某銀行網(wǎng)絡(luò)應(yīng)急方案

精品文檔精心整理精品文檔可編輯的精品文檔銀行網(wǎng)絡(luò)應(yīng)急方案XX股份有限公司網(wǎng)絡(luò)與安全服務(wù)部2012年2月目錄一、 銀行網(wǎng)絡(luò)結(jié)構(gòu)拓撲 3二、 骨干網(wǎng)通信故障 31. 故障處理人員 32. 電信、聯(lián)通網(wǎng)絡(luò)通信故障 33. 通信故障恢復(fù) 34. 到總行路由器故障 45. 路由器故障處理 4三、 核心交換機故障應(yīng)急 51. 一臺4506交換機故障應(yīng)急 52. 當核心交換同時癱瘓在20分鐘內(nèi)保證業(yè)務(wù)正常運作 7四、 第三方外聯(lián)區(qū)網(wǎng)絡(luò)應(yīng)急 191. 第三方業(yè)務(wù)銀聯(lián)區(qū)網(wǎng)絡(luò)應(yīng)急 192. 其它第三方業(yè)務(wù)區(qū)網(wǎng)絡(luò)應(yīng)急 46五、 聯(lián)系方式： 56銀行網(wǎng)絡(luò)結(jié)構(gòu)拓撲骨干網(wǎng)通信故障故障處理人員參與人：XX、XX、XX電信、聯(lián)通網(wǎng)絡(luò)通信故障根據(jù)到總行的兩臺cisco7206路由器的日志以及實際登陸設(shè)備使用showintATM4/0.1、ping對端地址、showiproute、showlog，查看上述相關(guān)設(shè)備和線路是否有反復(fù)重起、誤碼率高、異常路由、錯誤連接等情況即可確認故障。通信故障恢復(fù)恢復(fù)步驟：1）重啟故障新路相連路由器，看是否能夠自動恢復(fù)2)斷電重起無法解決故障的，停止使用故障設(shè)備和線路，防止其影響網(wǎng)絡(luò)其他部分。3)如系線路故障通知各有關(guān)方面（逐項對照處理）：●如為中國電信線路故障，向31000000報修，并通知分行辦公室相關(guān)人員?！袢鐬橹袊?lián)通線路故障，向XXXX報修，并通知分行辦公室相關(guān)人員。到總行路由器故障查看日志，檢查設(shè)備故障前的異常日志信息；登陸路由器使用showlog，showipintbrie,showprocesscpuhis,showiproute,ping對端地址等命令來確認故障。路由器故障處理一旦發(fā)現(xiàn)到總行7206路由器故障可按以下步驟來處理：●聯(lián)系XX公司，并啟動原廠商保修服務(wù)備件更換程序?！褚驗閮膳_7206路由器是互為備份的，一臺發(fā)生故障不影響實際業(yè)務(wù)，不調(diào)用庫房備件和集成商備件更換，等待原廠商備件到達?！駥τ谀軌蛟诰€插拔的接口模塊、有standby的引擎和電源，優(yōu)先使用在線更換方式。在線更換的具體操作流程如下：a)用筆記本電腦連接在網(wǎng)絡(luò)設(shè)備的Console上，啟動Console監(jiān)控和記錄；b)準備好存檔的系統(tǒng)配置，備用。如有可能，同時保存當前系統(tǒng)配置；c)對故障模塊上連接的線纜做好標記，小心拔下；d)做好安全接地，拔下故障模塊；e)檢查設(shè)備和模塊狀態(tài)，確認是否影響整個設(shè)備或其他模塊正常運行，standby模塊是否正常接管；f)做好安全接地，插上更換的備件模塊；g)檢查設(shè)備和模塊狀態(tài)，確認是否能夠正常識別新模塊，是否影響其他模塊運行；h)按原樣插上線纜；i)檢查線纜連接狀態(tài)正常；j)確認備件更換成功。l對于機箱、不能在線插拔的接口模塊、或者沒有standby的引擎和電源，采用下電更換方式。下電更換的具體操作流程如下：a)準備好存檔的系統(tǒng)配置，備用。如有可能，同時保存當前系統(tǒng)配置；b)準備好原先使用的系統(tǒng)軟件，備用；c)故障設(shè)備下電；d)對需要拔除的線纜做好標記，小心拔下。如果機箱或引擎更換，需拔除所有連接線纜；e)更換備件；f)用筆記本電腦連接在網(wǎng)絡(luò)設(shè)備的Console上，啟動Console監(jiān)控和記錄；g)設(shè)備上電；h)檢查系統(tǒng)自檢情況，確認無硬件故障；i)安裝系統(tǒng)軟件；j)恢復(fù)系統(tǒng)配置；k)冷啟動，確認軟硬件正常工作；l)按原樣插上其他線纜；m)檢查線纜連接狀態(tài)正常；n)確認備件更換成功。核心交換機故障應(yīng)急一臺4506交換機故障應(yīng)急查看日志，檢查設(shè)備故障前的異常日志信息；登陸交換機使用showlog，showipintbrie,showprocesscpuhis,showiproute,ping對端地址，showvlanbrie,showvtpstat,showprocessmem,showmodul,showdiag,showipeigrpnei,showcdpnei等一系列命令來查找、確認故障。因為兩臺4506核心交換機完全是熱備的雙機，所以一臺發(fā)生故障并不影響業(yè)務(wù)運行。對于配置問題要制定正確的更改配置腳本，備份當前配置以后實施更改；對于線路問題的要制作新網(wǎng)線，替換故障的網(wǎng)線；對于硬件問題要練習XX公司，申請硬件故障維修。對于能夠在線插拔的接口模塊、有standby的引擎和電源，優(yōu)先使用在線更換方式。在線更換的具體操作流程如下：a)用筆記本電腦連接在網(wǎng)絡(luò)設(shè)備的Console上，啟動Console監(jiān)控和記錄；b)準備好存檔的系統(tǒng)配置，備用。如有可能，同時保存當前系統(tǒng)配置；c)對故障模塊上連接的線纜做好標記，小心拔下；d)做好安全接地，拔下故障模塊；e)檢查設(shè)備和模塊狀態(tài)，確認是否影響整個設(shè)備或其他模塊正常運行，standby模塊是否正常接管；f)做好安全接地，插上更換的備件模塊；g)檢查設(shè)備和模塊狀態(tài)，確認是否能夠正常識別新模塊，是否影響其他模塊運行；h)按原樣插上線纜；i)檢查線纜連接狀態(tài)正常；j)確認備件更換成功。l對于機箱、不能在線插拔的接口模塊、或者沒有standby的引擎和電源，采用下電更換方式。下電更換的具體操作流程如下：a)準備好存檔的系統(tǒng)配置，備用。如有可能，同時保存當前系統(tǒng)配置；b)準備好原先使用的系統(tǒng)軟件，備用；c)故障設(shè)備下電；d)對需要拔除的線纜做好標記，小心拔下。