×

Loading...
Ad by
  • 推荐 OXIO 加拿大高速网络，最低月费仅$40. 使用推荐码 RCR37MB 可获得一个月的免费服务
Ad by
  • 推荐 OXIO 加拿大高速网络，最低月费仅$40. 使用推荐码 RCR37MB 可获得一个月的免费服务

@

我也是这样想啊！谢谢你回复。这还有一个问题关于PIX和VPN的问题。

8221129(8221129)
本文发表在 rolia.net 枫下论坛PIX用在分公司，和INTERNET连接。现在做了VPN连接总公司。现在不能上网了，不知道问题在哪里和如何修改。下面是具体配置。谢谢先！
interface ethernet0 10baset
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password <skipped> encrypted
passwd <skipped> encrypted
hostname ScarPix
domain-name dscltd.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.7.0.0 TCA-Main
name 10.0.0.0 Lang
access-list in_out_nat0_acl permit ip 192.168.255.0 255.255.255.240 Lang 255.255.0.0
access-list in_out_nat0_acl permit ip 192.168.255.0 255.255.255.240 TCA-Main 255.255.0.0
access-list out_crypto_20 permit ip 192.168.255.0 255.255.255.240 Lang 255.255.0.0
access-list out_crypto_20 permit ip 192.168.255.0 255.255.255.240 TCA-Main 255.255.0.0
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside pppoe setroute
ip address inside 192.168.255.2 255.255.255.240
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
nat (inside) 0 access-list in_out_nat0_acl
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 10.0.250.170 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map out_map 20 ipsec-isakmp
crypto map out_map 20 match address out_crypto_20
crypto map out_map 20 set peer 209.135.126.147
crypto map out_map 20 set transform-set ESP-3DES-SHA
crypto map out_map interface outside
isakmp enable outside
isakmp key ******** address 209.135.126.147 netmask 255.255.255.255 no-xauth no-config-mode
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
telnet timeout 5
ssh 209.202.119.2 255.255.255.255 outside
ssh timeout 5
console timeout 0
vpdn group Bell request dialout pppoe
vpdn group Bell localname <skipped>
vpdn username <skipped> password *********
dhcpd address 192.168.255.8-192.168.255.14 inside
dhcpd wins 10.0.0.3
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain dscltd.com
dhcpd auto_config outside
username <skipped> password <skipped> encrypted privilege 15
terminal width 80
Cryptochecksum:e62b274f3c900e2a451d81748f320df0
: end更多精彩文章及讨论，请光临枫下论坛 rolia.net
(#2880324@0)
Last Updated: 2006-4-2
This post has been archived. It cannot be replied.
Report

Replies, comments and Discussions:

