一靜態(tài)轉(zhuǎn)換

static(dmz,outside)9netmask5500

設(shè)定DMZ區(qū)固定主機(jī)與外網(wǎng)固定IP之間的一對(duì)一靜態(tài)轉(zhuǎn)換

access-group120ininterfaceoutside

access-group120ininterfaceinside

access-group120ininterfacedmz

將訪問(wèn)列表應(yīng)用于端口

conduitpermittcphostany

conduitpermittcphostany

conduitpermittcphost2any

conduitpermittcphost9any

設(shè)置管道：允許任何地址對(duì)全局地址進(jìn)行TCP協(xié)議的訪問(wèn)

conduitpermiticmpany

設(shè)置管道：允許任何地址對(duì)地址進(jìn)行PING測(cè)試

ripoutsidepassiveversion2

ripinsidepassiveversion2

routeoutside

設(shè)定默認(rèn)路由到電信端

routeinside1

routeinside1

routeinside1

routeinside1

routeinside1

routeinside1

routeinside1

routeinside1

routeinside1

routeinside1

設(shè)定路由回指到內(nèi)部的子網(wǎng)

timeoutxlate3:00:00

timeoutconn1:00:00half-closed0:10:00udp0:02:00rpc0:10:00h225

1:00:00

timeouth3230:05:00mgcp0:05:00sip0:30:00sip_media0:02:00

timeoutuauth0:05:00absolute

aaa-serverTACACS+protocoltacacs+

aaa-serverRADIUSprotocolradius

aaa-serverLOCALprotocollocal

nosnmp-serverlocation

nosnmp-servercontact

snmp-servercommunitypublic

nosnmp-serverenabletraps

floodguardenable

sysoptconnectionpermit-ipsec

sysoptconnectionpermit-pptp

serviceresetinbound

serviceresetoutside

cryptoipsectransform-setmysetesp-desesp-md5-hmac

定義一個(gè)名稱為myset的交換集

cryptodynamic-mapdynmap10settransform-setmyset

根據(jù)myset交換集產(chǎn)生名稱為dynmap的動(dòng)態(tài)加密圖集（可選）

cryptomapvpn10ipsec-isakmpdynamicdynmap

將dynmap動(dòng)態(tài)加密圖集應(yīng)用為IPSEC的策略模板（可選）

cryptomapvpn20ipsec-isakmp

用IKE來(lái)建立IPSEC安全關(guān)聯(lián)以保護(hù)由該加密條目指定的數(shù)據(jù)流

cryptomapvpn20matchaddress110

為加密圖指定列表110作為可匹配的列表

cryptomapvpn20setpeer1

在加密圖條目中指定IPSEC對(duì)等體

cryptomapvpn20settransform-setmyset

指定myset交換集可以被用于加密條目

cryptomapvpnclientconfigurationaddressinitiate

指示PIX防火墻試圖為每個(gè)對(duì)等體設(shè)置IP地址

cryptomapvpnclientconfigurationaddressrespond

指示PIX防火墻接受來(lái)自任何請(qǐng)求對(duì)等體的IP地址請(qǐng)求

cryptomapvpninterfaceoutside

將加密圖應(yīng)用到外部接口

isakmpenableoutside

在外部接口啟用IKE協(xié)商

isakmpkey********address1netmask55

指定預(yù)共享密鑰和遠(yuǎn)端對(duì)等體的地址

isakmpidentityaddress

IKE身份設(shè)置成接口的IP地址

isakmpclientconfigurationaddress-poollocalyyoutside

isakmppolicy10authenticationpre-share

指定預(yù)共享密鑰作為認(rèn)證手段

isakmppolicy10encryptiondes

指定56位DES作為將被用于IKE策略的加密算法

isakmppolicy10hashmd5

指定MD5(HMAC變種)作為將被用于IKE策略的散列算法

isakmppolicy10group2

指定1024比特Diffie-Hellman組將被用于IKE策略

isakmppolicy10lifetime86400

每個(gè)安全關(guān)聯(lián)的生存周期為86400秒（一天）

vpngroupciscoidle-time1800

vpngrouppix_vpnaddress-poolyy

vpngrouppix_vpnidle-time1800

vpngrouppix_vpnpassword********

vpngroup123address-poolyy

vpngroup123idle-time1800

vpngroup123password********

vpngroup456address-poolyy

vpngroup456idle-time1800

vpngroup456password********