форумы  помощь  поиск  регистрация  майллист  вход/выход  слежка

Вариант для распечатки		Пред. тема | След. тема
Форумы Маршрутизаторы CISCO и др. оборудование. (Безопасность)
Изначальное сообщение		[ Отслеживать ]

"Помогите с DMZ на Pix"		+/–
Сообщение от eric (??) on 03-Мрт-10, 13:19
name 192.168.0.15 Web access-list acl_dmz permit tcp host Web any eq www access-list acl_inbound permit tcp any host 213.145.149.X eq www ip address dmz 192.168.0.1 255.255.255.0 nat (dmz) 1 192.168.0.0 255.255.255.0 0 0 static (dmz,outside) 213.145.149.X Web netmask 255.255.255.255 0 0 access-group acl_inbound in interface outside access-group acl_outbound in interface inside access-group acl_dmz in interface dmz Изнутри работает, а извне нет... где может быть ошибка? попробовал так access-list acl_dmz permit tcp host Web any eq www и еще так access-list acl_dmz permit tcp host Web eq www any все равно нет. порт вроде прослушивается... Спасибо
Высказать мнение | Ответить | Правка | Cообщить модератору

Сообщения по теме

[Сортировка по времени | RSS]

1. "Помогите с DMZ на Pix"		+/–
Сообщение от GolDi (??) on 03-Мрт-10, 14:17
>[оверквотинг удален] > >и еще так > >access-list acl_dmz permit tcp host Web eq www any > >все равно нет. > >порт вроде прослушивается... > >Спасибо Может так? access-list acl_dmz permit tcp any host Web eq www
Высказать мнение | Ответить | Правка | ^ | Наверх | Cообщить модератору

2. "Помогите с DMZ на Pix"		+/–
Сообщение от and (??) on 04-Мрт-10, 04:14
> >name 192.168.0.15 Web >access-list acl_dmz permit tcp host Web any eq www >access-list acl_inbound permit tcp any host 213.145.149.X eq www >ip address dmz 192.168.0.1 255.255.255.0 >nat (dmz) 1 192.168.0.0 255.255.255.0 0 0 >static (dmz,outside) 213.145.149.X Web netmask 255.255.255.255 0 0 >access-group acl_inbound in interface outside >access-group acl_outbound in interface inside >access-group acl_dmz in interface dmz Строчка > nat (dmz) 1 192.168.0.0 255.255.255.0 0 0 лишняя, поскольку nat работает в паре с global, которого здесь нет. static в nat не нуждается. Все должно заработать.
Высказать мнение | Ответить | Правка | ^ | Наверх | Cообщить модератору

	3. "Помогите с DMZ на Pix"		+/–
	Сообщение от eric (??) on 09-Мрт-10, 08:59
	global (outside) 1 213.145.149.198 global (dmz) 1 192.168.0.10-192.168.0.160 вот так прописал глобал, нат убрал, не работает
	Высказать мнение | Ответить | Правка | ^ | Наверх | Cообщить модератору

	4. "Помогите с DMZ на Pix"		+/–
	Сообщение от GolDi (??) on 09-Мрт-10, 09:37
	> >global (outside) 1 213.145.149.198 >global (dmz) 1 192.168.0.10-192.168.0.160 > >вот так прописал глобал, нат убрал, не работает Там ещё масса примеров http://www.ciscolab.ru/2006/12/06/pix_corporatiive_conf.html
	Высказать мнение | Ответить | Правка | ^ | Наверх | Cообщить модератору

