配置cisco pix防火墙实现双出口

《配置cisco pix防火墙实现双出口》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、配置CiscoPIX防火墙实现双出口一、用户需求　　用户有一台CiscoPIX515E防火墙，一个网通的出口，一个电信的出口。现在要实现默认都往电信线路出去，而访问网通的网站时使用网通的线路出去。　　二、实现要点　　1、首先要收集网通的IP网段（这个可以在网络上搜索，或者电信的朋友要一份）；　　2、在路由方面，由于CiscoPIX是偏向于防火墙的功能，因此PIX在路由方面是比较弱的无法通过策略路由来实现，在此我使用了默认路由往设成电信的网关，同时添加网通IP网段的静态路由。这样实现了两个出口路由的走向。　　3、在NAT方面，要配置两条NAT，其中一条是通往网通的转换成网通的出口IP，另一条是通

2、往电信的转换成电信的出口IP，这个NAT应该是网通的NAT要配置在电信NAT前面，否则将无法实现。　　三、CiscoPIX双出口配置　　3.1环境描述nameifethernet0outsidesecurity0nameifethernet1insidesecurity100nameifethernet5teloutsidesecurity0ipaddressoutside224.254.14.164255.255.255.0ipaddressinside192.168.0.1255.255.255.0ipaddressteloutside202.99.114.91255.255.255.12

3、8#备注：outside为网通线路出口；teloutside为电信线路出口；inside为内网接口；　　3.2双出口实现　　A、网通IP网段定义object-groupnetworkwtnetworknetwork-object58.16.0.0255.248.0.0network-object58.100.0.0255.254.0.0network-object58.240.0.0255.240.0.0network-object60.0.0.0255.248.0.0network-object60.8.0.0255.252.0.0network-object60.12.0.0255.255

4、.0.0network-object60.13.0.0255.255.192.0network-object60.13.128.0255.255.128.0network-object60.16.0.0255.240.0.0network-object60.24.0.0255.248.0.0network-object60.31.0.0255.255.0.0network-object60.208.0.0255.248.0.0network-object60.216.0.0255.254.0.0network-object60.220.0.0255.252.0.0network-object6

5、1.48.0.0255.252.0.0network-object61.52.0.0255.254.0.0network-object61.54.0.0255.255.0.0network-object61.55.0.0255.255.0.0network-object61.133.0.0255.255.128.0network-object61.134.64.0255.255.192.0network-object61.134.128.0255.255.128.0network-object61.135.0.0255.255.0.0network-object61.136.0.0255.25

6、5.0.0network-object61.138.0.0255.255.128.0network-object61.139.128.0255.255.192.0network-object61.148.0.0255.255.0.0network-object61.149.0.0255.255.0.0network-object61.156.0.0255.255.0.0network-object61.158.0.0255.255.0.0network-object61.159.0.0255.255.192.0network-object61.161.0.0255.255.192.0netwo

7、rk-object61.161.128.0255.255.128.0network-object61.162.0.0255.255.0.0network-object61.163.0.0255.255.0.0network-object61.167.0.0255.255.0.0network-object61.168.0.0255.255.0.0network-object61.176.0.025