Cisco PIX防火墙安装流程及安全配置
作者：korn 来源：IT专家网 添加时间：2006-5-26 13:00:2313. 将配置保存:
wr mem
14. 几个常用的网络测试命令:
#ping
#show interface 查看端口状态
#show static 查看静态地址映射
Cisco PIX 520 是一款性能良好的网络安全产品，如果再加上Check Point 的软件防火墙组成两道防护，可以得到更加完善的安全防范。主要用于局域网的外连设备(如路由器、拨号访问服务器等)与内部网络之间，实现内部网络的安全防范，避免来自外部的恶意攻击。
Cisco PIX 520的默认配置允许从内到外的所有信息请求，拒绝一切外来的主动访问，只允许内部信息的反馈信息进入。当然也可以通过某些设置，例如:访问表等，允许外部的访问。因为，远程用户的访问需要从外到内的访问。另外，可以通过NAT地址转换，实现公有地址和私有地址的转换。
简单地讲，PIX 520的主要功能有两点:
1.实现网络安全
2.实现地址转换
下面简单列出PIX 520 的基本配置
1.Configure without NAT
nameif ethernet0 outside security0
nameif ethernet1 inside security100
interface ethernet0 auto
interface ethernet1 auto
ip address outside 202.109.77.1 255.255.255.0 (假设对外端口地址)
ip address inside 10.1.0.9 255.255.255.0(假设内部网络为:10.1.0.0)
hostname bluegarden
arp timeout 14400
no failover
names
pager lines 24
logging buffered debugging
nat (inside) 0 0 0
rip inside default no rip inside passive no rip outside default rip outside passive
route outside 0.0.0.0 0.0.0.0 202.109.77.2 1(外连设备的内部端口地址)
timeout xlate 3:00:00 conn 1:00:00 udp 0:02:00 timeout rpc 0:10:00 h323 0:05:00 timeout uauth 0:05:00 absolute
no snmp-server location no snmp-server contact snmp-server community public
mtu outside 1500 mtu inside 1500
2.Configure with NAT
nameif ethernet0 outside security0
nameif ethernet1 inside security100
interface ethernet0 auto
interface ethernet1 auto
ip address outside 202.109.77.1 255.255.255.0 (假设对外端口地址)
ip address inside 10.1.0.9 255.255.255.0(假设内部网络为:10.1.0.0)
hostname bluegarden
arp timeout 14400
no failover
names
pager lines 24
logging buffered debugging
nat (inside) 1 0 0
global (outside) 1 202.109.77.10-202.109.77.20 global (outside) 1 202.109.22.21
no rip inside default no rip inside passive no rip outside default no rip outside passive
conduit permit icmp any any
route outside 0.0.0.0 0.0.0.0 202.109.77.2 1(外连设备的内部端口地址)
timeout xlate 3:00:00 conn 1:00:00 udp 0:02:00 timeout rpc 0:10:00 h323 0:05:00 timeout uauth 0:05:00 absolute
no snmp-server location no snmp-server contact snmp-server community public
mtu outside 1500 mtu inside 1500
Cisco PIX 的多点服务配置
结构图如下:
PIX 520
Two Interface Multiple Server Configuration
nameif ethernet0 outside security0
nameif ethernet0 inside security100
interface ethernet0 auto
interface ethernet1 auto
ip address inside 10.1.1.1 255.0.0.0
ip address outside 204.31.17.10 255.255.255.0
logging on
logging host 10.1.1.11
logging trap 7
logging facility 20
no logging console
arp timeout 600
nat (inside) 1 10.0.0.0 255.0.0.0
nat (inside) 2 192.168.3.0 255.255.255.0
global (outside) 1 204.31.1.25-204.31.17.27
global (outside) 1 204.31.1.24
global (outside) 2 192.159.1.1-192.159.1.254
conduit permit icmp any any
outbound 10 deny 192.168.3.3 255.255.255.255 1720
outbound 10 deny 0 0 80
outbound 10 permit 192.168.3.3 255.255.255.255 80
outbound 10 deny 192.168.3.3 255.255.255.255 java
outbound 10 permit 10.1.1.11 255.255.255.255 80
apply (inside) 10 outgoing_src
no rip outside passive
no rip outside default
rip inside passive
rip inside default
route outside 0 0 204.31.17.1.1
tacacs-server host 10.1.1.12 lq2w3e
aaa authentication any inside 192.168.3.0 255.255.255.0 0 0 tacacs+
aaa authentication any inside 192.168.3.0 255.255.255.0 0 0
static (inside,outside) 204.31.19.0 192.168.3.0 netmask 255.255.255.0
conduit permit tcp 204.31.19.0 255.255.255.0 eg h323 any
static (inside,outside) 204.31.17.29 10.1.1.11
conduit permit tcp host 204.31.17.29 eq 80 any
conduit permit udp host 204.31.17.29 eq rpc host 204.31.17.17
conduit permit udp host 204.31.17.29 eq 2049 host 204.31.17.17
static (inside.outside) 204.31.1.30 10.1.1.3 netmask 255.255.255.255 10 10
conduit permit tcp host 204.31.1.30 eq smtp any
conduit permit tcp host 204.31.1.30 eq 113 any
snmp-server host 192.168.3.2
snmp-server location building 42
snmp-server contact polly hedra
snmp-server community ohwhatakeyisthee
telnet 10.1.1.11 255.255.255.255
telnet 192.168.3.0 255.255.255.0
CISCOPIX防火墙配置实践——介绍一个PIX防火墙实际配置案例，因为路由器的配置在安全性方面和PIX防火墙是相辅相成的，所以路由器的配置实例也一并列出。