	5. "Помогите с DMZ на Pix"		+/–
	Сообщение от eric (??) on 09-Мрт-10, 13:12
	по каким-то не известным мне причинам заработало... только тот, кто там находится, говорит что он подключил второй интерфейс сервера к локалке и заработало... не могу догнать, почему, помогите разобраться в конфиге, по логике же должен без локалки работать... вот вся конфига : Saved : PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto interface ethernet3 auto interface ethernet4 auto interface ethernet5 auto shutdown nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security30 nameif ethernet3 outside2 security0 nameif ethernet4 intf4 security8 nameif ethernet5 intf5 security10 enable password -------------- encrypted passwd ------------- encrypted hostname pix domain-name ---------- fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 10.0.0.1 pdc name 10.0.0.2 proxy name 10.0.0.3 exchange name 192.168.0.15 Web access-list acl_dmz permit tcp any host Web eq www access-list acl_dmz permit udp host Web any eq domain access-list acl_dmz permit tcp host Web any eq smtp access-list acl_dmz permit tcp host Web any eq www access-list acl_dmz permit tcp host Web any eq pop3 access-list acl_dmz deny ip any any access-list acl_inbound permit tcp host ------------ host 213.145.149.--- eq s                                                                              sh access-list acl_inbound permit icmp any host 213.145.149.---------- echo-reply access-list acl_inbound permit icmp any host 213.145.149.---------- source-quench access-list acl_inbound permit icmp any host 213.145.149.---------- unreachable access-list acl_inbound permit icmp any host 213.145.149.---------- time-exceeded access-list acl_inbound permit udp any host 213.145.149.--- eq domain access-list acl_inbound permit tcp any host 213.145.149.--- eq ssh access-list acl_inbound permit tcp any host 213.145.149.---eq https access-list acl_inbound permit tcp any host 213.145.149.--- eq www access-list acl_inbound deny ip any any access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 10051 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 9091 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 9090 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5269 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5223 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5222 access-list acl_outbound permit ip 10.0.0.0 255.255.255.0 host Web access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq https access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq www access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq smtp access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq pop3 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 995 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq imap4 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 993 access-list acl_outbound permit udp 10.0.0.0 255.255.255.0 any eq domain access-list acl_outbound permit ip host pdc host 192.168.0.2 access-list acl_outbound permit icmp 10.0.0.0 255.255.255.0 any echo access-list acl_outbound permit tcp host proxy any eq www access-list acl_outbound permit tcp host proxy any eq https access-list acl_outbound permit tcp host proxy any eq ftp access-list acl_outbound permit tcp host proxy any range 1024 65535 access-list acl_outbound permit tcp host exchange any eq smtp access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host -------------- access-list acl_outbound permit tcp host exchange any eq pop3 access-list acl_outbound deny ip any any pager lines 24 logging on logging buffered errors logging trap notifications mtu outside 1500 mtu inside 1500 mtu dmz 1500 mtu outside2 1500 mtu intf4 1500 mtu intf5 1500 ip address outside 213.145.149.--- 255.255.255.248 ip address inside 10.0.0.254 255.255.255.0 ip address dmz 192.168.0.1 255.255.255.0 no ip address outside2 no ip address intf4 no ip address intf5 ip audit info action alarm ip audit attack action alarm no failover failover timeout 0:00:00 failover poll 15 no failover ip address outside no failover ip address inside no failover ip address dmz no failover ip address outside2 no failover ip address intf4 no failover ip address intf5 pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 213.145.149.-- global (dmz) 1 192.168.0.20-192.168.0.110 nat (inside) 1 10.0.0.0 255.255.255.0 0 0 nat (dmz) 1 192.168.0.0 255.255.255.0 0 0 static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.255.0 0 0 static (dmz,outside) 213.145.149.--- Web netmask 255.255.255.255 0 0 access-group acl_inbound in interface outside access-group acl_outbound in interface inside access-group acl_dmz in interface dmz route outside 0.0.0.0 0.0.0.0 213.145.149.--- 1 route outside2 10.0.0.0 255.0.0.0 10.1.44.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa authentication ssh console LOCAL http server enable http 192.168.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet timeout 30 ssh ----------- 255.255.255.255 outside ssh proxy 255.255.255.255 inside ssh timeout 60 management-access outside console timeout 0 dhcpd address 10.0.0.100-10.0.0.200 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside dhcpd enable inside username ----------- password ------------- encrypted privilege 2 terminal width 80 Cryptochecksum:---------------------------- : end
	Высказать мнение | Ответить | Правка | ^ | Наверх | Cообщить модератору