如果機箱或引擎更換，需拔除所有連接線纜；e)更換備件；f)用筆記本電腦連接在網(wǎng)絡(luò)設(shè)備的Console上，啟動Console監(jiān)控和記錄；g)設(shè)備上電；h)檢查系統(tǒng)自檢情況，確認無硬件故障；i)安裝系統(tǒng)軟件；j)恢復(fù)系統(tǒng)配置；k)冷啟動，確認軟硬件正常工作；l)對于交換機要將VTP設(shè)置為Client模式，首先連接上行線纜，確認VTP復(fù)制正確；m)按原樣插上其他線纜；n)檢查線纜連接狀態(tài)正常；o)確認備件更換成功。當核心交換同時癱瘓在20分鐘內(nèi)保證業(yè)務(wù)正常運作現(xiàn)有2臺備用的cisco3550，在兩臺核心cisco4506同事癱瘓后，將其作為核心交換來保證業(yè)務(wù)的正常運作，同時保持原有的網(wǎng)絡(luò)拓撲及網(wǎng)絡(luò)核心的安全策略和qos。3550核心交換配置定義設(shè)備命名hostnameproduction設(shè)備軟件版本使用支持動態(tài)路由協(xié)議的IOS：c3550-i5k2l2q3-mz.121-13.EA1a.binVlan定義1defaultactiveFa0/1,Fa0/2,Fa0/35,Fa0/36Fa0/37,Fa0/38,Fa0/39,Fa0/40Fa0/41,Fa0/42,Fa0/43,Fa0/44Fa0/45,Fa0/46,Fa0/47,Fa0/482vlan0002activeFa0/10,Fa0/21,Fa0/25,Fa0/34Gi0/1,Gi0/23vlan0003activeFa0/5,Fa0/8,Fa0/11,Fa0/12Fa0/17,Fa0/19,Fa0/20,Fa0/22Fa0/28,Fa0/29,Fa0/30,Fa0/324vlan0004activeFa0/13,Fa0/18,Fa0/275vlan0005activeFa0/76vlan0006active10vlan0010activeFa0/4,Fa0/6,Fa0/1420vlan0020active30vlan0030active40vlan0040active50VLAN0050active60VLAN0060active63vlan0063active128vlan0128activeFa0/3,Fa0/24,Fa0/26,Fa0/31Fa0/33195vlan195activeFa0/16,Fa0/23196vlan196active255VLAN0255activeFa0/9,Fa0/15Ip地址分配及hsrpinterfaceVlan1noipaddressnoipredirectsshutdownstandby10priority100standby10preempt!interfaceVlan2ipaddressipaccess-group101innoipredirectsstandby20ipstandby20priority150standby20preempt!interfaceVlan3ipaddressipaccess-group101innoipredirectsstandby30ipstandby30priority150standby30preempt!interfaceVlan4ipaddress692noipredirectsstandby40ip5standby40priority150standby40preempt!interfaceVlan5ipaddress92noipredirectsstandby50ipstandby50priority150standby50preempt!interfaceVlan6noipaddressnoipredirectsshutdownstandby60ipstandby60priority150standby60preempt!interfaceVlan10ipaddressipaccess-group103innoipredirectsstandby100ipstandby100timers515standby100priority200standby100preemptstandby100trackVlan1050!interfaceVlan20noipaddressnoipredirectsstandby110timers515standby110priority150standby110preemptstandby110trackVlan2050!interfaceVlan30noipaddressipaccess-group101innoipredirectsshutdownstandby120ip00standby120timers515standby120priority200standby120preemptstandby120trackVlan3050!interfaceVlan40noipaddressipaccess-group101innoipredirectsshutdownstandby130ip00standby130timers515standby130priority150standby130preemptstandby130trackVlan4050!interfaceVlan50ipaddressiphelper-address0noipredirectsstandby150ipstandby150timers515standby150priority150standby150preemptstandby150trackVlan150!interfaceVlan63noipaddressnoipredirects!interfaceVlan128ipaddressipaccess-group101innoipredirectsstandby160ipstandby160timers515standby160priority150standby160preemptstandby160trackVlan12850!interfaceVlan150noipaddressshutdown!interfaceVlan195ipaddressnoipredirectsstandby195ipstandby195priority150standby195preempt!interfaceVlan196noipaddressnoipredirectsshutdownstandby196ipstandby196priority100standby196preempt!interfaceVlan255ipaddressnoipredirectsstandby255ipstandby255priority200standby255preempt路由策略routereigrp20redistributestaticnetwork55noauto-summarynoeigrplog-neighbor-changesiproute8iproute558iproute11558iproute8iproute8iproute45