防火墙实施策略--最高级防火墙

《防火墙实施策略--最高级防火墙》由会员上传分享，免费在线阅读，更多相关内容在应用文档-天天文库。

1、最高级防火墙（思科pix525防火墙）配置命令：PIX525有三个以太接口，分别接入内网，外网和中间区域。   设置：(pix515只有两个口而且固定的优先级)ePix525#conftPix525(config)#nameifethernet0insidesecurity100Pix525(config)#nameifethernet1dmzsecurity50Pix525(config)#nameifethernet2outsidesecurity0   设置接口工作方式：Pix525(config)#interfaceethernet0autoPix525

2、(config)#interfaceethernet1autoPix525(config)#interfaceethernet2auto设置接口IP地址：Pix525(config)#ipaddressoutside10.1.1.1255.255.255.240Pix525(config)#ipaddressinside172.16.1.2255.255.255.0Pix525(config)#ipaddressdmz172.16.6.1255.255.255.0设置时间：clockset9:0:0152010-5-21指定接口的安全级别：pix525(conf

3、ig)#nameifethernet0outsidesecurity0  #outside是指pix525(config)#nameifethernet0dmzsecurity50 #outside是指外部接口外部接口 pix525(config)#nameifethernet1insidesecurity100#inside是指内部接口路由：routeinside172.16.0.0255.255.0.0172.16.1.21routeoutside10.1.0.0255.255.0.010.1.1.1NAT地址转换：将三部门网络地址分别划成一组,并转换成外部

4、地址 nat(inside)1172.16.3.0255.255.255.0 nat(inside)2172.16.4.0255.255.255.0 nat(inside)3172.16.4.0255.255.255.0 global(outside)110.1.1.1-10.1.1.41netmask255.255.255.0 global(outside)210.1.1.5-10.1.1.8netmask255.255.255.0 global(outside)310.1.1.9-10.1.1.12netmask255.255.255.0设置内（telnet

5、）外部（ssh）用户登录本地服务器或设备命令： telnet172.16.13.110255.255.255.0insidepasswordadminenablepasswordadminssh130.12.1.0255.255.255.0outsideusernamemiaosenpasswordmiaosenaaaauthernacationsshlocal/使用本地认证认证：config#cazeroiseconfig#cagenerateconfig#casave包过滤型防火墙的访问控制表（ACL）配置其他部分访问财务部门策略：禁止www，ftp，smt

6、p允许管理主机访问财务access-list100denytcp172.16.4.0255.255.255.0172.16.3.0255.255.255.0eqftp access-list100denytcp172.16.4.0255.255.255.0172.16.3.0255.255.255.0eqwwwaccess-list100denytcp172.16.4.0255.255.255.0172.16.3.0255.255.255.0eqsmtpaccess-list100denytcp172.16.5.0255.255.255.0172.16.3.02

7、55.255.255.0eqftp access-list100dennytcp172.16.5.0255.255.255.0172.16.3.0255.255.255.0eqwwwaccess-list100denytcp172.16.5.0255.255.255.0172.16.3.0255.255.255.0eqsmtpaccess-list100permittcp172.16.0.0//255.255.0.0172.16.6.0255.255.255.0eqsmtpaccess-list100permittcp172.16.0.0//255.255.0.

8、0172.16.6.02