在pix或asa如何防止内网用户乱改ip配置案例

《在pix或asa如何防止内网用户乱改ip配置案例》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、在pix或asa如何防止内网用户乱改ip配置案例～教育资源库　　防止内网用户乱该ip地址，用户只能用给定的ip，如果改ip地址，则无法访问网络资源。　　例如：做了下述配置后(arpinside10.64.64.29000f.b0d8.a504)，mac地址为000f.b0d8.a504的pc只能使用ip10.64.64.29来访问网络资源，如果该ip则无法访问。pix515e#shrun:Saved:PIXVersion7.2(1)!hostnamepix515edomain-nameciscoenablepassesname10.64.64.113c

2、hengxiaojiename10.64.64.13dhcpname10.64.64.71liuyongjunname10.64.64.72liuyongjun-ibmname10.64.64.39lixiaoliangname10.64.64.103lixuesongname10.64.64.17lulianyingname10.64.64.92qizuomengname10.64.64.69e10.64.64.105xingzhonghename10.64.64.45tanjunname10.64.64.108zhangyiname10.64.64

3、.178hujianname10.64.64.93ibm220name10.64.64.62jilingname10.64.64.111yangliuname10.64.64.112e10.64.64.158e10.64.64.52lishihainame10.64.64.78office-teachername10.64.64.48yangjinname10.64.64.104e10.64.64.63zangdongname10.64.64.80xiaoguangyuename10.64.64.14ibm235name10.64.64.222lixu

4、esong-dellname10.64.64.75maxiaopengname10.64.64.215lintaoname10.64.64.199machiname10.64.64.216liuxuesongname10.64.64.246jiachangjingname10.64.64.61chufeifoutsidesecurity-level0ipaddressX.X.76.26255.255.255.0!interfaceEther1nameifinsidesecurity-level100ipaddress10.64.64.2255.255.

5、240.0!interfaceEther2nameifdmzsecurity-level80ipaddress192.168.0.1255.255.255.0!passe-rangeeperiodicdaily8:00to17:00!ftpmodepassiveclocktimezoneCST8dnsdomain-lookupoutsidednsserver-groupDefaultDNSname-server219.150.32.132domain-namecisco　　做object-group以便在acl里被调用（注：object-group是个

6、好东东，可以大大简化acl的配置）****************************************************object-groupaxiaopengeetingtcp1234下一页友情提醒：，特别！port-objectrange15031503port-objectrangeh323h323object-groupeachiiticmpanyanyecho-replyaccess-listoutside_access_inextendedpermittcpanyanyobject-groupmeeting　　调用上述的

7、object-group到acl****************************************************access-listinside_access_inextendeddenyipany192.168.0.0255.255.255.0access-listinside_access_inextendedpermitipobject-groupcaiitipobject-groupanyaccess-listinside_access_inextendedpermitipobject-groupguestanyina

8、ctiveaccess-listinside_access_inextendeddenytcp