558iproute555iproute556iproute557iproute1558iproute2558iproute3558iproute4558interfaceVlan2ipaddressipaccess-group101ininterfaceVlan3ipaddressipaccess-group101ininterfaceVlan30noipaddressipaccess-group101ininterfaceVlan40noipaddressipaccess-group101ininterfaceVlan128ipaddressipaccess-group101inaccess-list101permitiphost40host46access-list101permitiphost40host45access-list101denyip5555access-list101denyip5555access-list101denyip5555access-list101denyip5555access-list101denyip5555access-list101denyip5555access-list101permitipanyanyinterfaceVlan10ipaddressipaccess-group103inaccess-list103permitiphost45host0access-list103permitiphost40host0access-list103permitiphost40host46access-list103permitiphost40host45access-list103permitiphost45host8access-list103permitiphost40host8access-list103permitiphost45host2access-list103permitiphost40hostaccess-list103permitiphost1host0access-list103permitip55hostaccess-list103permitip55hostaccess-list103permitip55hostaccess-list103permitip55host0access-list103permitip55host3access-list103permitip55host5access-list103permitip55host6access-list103permitip55host0access-list103permitip55host3access-list103permitip55host3access-list103permitip55host7access-list103permitiphost45host9access-list103permitiphost40host9access-list103denyip5555access-list103denyip5555access-list103denyip5555access-list103denyip5555access-list103denyip5555access-list103denyip5555access-list103permitipanyanyQos作為核心交換機無需在此配置qos安全策略aaanew-modelaaaauthenticationloginspdb-acsgrouptacacs+enableaaaaccountingexecspdb-acsstart-stopgrouptacacs+aaaaccountingcommands0spdb-acsstart-stopgrouptacacs+aaaaccountingcommands1spdb-acsstart-stopgrouptacacs+aaaaccountingcommands2spdb-acsstart-stopgrouptacacs+aaaaccountingcommands3spdb-acsstart-stopgrouptacacs+aaaaccountingcommands4spdb-acsstart-stopgrouptacacs+aaaaccountingcommands5spdb-acsstart-stopgrouptacacs+aaaaccountingcommands6spdb-acsstart-stopgrouptacacs+aaaaccountingcommands7spdb-acsstart-stopgrouptacacs+aaaaccountingcommands8spdb-acsstart-stopgrouptacacs+aaaaccountingcommands9spdb-acsstart-stopgrouptacacs+aaaaccountingcommands10spdb-acsstart-stopgrouptacacs+aaaaccountingcommands11spdb-acsstart-stopgrouptacacs+aaaaccountingcommands12spdb-acsstart-stopgrouptacacs+aaaaccountingcommands13spdb-acsstart-stopgrouptacacs+aaaaccountingcommands14spdb-acsstart-stopgrouptacacs+aaaaccountingcommands15spdb-acsstart-stopgrouptacacs+iptacacssource-interfaceLoopback0tacacs-serverhost7tacacs-serverhost4tacacs-serverkeys9y8loggingtrapdebuggingloggingsource-interfaceLoopback0logging4logging5linevty04exec-timeout50accountingcommands0spdb-acsaccountingcommands1spdb-acsaccountingcommands2spdb-acsaccountingcommands3spdb-acsaccountingcommands4spdb-acsaccountingcommands5spdb-acsaccountingcommands6spdb-acsaccountingcommands7spdb-acsaccountingcommands8spdb-acsaccountingcommands9spdb-acsaccountingcommands10spdb-acsaccountingcommands11spdb-acsaccountingcommands12spdb-acsaccountingcommands13spdb-acsaccountingcommands14spdb-acsaccountingcommands15spdb-acsaccountingexecspdb-acsloginauthenticationspdb-acs網(wǎng)管配置access-list10permit8access-list10permit9access-list10permit6access-list10permit7access-list10permit5snmp-servercommunitypublicROsnmp-servercommunityreadRO10snmp-servertrap-sourceLoopback0snmp-serverenabletrapssnmpauthenticationwarmstartsnmp-serverenabletrapsconfigsnmp-serverenabletrapsentitysnmp-serverenabletrapsrtrsnmp-serverenabletrapsvtpsnmp-serverhost4publicsnmp-serverhost5read其他配置servicetimestampsdebugdatetimelocaltimeshow-timezoneservicetimestampslogdatetimelocaltimeshow-timezoneservicepassword-encryptionnoipdomain-lookupipcefload-sharingalgorithmoriginalclocktimezoneBJT8ntpsourceLoopback0ntpserver0monitorsession1sourcevlan1,10,192rxmonitorsession1destinationinterfaceFa0/5網(wǎng)絡(luò)實施前期準備一、8條交叉線（2條做trunk，6條連向樓層交換機）二、將樓層交換機的fa0/47和48口空出來，并做好相應(yīng)的配置實施步驟第一步：兩臺3550上架并加電啟用（預(yù)計3分鐘）第二步：將連接hp小機的光纖接口連到3550上（預(yù)計1分鐘）cisco4506主的gigabit1/1對應(yīng)3550主的gigabit0/1cisco4506主的gigabit2/2對應(yīng)3550主的gigabit0/2cisco4506備的gigabit1/1對應(yīng)3550主的gigabit0/1cisco4506備的gigabit2/2對應(yīng)3550主的gigabit0/2第三步：將現(xiàn)成的交叉線在3550主備之間互連做ether－channel(預(yù)計1分鐘)3550主的fa0/47對應(yīng)3550備的fa0/473550主的fa0/48對應(yīng)3550備的fa0/48第四步：將連在cisco4506上所有的電口都挪向3550上（預(yù)計5分鐘）cisco4506主的fa2/3對應(yīng)3550主的fa0/3cisco4506主的fa2/4對應(yīng)3550主的fa0/4以此類推cisco4506主的fa2/34對應(yīng)3550主的fa0/34cisco4506備的fa2/3對應(yīng)3550備的fa0/3cisco4506備的fa2/4對應(yīng)3550備的fa0/4以此類推cisco4506備的fa2/34對應(yīng)3550備的fa0/34第五步：3臺樓層交換機與3550之間的互連（預(yù)計3分鐘）3550主的fa0/41對應(yīng)255.15的fa0/473550主的fa0/43對應(yīng)255.16的fa0/473550主的fa0/45對應(yīng)255.17的fa0/473550備的fa0/41對應(yīng)255.15的fa0/483550備的fa0/43對應(yīng)255.16的fa0/483550備的fa0/45對應(yīng)255.17的fa0/48第三方外聯(lián)區(qū)網(wǎng)絡(luò)應(yīng)急第三方業(yè)務(wù)銀聯(lián)區(qū)網(wǎng)絡(luò)應(yīng)急線路故障：發(fā)生故障時，登陸ASA防火墻、交換機、路由器通過showlog,showipintbrie,showinterface,ping,showiproute,showroute等命令來確認相關(guān)接口在故障發(fā)生前和發(fā)生時的狀態(tài)，找出問題線路。如果是內(nèi)部網(wǎng)絡(luò)線路，在線更換的具體操作流程如下：a)用筆記本電腦連接在網(wǎng)絡(luò)設(shè)備的Console上，啟動Console監(jiān)控和記錄；b)準備好存檔的系統(tǒng)配置，備用。如有可能，同時保存當前系統(tǒng)配置；c)對故障模塊上連接的線纜做好標記，小心拔下；d)做好安全接地，插上更換的新網(wǎng)線e)檢查線纜連接狀態(tài)正常；f)確認線纜更換成功。如果是外部線纜，則確認故障后，由XX打保修電話，聯(lián)系聯(lián)通、移動公司人員前來維修。設(shè)備故障：由于銀聯(lián)區(qū)所有的設(shè)備都是雙機熱備，所以一臺發(fā)生故障并不影響業(yè)務(wù)運行。對于配置問題要制定正確的更改配置腳本，備份當前配置以后實施更改；對于硬件問題要練習XX公司，申請硬件故障維修。兩臺設(shè)備故障：使用1臺ASA5540防火墻備份ASA防火墻的配置、使用1臺cisco1841路由器備份連接銀聯(lián)方路由器的配置，任意1臺交換機無需配置用來備份銀聯(lián)區(qū)交換機。ASA防火墻配置：

spdbsyasa#shrun:Saved:ASAVersion8.2(1)!hostnamespdbsyasaenablepassword2KFQnbNIdI.2KYOUencryptedpasswd2KFQnbNIdI.2KYOUencryptednames!interfaceGigabitEthernet0/0speed100duplexfullnameifoutsidesecurity-level0ipaddress8!interfaceGigabitEthernet0/1nameifinsidesecurity-level100ipaddress8!interfaceGigabitEthernet0/2nameifdmzsecurity-level50ipaddress!interfaceGigabitEthernet0/3descriptionLANFailoverInterface!interfaceManagement0/0shutdownnonameifnosecurity-levelnoipaddress!ftpmodepassiveaccess