| 主要用于局域网的外连设备（如路由器、拨号访问服务器等）与内部网络之间，实现内部网络的安全防范，避免来自外部的恶意攻击。 Cisco PIX 520的默认配置允许从内到外的所有信息请求，拒绝一切外来的主动访问，只允许内部信息的反馈信息进入。当然也可以通过某些设置，例如：访问表等，允许外部的访问。 因为，远程用户的访问需要从外到内的访问。另外，可以通过NAT地址转换，实现公有地址和私有地址的转换。 简单地讲，PIX 520的主要功能有两点： 1.实现网络安全 2.实现地址转换 下面简单列出PIX 520 的基本配置 1.Configure without NAT nameif ethernet0 outside security0 nameif ethernet1 inside security100 interface ethernet0 auto interface ethernet1 auto ip address outside 202.109.77.1 255.255.255.0 (假设对外端口地址) ip address inside 10.1.0.9 255.255.255.0(假设内部网络为:10.1.0.0) hostname bluegarden arp timeout 14400 no failover names pager lines 24 logging buffered debugging nat (inside) 0 0 0 rip inside default no rip inside passive no rip outside default rip outside passive route outside 0.0.0.0 0.0.0.0 202.109.77.2 1(外连设备的内部端口地址) timeout xlate 3:00:00 conn 1:00:00 udp 0:02:00 timeout rpc 0:10:00 h323 0:05:00 timeout uauth 0:05:00 absolute no snmp-server location no snmp-server contact snmp-server community public mtu outside 1500 mtu inside 1500 2.Configure with NAT nameif ethernet0 outside security0 nameif ethernet1 inside security100 interface ethernet0 auto interface ethernet1 auto ip address outside 202.109.77.1 255.255.255.0 (假设对外端口地址) ip address inside 10.1.0.9 255.255.255.0(假设内部网络为:10.1.0.0) hostname bluegarden arp timeout 14400 no failover names pager lines 24 logging buffered debugging nat (inside) 1 0 0 global (outside) 1 202.109.77.10-202.109.77.20 global (outside) 1 202.109.22.21 no rip inside default no rip inside passive no rip outside default no rip outside passive conduit permit icmp any any route outside 0.0.0.0 0.0.0.0 202.109.77.2 1(外连设备的内部端口地址) timeout xlate 3:00:00 conn 1:00:00 udp 0:02:00 timeout rpc 0:10:00 h323 0:05:00 timeout uauth 0:05:00 absolute no snmp-server location no snmp-server contact snmp-server community public mtu outside 1500 mtu inside 1500 |
|Archiver|手机版|家电维修论坛
( 蜀ICP备19011473号-4 川公网安备51102502000164号 )
GMT+8, 2025-5-1 05:13 , Processed in 0.122611 second(s), 18 queries .
Powered by Discuz! X3.5
© 2001-2025 Discuz! Team.