  • 工作学习 / 专业知识杂谈 / 关于PIX对应2个VLAN的问题 -8221129(8221129); 2006-4-1 {319} (#2877901@0)
    关于PIX对应2个VLAN的问题
    我现在有PIX515和2950一台。要求支持2个子网地址，而且这个网段的地址能够互通和上网。我的想法是在2950上面设置2个VLAN分别对于2个网段。PIX2个端口，一个对应INTERNET网，另外一个设成SUBINTERFACE对应2个网段，不知道这样行不行。如果PIX有3 个端口，就2个端口分别对于2个VLAN。不知道这个想法如何。谢谢大家指教
    • pix support trunk interface -ccie_sec(ciscoguy); 2006-4-1 (#2877925@0)
      • 对的，我看了CISCO网站也是这样的。http:、/www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172786.html#wp1113437是关于VLAN的配置的介绍。我想问如果一个内网端口 -8221129(8221129); 2006-4-1 {281} (#2878184@0)
        对的，我看了CISCO网站也是这样的。http:、/www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172786.html#wp1113437是关于VLAN的配置的介绍。我想问如果一个内网端口，我设置一个物理地址和逻辑地址就可以对应2个网段了，如果有2个内网端口，如果设置啊
        • 那不是更简单乐。 两个内网端口对应两个vlan呗。 用每个内网端口地址作为两个vlan的default gateway. switch上联pix的两个端口用access mode. -dennis2000(dennis2000); 2006-4-2 (#2880296@0)
          • 我也是这样想啊！谢谢你回复。这还有一个问题关于PIX和VPN的问题。 -8221129(8221129); 2006-4-2 {3121} (#2880324@0)
            本文发表在 rolia.net 枫下论坛PIX用在分公司，和INTERNET连接。现在做了VPN连接总公司。现在不能上网了，不知道问题在哪里和如何修改。下面是具体配置。谢谢先！
            interface ethernet0 10baset
            interface ethernet1 100full
            nameif ethernet0 outside security0
            nameif ethernet1 inside security100
            enable password <skipped> encrypted
            passwd <skipped> encrypted
            hostname ScarPix
            domain-name dscltd.com
            fixup protocol dns maximum-length 512
            fixup protocol ftp 21
            fixup protocol h323 h225 1720
            fixup protocol h323 ras 1718-1719
            fixup protocol http 80
            fixup protocol ils 389
            fixup protocol rsh 514
            fixup protocol rtsp 554
            fixup protocol sip 5060
            fixup protocol sip udp 5060
            fixup protocol skinny 2000
            fixup protocol smtp 25
            fixup protocol sqlnet 1521
            fixup protocol tftp 69
            names
            name 10.7.0.0 TCA-Main
            name 10.0.0.0 Lang
            access-list in_out_nat0_acl permit ip 192.168.255.0 255.255.255.240 Lang 255.255.0.0
            access-list in_out_nat0_acl permit ip 192.168.255.0 255.255.255.240 TCA-Main 255.255.0.0
            access-list out_crypto_20 permit ip 192.168.255.0 255.255.255.240 Lang 255.255.0.0
            access-list out_crypto_20 permit ip 192.168.255.0 255.255.255.240 TCA-Main 255.255.0.0
            pager lines 24
            logging on
            mtu outside 1500
            mtu inside 1500
            ip address outside pppoe setroute
            ip address inside 192.168.255.2 255.255.255.240
            ip audit info action alarm
            ip audit attack action alarm
            pdm history enable
            arp timeout 14400
            nat (inside) 0 access-list in_out_nat0_acl
            timeout xlate 3:00:00
            timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
            timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
            timeout uauth 0:05:00 absolute
            aaa-server TACACS+ protocol tacacs+
            aaa-server RADIUS protocol radius
            aaa-server LOCAL protocol local
            aaa authentication telnet console LOCAL
            aaa authentication ssh console LOCAL
            http server enable
            http 10.0.250.170 255.255.255.255 inside
            no snmp-server location
            no snmp-server contact
            snmp-server community public
            no snmp-server enable traps
            floodguard enable
            sysopt connection permit-ipsec
            crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
            crypto map out_map 20 ipsec-isakmp
            crypto map out_map 20 match address out_crypto_20
            crypto map out_map 20 set peer 209.135.126.147
            crypto map out_map 20 set transform-set ESP-3DES-SHA
            crypto map out_map interface outside
            isakmp enable outside
            isakmp key ******** address 209.135.126.147 netmask 255.255.255.255 no-xauth no-config-mode
            isakmp policy 20 authentication pre-share
            isakmp policy 20 encryption 3des
            isakmp policy 20 hash sha
            isakmp policy 20 group 2
            isakmp policy 20 lifetime 86400
            telnet timeout 5
            ssh 209.202.119.2 255.255.255.255 outside
            ssh timeout 5
            console timeout 0
            vpdn group Bell request dialout pppoe
            vpdn group Bell localname <skipped>
            vpdn username <skipped> password *********
            dhcpd address 192.168.255.8-192.168.255.14 inside
            dhcpd wins 10.0.0.3
            dhcpd lease 3600
            dhcpd ping_timeout 750
            dhcpd domain dscltd.com
            dhcpd auto_config outside
            username <skipped> password <skipped> encrypted privilege 15
            terminal width 80
            Cryptochecksum:e62b274f3c900e2a451d81748f320df0
            : end更多精彩文章及讨论，请光临枫下论坛 rolia.net
            • nat (inside) 1 0 0 global (outside) 1 interface -shapei(沙皮狗); 2006-4-2 (#2880376@0)
              • 你是说没有GOLBAL语句和NAT对应？ -8221129(8221129); 2006-4-2 (#2880401@0)
                • PIX works purely on the NAT table -shapei(沙皮狗); 2006-4-2 {227} (#2880433@0)
                  , so check your NAT table see if traffic is defined or not, if some traffic does not need NAT, using NAT 0 (identical NAT) or NAT 0 access-list (excempt NAT), to understand how PIX works, suggest you buying a PIX, 501 is enough
                  • u right, i set nat and global this time.thank you 老沙 Just add nat (inside) 1 0 0 global (outside) 1 interface -8221129(8221129); 2006-4-2 (#2880472@0)

More Topics

  • For those of you, who don’t believe that we have technology to control the weather or cause earth quacks, please watch this video.
  • 美国考古博士生分析激光雷达数据发现失踪的千年玛雅古城
  • Yann LeCun最新公开表示：今年诺贝尔奖颁给AI，是诺奖委员会感到压力的结果，需要承认深度学习的影响。化学奖塞不下更多人，所以只能选了物理, 颁给Hinton和Hopefield勉强合理. 获奖成果玻尔兹曼机和Hopefield网络现在完全无用(completely useless)。
  • Nobel Prize-Winner on AI 'Existential Threat' 辛顿认为我们也许很快就失去对AI的控制。这东西在20年内可能超过人类。
  • CO2 is known as the gas of life according to this Harvard professor - the more CO2 we have the more life there can be on the planet.
    • 枫下论坛主坛 /  工作学习 /  专业知识杂谈