刚调试完的一台ASA,与大家共享,

network

刚调试完的一台ASA,与大家共享,

ASA Version 7.0(7)
!
hostname ciscoasa
domain-name cisco
enable password Zcyi/C7ylCZi5MSY encrypted
names
dns-guard
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 120.200.253.98 255.255.255.240
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 172.16.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list 10 extended permit icmp any any
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
asdm image disk0:/asdm-507.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group 10 in interface outside
route outside 0.0.0.0 0.0.0.0 120.200.253.91 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username deling password JeCDFkC1HJKcdS4s encrypted privilege 15
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd address 172.16.1.2-172.16.1.254 inside
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd dns 202.106.0.20
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:414c184d8d80123409c9f00a15815e9c
: end
无法上传图片,拓扑就不传了,很简单的用应


一下是PIX的一个配置模板

PIX Version 6.3(1)
　　interface ethernet0 auto 设定端口0 速率为自动
　　interface ethernet1 100full 设定端口1 速率为100兆全双工
　　interface ethernet2 auto 设定端口2 速率为自动
　　nameif ethernet0 outside security0 设

定端口0 名称为 outside 安全级别为0
　　nameif ethernet1 inside security100 设定端口1 名称为 inside 安全级别为100
　　nameif ethernet2 dmz security50 设定端口2 名称为 dmz 安全级别为50
　　enable password Dv0yXUGPM3Xt7xVs encrypted 特权密码
　　passwd 2KFQnbNIdI.2KYOU encrypted 登陆密码
　　hostname hhyy 设定防火墙名称
　　fixup protocol ftp 21
　　fixup protocol h323 h225 1720
　　fixup protocol h323 ras 1718-1719
　　fixup protocol http 80
　　fixup protocol ils 389
　　fixup protocol rsh 514
　　fixup protocol rtsp 554
　　fixup protocol sip 5060
　　fixup protocol sip udp 5060
　　no fixup protocol skinny 2000
　　fixup protocol smtp 25
　　fixup protocol sqlnet 1521
　　允许用户查看、改变、启用或禁止一个服务或协议通过PIX防火墙，防火墙默认启用了一些常见的端口，但对于ORACLE等专有端口，需要专门启用。
　　names
　　access-list 101 permit ip 192.168.99.0 255.255.255.0 192.168.170.0 255.255.255.0
　　access-list 101 permit ip 192.168.12.0 255.255.255.0 192.168.180.0 255.255.255.0
　　access-list 101 permit ip 192.168.23.0 255.255.255.0 192.168.180.0 255.255.255.0
　　access-list 101 permit ip 192.168.99.0 255.255.255.0 192.168.101.0 255.255.255.0
　　建立访问列表，允许特定网段的地址访问某些网段
　　access-list 120 deny icmp 192.168.2.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.3.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.4.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.5.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.6.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.7.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.8.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.9.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.10.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.11.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.12.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.13.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.14.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.15.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.16.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.17.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.18.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.19.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.20.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.21.0 255.255.255.0 any
　　access-list 120 deny icmp 192.168.22.0 255.255.255.0 any
　　access-list 120 deny udp any any eq netbios-ns
　　access-list 120 deny udp any any eq netbios-dgm
　　access-list 120 deny udp any any eq 4444
　　access-list 120 deny udp any any eq 1205
　　access-list 120 deny udp any any eq 1209
　　access-list 120 deny tcp any any eq 445
　　access-list 120 deny tcp any any range 135 netbios-ssn
　　access-list 120 permit ip any any
　　建立访问列表120防止各个不同网段之间的ICMP发包及拒绝135、137等端口之间的通信（主要防止冲击波病毒）
　　access-list 110 permit ip 192.168.99.0 255.255.255.0 192.168.101.0 255.255.255.0
　　pager lines 24
　　logging on
　　logging monitor debugging
　　logging buffered debugging
　　logging trap notifications
　　mtu outside 1500
　　mtu inside 1500
　　mtu dmz 1500
　　ip address outside 10.1.1.4 255.255.255.224 设定外端口地址
　　ip address inside 192.168.1.254 255.255.255.0 设定内端口地址
　　ip address dmz 192.168.19.1 255.255.255.0 设定DMZ端口地址
　　ip audit info action alarm
　　ip audit attack action alarm
　　ip local pool hhyy 192.168.170.1-192.168.170.254
　　建立名称为hhyy的地址池，起始地址段为：192.168.170.1-192.168.170.254
　　ip local pool yy 192.168.180.1-192.168.180.254
　　建立名称为yy 的地址池，起始地址段为：192.168.180.1-192.168.180.254
　　no failover
　　failover timeout 0:00:00
　　failover poll 15
　　no failover ip address outside
　　no failover ip address inside
　　no failover ip address dmz
　　no pdm history enable
　　arp timeout 14400