完整的pix525配置_中国IT运维网www.cnitom.com_领先的专业IT运维管理网站

PIX Version 6.3(3)
\\配置接口名称，安全级别，主机名，使用的域名

interface ethernet0 100full
interface ethernet1 100full
interface gb-ethernet0 1000auto
interface gb-ethernet1 1000auto
nameif ethernet0 cimo security10
nameif ethernet1 intf3 security15
nameif gb-ethernet0 outside security0
nameif gb-ethernet1 inside security100
enable password 52network encrypted
passwd 52network encrypted
hostname PIX-A
domain-name 52network.com

\\ 配置PIX允许的协议类型，要加密保护的数据流量

fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol splnet 1521
fixup protocoltftp 69
names
access-list inside_outbound_nat0_acl permit ip 202.102.54.0 255.255.255.0 10.0.1.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 202.102.54.0 255.255.255.0 10.0.1.0 255.255.255.0

\\设置日志服务器，PIX各接口的IP地址，PIX设备的故障切换功能


pager lines 24
logging timestamp
logging standby
logging trap informational
logging facility 22
logging host inside 202.102.54.5
mtu cimo 1500
mtu intf3 1500
mtu outside 1500
mtu inside 1500
ip address cimo 192.168.0.1 255.255.255.252
ip address intf3 127.0.0.1 255.255.255.255
ip address outside 202.102.53.6 255.255.255.0
ip address inside 202.102.54.1 255.255.255.248
ip audit info action alarm
ip audit attack action alarm
failover
failover timeout 0:00:00
failover poll 15
failover replication http
failover ip address shaying 192.168.0.2
failover ip address intf3 127.0.0.2
failover ip address outside 202.102.53.69
failover ip address inside 202.102.54.3
failover link shaying

\\配置能通过WEB界面管理PIX设备的工作站。

pdm location 219.238.213.192 255.255.255.192 outside
pdm location 202.102.54.0 255.255.255.0 inside
pdm location 202.102.54.28 255.255.255.255 inside
pdm location 202.102.54.88 255.255.255.255 inside
pdm location 202.102.54.89 255.255.255.255 inside
pdm location 202.102.54.90 255.255.255.255 inside
pdm location 202.102.54.208 255.255.255.240 inside
pdm location 202.102.54.48 255.255.255.240 outside
pdm location 202.102.54.48 255.255.255.240 inside
pdm location 202.102.54.128 255.255.255.240 inside
pdm location 219.238.213.245 255.255.255.255 outside
pdm location 10.0.0.0 255.255.255.0 outside
pdm location 10.0.1.0 255.255.255.0 outside
pdm location 202.102.54.208 255.255.255.240 outside
pdm location 172.16.201.0 255.255.255.0 inside
pdm location 202.102.54.0 255.255.255.0 outside
pdm location 219.239.218.192 255.255.255.192 outside
pdm location 219.238.218.248 255.255.255.255 outside
pdm location 219.238.218.241 255.255.255.255 outside
pdm logging information 100
no pdm history enable
arp timeout 14400