-listIPP_PATextendedpermitiphost1host5access-listIPP_PATextendedpermitiphost2host5access-listIPP_PATextendedpermitiphost3host5access-listIPP_PATextendedpermitiphost1host8access-listIPP_PATextendedpermitiphost2host8access-listIPP_PATextendedpermitiphost3host8access-listOUTSIDE_INextendedpermiticmpanyanyaccess-listOUTSIDE_INextendedpermittcphost1hosteq21428access-listOUTSIDE_INextendedpermittcphost1eq21428hostaccess-listOUTSIDE_INextendedpermittcphost1hosteq23428access-listOUTSIDE_INextendedpermittcphost1eq23428hostaccess-listOUTSIDE_INextendedpermittcphost3hosteq21428access-listOUTSIDE_INextendedpermittcphost3eq21428hostaccess-listOUTSIDE_INextendedpermittcphost3hosteq23428access-listOUTSIDE_INextendedpermittcphost3eq23428hostaccess-listOUTSIDE_INextendedpermittcphost31eq6060host2access-listOUTSIDE_INextendedpermitudp448eqsnmptrapaccess-listOUTSIDE_INextendedpermitudp448eqsyslogaccess-listOUTSIDE_INextendedpermitudphost4eqradiusaccess-listOUTSIDE_INextendedpermitudphost4eqradius-acctaccess-listOUTSIDE_INextendedpermitudphost4eq1812access-listOUTSIDE_INextendedpermitudphost4eq1813access-listOUTSIDE_INextendedpermittcphost4eqtacacsaccess-listOUTSIDE_INextendedpermitudphost7eqradiusaccess-listOUTSIDE_INextendedpermitudphost7eqradius-acctaccess-listOUTSIDE_INextendedpermitudphost7eq1812access-listOUTSIDE_INextendedpermitudphost7eq1813access-listOUTSIDE_INextendedpermittcphost7eqtacacsaccess-listOUTSIDE_INextendedpermitudphost0access-listOUTSIDE_INextendedpermittcphost0access-listINSIDE_OUTextendedpermiticmpanyanyaccess-listINSIDE_OUTextendedpermittcphost1host5eq21428access-listINSIDE_OUTextendedpermittcphost1eq21428host5access-listINSIDE_OUTextendedpermittcphost1host5eq23428access-listINSIDE_OUTextendedpermittcphost1eq23428host5access-listINSIDE_OUTextendedpermittcphost1host8eq21428access-listINSIDE_OUTextendedpermittcphost1eq21428host8access-listINSIDE_OUTextendedpermittcphost1host8eq23428access-listINSIDE_OUTextendedpermittcphost1eq23428host8access-listINSIDE_OUTextendedpermittcphost2host5eq21428access-listINSIDE_OUTextendedpermittcphost2eq21428host5access-listINSIDE_OUTextendedpermittcphost2host5eq23428access-listINSIDE_OUTextendedpermittcphost2eq23428host5access-listINSIDE_OUTextendedpermittcphost2host8eq21428access-listINSIDE_OUTextendedpermittcphost2eq21428host8access-listINSIDE_OUTextendedpermittcphost2host8eq23428access-listINSIDE_OUTextendedpermittcphost2eq23428host8access-listINSIDE_OUTextendedpermittcphost3host5eq21428access-listINSIDE_OUTextendedpermittcphost3eq21428host5access-listINSIDE_OUTextendedpermittcphost3host5eq23428access-listINSIDE_OUTextendedpermittcphost3eq23428host5access-listINSIDE_OUTextendedpermittcphost3host8eq21428access-listINSIDE_OUTextendedpermittcphost3eq21428host8access-listINSIDE_OUTextendedpermittcphost3host8eq23428access-listINSIDE_OUTextendedpermittcphost3eq23428host8access-listINSIDE_OUTextendedpermittcphost45host2eq6060access-listINSIDE_OUTextendedpermitip448anyaccess-listINSIDE_OUTextendedpermitiphost4anyaccess-listINSIDE_OUTextendedpermitiphost7anyaccess-listINSIDE_OUTextendedpermitudphost0anyeqntpaccess-listINSIDE_OUTextendedpermitudphost2anyeqntppagerlines24mtuoutside1500mtuinside1500mtudmz1500failoverfailoverlanunitprimaryfailoverlaninterfacefailoverlanGigabitEthernet0/3failoverpolltimeunitmsec500holdtime5failoverinterfaceipfailoverlanstandbyicmpunreachablerate-limit1burst-size1noasdmhistoryenablearptimeout14400global(outside)2nat(inside)2access-listIPP_PATstatic(inside,outside)tcp21428321428netmask55static(inside,outside)tcp23428323428netmask55static(inside,outside)tcptelnet3telnetnetmask55static(outside,inside)51netmask55static(outside,inside)83netmask55static(inside,outside)245netmask55static(outside,inside)231netmask55static(inside,outside)00netmask55static(inside,outside)22netmask55static(inside,outside)55netmask55static(inside,outside)66netmask55static(inside,outside)77netmask55static(inside,outside)88netmask55static(inside,outside)99netmask55static(inside,outside)44netmask55static(inside,outside)77netmask55access-groupOUTSIDE_INininterfaceoutsideaccess-groupINSIDE_OUTininterfaceinsiderouteoutside15551routeoutside35551routeinside01routeoutside51routeinside44801routeoutside315551timeoutxlate3:00:00timeoutconn1:00:00half-closed0:10:00udp0:02:00icmp0:00:02timeoutsunrpc0:10:00h3230:05:00h2251:00:00mgcp0:05:00mgcp-pat0:05:00timeoutsip0:30:00sip_media0:02:00sip-invite0:03:00sip-disconnect0:02:00timeoutsip-provisional-media0:02:00uauth0:05:00absolutetimeouttcp-proxy-reassembly0:01:00dynamic-access-policy-recordDfltAccessPolicyaaa-serverTACACS+protocoltacacs+aaa-serverRADIUSprotocolradiusaaa-serverspdb-acsprotocoltacacs+aaa-serverspdb-acs(inside)host7keys9y8aaa-serverspdb-acs(inside)host4keys9y9aaaauthenticationsshconsolespdb-acssnmp-serverhostinside5communityreadsnmp-serverhostinside6pollcommunityreadsnmp-serverhostinside7pollcommunityreadsnmp-serverhostinside8pollcommunityreadsnmp-serverhostinside9pollcommunityreadnosnmp-serverlocationnosnmp-servercontactsnmp-servercommunity*****snmp-serverenabletrapssnmpauthenticationlinkuplinkdowncoldstartsnmp-serverenabletrapssyslogcryptoipsecsecurity-associationlifetimeseconds28800cryptoipsecsecurity-associationlifetimekilobytes4608000telnetinsidetelnetinsidetelnettimeout5sshtimeout5consoletimeout0threat-detectionbasic-threatthreat-detectionstatisticsaccess-listnothreat-detectionstatisticstcp-intercept!class-mapinspection_defaultmatchdefault-inspection-traffic!!policy-maptypeinspectdnspreset_dns_mapparametersmessage-lengthmaximum512policy-mapglobal_policyclassinspection_defaultinspectdnspreset_dns_mapinspectftpinspecth323h225inspecth323rasinspectnetbiosinspectrshinspectrtspinspectskinnyinspectesmtpinspectsqlnetinspectsunrpcinspecttftpinspectsipinspectxdmcp!service-policyglobal_policyglobalprompthostnamecontextCryptochecksum:b0171b7af7453023bce0c7ebfafb273e:end

