Cisco pix515e配置

舒畅

　　外网ip  188.188.188.144--151  255.255.255.248
　　广播号：151  网络号：144  网关 145
　　内网二个网段：199.199.199.0 255.255.255.0
　　168.168.0.0  255.255.0.0
　　pix# wr t
　　Building configuration...
　　: Saved
　　:
　　PIX Version 6.3(5)
　　interface ethernet0 auto
　　interface ethernet1 auto
　　nameif ethernet0 outside security0
　　nameif ethernet1 inside security100
　　enable password 8Ry2YjIyt7RRXU24 encrypted
　　passwd u7sKZqFIgmvnwMCU encrypted
　　hostname pix
　　domain-name who.com
　　fixup protocol dns maximum-length 512
　　fixup protocol ftp 21
　　fixup protocol h323 h225 1720
　　fixup protocol h323 ras 1718-1719
　　fixup protocol http 80
　　fixup protocol http 1080
　　fixup protocol pptp 1723
　　fixup protocol rsh 514
　　fixup protocol rtsp 554
　　fixup protocol sip 5060
　　fixup protocol sip udp 5060
　　fixup protocol skinny 2000
　　//去除mailguard防护，外网用pop3才不出问题
　　no fixup protocol smtp 25
　　fixup protocol sqlnet 1521
　　fixup protocol tftp 69
　　names
　　pager lines 24
　　logging on
　　mtu outside 1500
　　mtu inside 1500
　　ip address outside 188.188.188.147 255.255.255.248
　　ip address inside 199.199.199.147 255.255.255.0
　　ip audit info action alarm
　　ip audit attack action alarm
　　no failover
　　failover timeout 0:00:00
　　failover poll 15
　　no failover ip address outside
　　no failover ip address inside
　　pdm logging informational 100
　　pdm history enable
　　arp timeout 14400
　　global (outside) 1 interface
　　global (outside) 1 188.188.188.146
　　nat (inside) 1 0.0.0.0 0.0.0.0 0 0
　　route outside 0.0.0.0 0.0.0.0 188.188.188.145 1
　　route inside 168.168.0.0 255.255.0.0 168.168.55.3 1
　　timeout xlate 3:00:00
　　timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
　　timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
　　timeout sip-disconnect 0:02:00 sip-invite 0:03:00
　　timeout uauth 0:05:00 absolute
　　aaa-server TACACS+ protocol tacacs+
　　aaa-server TACACS+ max-failed-attempts 3
　　aaa-server TACACS+ deadtime 10
　　aaa-server RADIUS protocol radius
　　aaa-server RADIUS max-failed-attempts 3
　　aaa-server RADIUS deadtime 10
　　aaa-server LOCAL protocol local
　　http server enable
　　http 192.168.1.0 255.255.255.0 inside
　　no snmp-server location
　　no snmp-server contact
　　snmp-server community public
　　no snmp-server enable traps
　　floodguard enable
　　telnet 199.199.199.0 255.255.255.0 inside
　　telnet timeout 10
　　ssh timeout 5
　　console timeout 0
　　dhcpd ping_timeout 750

　　terminal>　　静态映射
　　***************************************
　　static (inside,outside) udp 188.188.188.146 8044 199.199.199.1 8044 netmask 255.255.255.255 0 0
　　//
　　static (inside,outside) tcp 188.188.188.146 smtp 199.199.199.151 smtp netmask 255.255.255.255 0 0
　　static (inside,outside) tcp 188.188.188.146 pop3 199.199.199.151 pop3 netmask 255.255.255.255 0 0
　　static (inside,outside) tcp 188.188.188.146 www 199.199.199.151 www netmask 255.255.255.255 0 0
　　static (inside,outside) tcp 188.188.188.146 https 199.199.199.151 https netmask 255.255.255.255 0 0
　　//允许ping命令..
　　conduit permit icmp any any
　　no conduit permit tcp any any
　　no conduit permit udp any any
　　//
　　conduit permit udp host 188.188.188.146 eq 8044 any
　　//
　　conduit permit tcp host 188.188.188.146 eq smtp any
　　conduit permit tcp host 188.188.188.146 eq pop3 any
　　conduit permit tcp host 188.188.188.146 eq www any
　　conduit permit tcp host 188.188.188.146 eq https any
　　访问列表
　　access-list 101 permit ip 199.199.199.1 255.255.255.255 any
　　access-list 101 permit tcp 199.199.199.151 255.255.255.255 any eq 25
　　access-list 101 permit tcp 199.199.199.151 255.255.255.255 any eq 110
　　access-list 101 permit tcp 199.199.199.151 255.255.255.255 any eq 80
　　access-list 101 permit tcp host 199.199.199.249 any range 442 6902
　　access-list 101 permit tcp host 168.168.1.183 any gt 1023
　　access-list 101 permit tcp 168.168.1.104 255.255.255.255 host 61.140.3.66 eq www
　　access-group 101 in interface inside
　　启用pptp和ipsec两种***
　　access-list no-nat permit ip 199.199.199.0 255.255.255.0 199.199.199.0 255.255.255.0
　　//access-list no-nat permit ip 168.168.0.0 255.255.0.0 199.199.199.0 255.255.255.0
　　ip local pool HJY 199.199.199.170-199.199.199.180
　　nat (inside) 0 access-list no-nat
　　sysopt connection permit-ipsec
　　crypto ipsec transform-set AAADES esp-des esp-md5-hmac
　　crypto dynamic-map DYNOMAP 10 set transform-set AAADES
　　crypto map ***PEER 20 ipsec-isakmp dynamic DYNOMAP
　　crypto map ***PEER client authentication LOCALs
　　crypto map ***PEER client configuration address initiate
　　crypto map ***PEER client configuration address respond
　　crypto map ***PEER interface outside
　　isakmp enable outside
　　isakmp key 预定密码**** address 0.0.0.0 netmask 0.0.0.0
　　isakmp client configuration address-pool local HJY outside
　　isakmp policy 10 authentication pre-share
　　isakmp policy 10 encryption des
　　isakmp policy 10 hash md5
　　isakmp policy 10 group 2
　　isakmp policy 10 lifetime 86400
　　***group 预定用户test address-pool HJY

　　***group 预定用户test>　　***group 预定用户test password 预定密码****
　　username 用户1user1 password 用户1密码***
　　username 用户2user2 password 用户2密码***
　　....
　　sysopt connection permit-pptp
　　vpdn group PPTP-VPDN-GROUP accept dialin pptp
　　vpdn group PPTP-VPDN-GROUP ppp authentication chap
　　vpdn group PPTP-VPDN-GROUP ppp authentication mschap
　　vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
　　vpdn group PPTP-VPDN-GROUP client configuration address local HJY
　　vpdn group PPTP-VPDN-GROUP pptp echo 60
　　vpdn group PPTP-VPDN-GROUP client authentication local
　　vpdn enable outside
　　vpdn username 用户pptpuser1 password 密码****
　　vpdn username 用户pptpuser2 password 密码****
　　....
　　Cryptochecksum:e73eb163f54804a716a5f444c09e17bd
　　: end
　　[OK]