\\配置地址转换，静态路由，双向访问列表，用ACL也可做。


nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside)0 202.102.54.0 255.255.255.0 0 0
static (inside,outside) 202.102.54.0 202.102.54.0 netmask 255.255.255.0 0 0
conduit permit tcp 202.102.54.208 255.255.255.240 ep www any
conduit permit udp 202.102.54.208 255.255.255.240 ep domain any
conduit permit tcp host 202.102.54.33 eq 15000 any
conduit permit tcp host 202.102.54.34 eq 15010 any
conduit permit tcp host 202.102.54.33 eq 15010 any
conduit permit tcp host 202.102.54.34 eq 15020 any
conduit permit tcp host 202.102.54.33 eq 15010 any
conduit permit tcp host 202.102.54.34 eq 15000 any
conduit permit tcp host 202.102.54.212 eq 1433 220.168.249.64 255.255.255.192
conduit permit tcp host 202.102.54.213 eq 1433 220.168.249.64 255.255.255.192
conduit permit tcp host 202.102.54.60 eq 1433 220.168.249.64 255.255.255.192
conduit permit ip host 202.102.54.35 220.168.249.64 255.255.255.192
conduit permit tcp host 202.102.54.214 eq 1433 host 220.168.249.100
conduit permit tcp host 202.102.54.214 eq ftp host 220.168.249.100
conduit permit tcp host 202.102.54.131 eq 1433 220.168.249.64 255.255.255.192
conduit permit tcp host 202.102.54.216 eq ftp host 220.168.249.92
conduit permit tcp host 202.102.54.213 eq 81 host 220.168.249.101
conduit permit ip host 202.102.54.137 host 220.168.249.100
conduit permit tcp host 202.102.54.133 eq www any
conduit permit tcp host 202.102.54.132 eq smtp any
conduit permit tcp host 202.102.54.132 eq www any
conduit permit tcp host 202.102.54.134 eq ftp any
conduit permit tcp host 202.102.54.132 eq pop3 any
conduit permit tcp host 202.102.54.210 eq ftp any
conduit permit tcp host 202.102.54.102 eq www any
conduit permit tcp host 202.102.54.216 eq www any
conduit permit tcp host 202.102.54.217 eq www any
conduit permit tcp host 202.102.54.134 eq www any
conduit permit tcp host 202.102.54.84 eq 10100 any
conduit permit tcp host 202.102.54.221 eq www any
conduit permit tcp host 202.102.54.68 eq 10100 any
conduit permit tcp host 202.102.54.213 eq 4662 any
conduit permit tcp host 202.102.54.213 eq 4672 any
conduit permit tcp host 202.102.54.68 eq 4662 any
conduit permit tcp host 202.102.54.68 eq 4672 any
conduit permit tcp host 202.102.54.213 eq www any
conduit permit tcp host 202.102.54.221 eq ftp any
conduit permit tcp 202.102.54.48 255.255.255.240 eq 1000 any
conduit permit tcp 202.102.54.64 255.255.255.240 eq 1000 any
conduit permit tcp 202.102.54.80 255.255.255.240 eq 1000 any
conduit deny ip 202.102.54.0 255.255.255.0 63.0.0.0 255.0.0.0
conduit deny ip 202.102.54.0 255.255.255.0 210.92.0.0 255.255.0.0
conduit permit tcp 202.102.54.0 255.255.255.0 eq ftp host 219.239.218.250
conduit permit tcp 202.102.54.0 255.255.255.0 eq 37631 host 219.239.218.250
conduit permit udp 202.102.54.0 255.255.255.0 eq 37632 host 219.239.218.250
conduit permit tcp 202.102.54.0 255.255.255.0 eq 1433 host 219.239.218.250
conduit permit tcp 202.102.54.0 255.255.255.0 eq ssh host 219.238.218.250
conduit permit tcp 202.102.54.0 255.255.255.0 eq 11050 host 219.238.218.250
conduit permit tcp host 202.102.54.131 eq 8294 host 219.239.218.250
conduit permit tcp host 202.102.54.131 eq 3389 host 219.238.218.250
conduit permit tcp 202.102.54.0 255.255.255.0 eq 8080 hsot 219.238.218.250
conduit permit tcp host 202.102.54.134 range 1500 1600 any
conduit permit udp host 202.102.54.134 range 1500 1600 any
conduit permit udp host 202.102.54.134 range 4000 6000 any
conduit permit tcp host 202.202.54.134 range 4000 6000 any
conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.246
conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.248
conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.249
conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.250
conduit permit ip any host 219.234.81.66
conduit permit tcp host 202.102.54.75 range 8881 9999 any
route outside 0.0.0.0 0.0.0.0 202.102.53.65 1
route inside 202.102.54.0 255.255.255.0 202.102.54.2 1

\\配置IPSEC，在PIX上设置加密算法，加密的接口


timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05)00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol raduis
aaa-sever LOCAL protocol local
http server enable
http 220.168.249.102 255.255.255.255 outside
http 219.238.218.192 255.255.255.192 outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp -3des esp -md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 219.239.218.247
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside

\\配置IKE，指定认证的方式为PRE-SHARE。


isakmp enable outside
isakmp  key 52network address 219.239.218.247 netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 28800

其他：


telnet timeout 15
ssh 220.168.249.105 255.255.255.255 outside
ssh 219.238.218.192 255.255.255.192 outside
ssh 202.102.54.0 255.255.255.0 inside
ssh timeout 15
console timeout 0
terminal width 80
banner exec welcome
banner login XXXX Login
cryptochecksum:**********************
:end