spdbsyasa#路由器配置：R1#shrunBuildingconfiguration...Currentconfiguration:4554bytes!version12.4servicetimestampsdebugdatetimemsecservicetimestampslogdatetimemsecnoservicepassword-encryption!hostnameR1!boot-start-markerboot-end-marker!loggingmessage-countersyslogenablepasswordcisco!aaanew-model!!aaaauthenticationloginspdb-acsgrouptacacs+enableaaaaccountingexecspdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands0spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands1spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands2spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands3spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands4spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands5spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands6spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands7spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands8spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands9spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands10spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands11spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands12spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands13spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands14spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands15spdb-acsaction-typestart-stopgrouptacacs+!!!aaasession-idcommondot11syslogipsource-route!!!!ipcefnoipdomainlookupnoipv6cef!multilinkbundle-nameauthenticated!!!!!!!!!!!!!!!!!!!!!!voice-card0!!!!!archivelogconfighidekeys!!!!!!track1ipsla1reachability!!!!interfaceLoopback0ipaddress5155!interfaceFastEthernet0/0noipaddressshutdownduplexautospeedauto!interfaceFastEthernet0/1noipaddressshutdownduplexautospeedauto!interfaceFastEthernet0/3/0!interfaceFastEthernet0/3/1!interfaceFastEthernet0/3/2!interfaceFastEthernet0/3/3!interfaceSerial0/1/0descriptiontoYinlianipaddress0652ipnatinsideipvirtual-reassemblyencapsulationpppnoshutdownclockrate2000000!interfaceSerial0/1/1noipaddressshutdownclockrate2000000!interfaceVlan1ipaddress0940secondaryipaddress51ipnatoutsideipvirtual-reassemblystandby184ip5standby184priority105standby184preemptstandby184track1decrement10!ipforward-protocolndiproute15505iproute35505iproute8iproute558iproute2558iproute315505noipservernoipsecure-server!!ipnatpoolyinlianpool1010netmaskipnatpoolpospool1313netmaskipnatoutsidesourcelist105poolyinlianpoolipnatoutsidesourcelist106poolpospool!ipsla1icmp-echo05source-interfaceSerial0/1/0frequency5ipslaschedule1lifeforeverstart-timenowaccess-list105permitiphosthost1access-list105permitiphosthost3access-list106permitiphost2host31!!!!!tacacs-serverhost4tacacs-serverhost7tacacs-serverkeys9y8!control-plane!!!!!!!!!!linecon0exec-timeout00loggingsynchronouslineaux0linevty04exec-timeout00passwordciscoaccountingcommands0spdb-acsaccountingcommands1spdb-acsaccountingcommands2spdb-acsaccountingcommands3spdb-acsaccountingcommands4spdb-acsaccountingcommands5spdb-acsaccountingcommands6spdb-acsaccountingcommands7spdb-acsaccountingcommands8spdb-acsaccountingcommands9spdb-acsaccountingcommands10spdb-acsaccountingcommands11spdb-acsaccountingcommands12spdb-acsaccountingcommands13spdb-acsaccountingcommands14spdb-acsaccountingcommands15spdb-acsaccountingexecspdb-acsloggingsynchronousloginauthenticationspdb-acs!schedulerallocate200001000ntpsourceLoopback0ntpserver0endR1#R2#shrunBuildingconfiguration...Currentconfiguration:4533bytes!version12.4servicetimestampsdebugdatetimemsecservicetimestampslogdatetimemsecnoservicepassword-encryption!hostnameR2!boot-start-markerboot-end-marker!loggingmessage-countersyslogenablepasswordcisco!aaanew-model!!aaaauthenticationloginspdb-acsgrouptacacs+enableaaaaccountingexecspdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands0spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands1spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands2spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands3spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands4spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands5spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands6spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands7spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands8spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands9spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands10spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands11spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands12spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands13spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands14spdb-acsaction-typestart-stopgrouptacacs+!aaaaccountingcommands15spdb-acsaction-typestart-stopgrouptacacs+!!!aaasession-idcommonclocktimezoneBJT8dot11syslogipsource-route!!!!ipcefnoipdomainlookupnoipv6cef!multilinkbundle-nameauthenticated!!!!!!!!!!!!!!!!!!!!!!voice-card0!!!!!archivelogconfighidekeys!!!!!!!!!interfaceLoopback0ipaddress5255!interfaceFastEthernet0/0noipaddressduplexautospeedauto!interfaceFastEthernet0/1noipaddressshutdownduplexautospeedauto!interfaceFastEthernet0/3/0!interfaceFastEthernet0/3/1!interfaceFastEthernet0/3/2!interfaceFastEthernet0/3/3!interfaceSerial0/1/0ipaddress1052ipnatinsideipvirtual-reassemblyencapsulationpppnofair-queueclockrate2000000!interfaceSerial0/1/1noipaddressshutdownclockrate2000000!interfaceVlan1ipaddress11secondaryipaddress52ipnatoutsideipvirtual-reassemblystandby184ip5standby184preempt!ipforward-protocolndiproute15509iproute35509iproute8iproute558iproute2558iproute315509noipservernoipsecure-server!!ipnatpoolpospool1313netmaskipnatpoolyinlianpool1010netmaskipnatoutsidesourcelist105poolyinlianpoolipnatoutsidesourcelist106poolpospool!access-list105permitiphosthost1access-list105permitiphosthost3access-list106permitiphost2host31!!!!!tacacs-serverhost7tacacs-serverhost4tacacs-serverkeys9y8!control-plane!!!!!!!!!!linecon0lineaux0linevty04exec-timeout00accountingcommands0spdb-acsaccountingcommands1spdb-acsaccountingcommands2spdb-acsaccountingcommands3spdb-a