	6. "Помогите с DMZ на Pix"		+/–
	Сообщение от eric (??) on 09-Мрт-10, 13:19
	или так, обратите внимание, что hitcnt в acl_dmz везде (hitcnt=0) , получается что через acl_dmz вообще ничего не идет... access-list acl_dmz; 6 elements access-list acl_dmz line 1 permit tcp any host Web eq www (hitcnt=0) access-list acl_dmz line 2 permit udp host Web any eq domain (hitcnt=0) access-list acl_dmz line 3 permit tcp host Web any eq smtp (hitcnt=0) access-list acl_dmz line 4 permit tcp host Web any eq www (hitcnt=0) access-list acl_dmz line 5 permit tcp host Web any eq pop3 (hitcnt=0) access-list acl_dmz line 6 deny ip any any (hitcnt=0) access-list acl_inbound; 10 elements access-list acl_inbound line 1 permit tcp host ------------ host 213.145.149.--- eq ssh (hitcnt=0) access-list acl_inbound line 2 permit icmp any host 213.145.149.------ echo-reply (hitcnt=472) access-list acl_inbound line 3 permit icmp any host 213.145.149.------ source-quench (hitcnt=0) access-list acl_inbound line 4 permit icmp any host 213.145.149.------ unreachable (hitcnt=0) access-list acl_inbound line 5 permit icmp any host 213.145.149.------ time-exceeded (hitcnt=21) access-list acl_inbound line 6 permit udp any host 213.145.149.--- eq domain (hitcnt=0) access-list acl_inbound line 7 permit tcp any host 213.145.149.--- eq ssh (hitcnt=0) access-list acl_inbound line 8 permit tcp any host 213.145.149.--- eq https (hitcnt=41) access-list acl_inbound line 9 permit tcp any host 213.145.149.--- eq www (hitcnt=69) access-list acl_inbound line 10 deny ip any any (hitcnt=2253) access-list acl_outbound; 25 elements access-list acl_outbound line 1 permit tcp 10.0.0.0 255.255.255.0 host Web eq 10051 (hitcnt=0) access-list acl_outbound line 2 permit tcp 10.0.0.0 255.255.255.0 host Web eq 9091 (hitcnt=0) access-list acl_outbound line 3 permit tcp 10.0.0.0 255.255.255.0 host Web eq 9090 (hitcnt=0) access-list acl_outbound line 4 permit tcp 10.0.0.0 255.255.255.0 host Web eq 5269 (hitcnt=0) access-list acl_outbound line 5 permit tcp 10.0.0.0 255.255.255.0 host Web eq 5223 (hitcnt=0) access-list acl_outbound line 6 permit tcp 10.0.0.0 255.255.255.0 host Web eq 5222 (hitcnt=0) access-list acl_outbound line 7 permit ip 10.0.0.0 255.255.255.0 host Web (hitcnt=63) access-list acl_outbound line 8 permit tcp 10.0.0.0 255.255.255.0 host Web eq https (hitcnt=0) access-list acl_outbound line 9 permit tcp 10.0.0.0 255.255.255.0 host Web eq www (hitcnt=22) access-list acl_outbound line 10 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq smtp (hitcnt=0) access-list acl_outbound line 11 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq pop3 (hitcnt=0) access-list acl_outbound line 12 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 995 (hitcnt=0) access-list acl_outbound line 13 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq imap4 (hitcnt=0) access-list acl_outbound line 14 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 993 (hitcnt=0) access-list acl_outbound line 15 permit udp 10.0.0.0 255.255.255.0 any eq domain (hitcnt=479570) access-list acl_outbound line 16 permit ip host pdc host 192.168.0.2 (hitcnt=0) access-list acl_outbound line 17 permit icmp 10.0.0.0 255.255.255.0 any echo (hitcnt=70415) access-list acl_outbound line 18 permit tcp host proxy any eq www (hitcnt=729476) access-list acl_outbound line 19 permit tcp host proxy any eq https (hitcnt=47073) access-list acl_outbound line 20 permit tcp host proxy any eq ftp (hitcnt=8) access-list acl_outbound line 21 permit tcp host proxy any range 1024 65535 (hitcnt=20315) access-list acl_outbound line 22 permit tcp host exchange any eq smtp (hitcnt=1326) access-list acl_outbound line 23 permit tcp 10.0.0.0 255.255.255.0 host 212.42.122.115 (hitcnt=15) access-list acl_outbound line 24 permit tcp host exchange any eq pop3 (hitcnt=30458) access-list acl_outbound line 25 deny ip any any (hitcnt=619340)
	Высказать мнение | Ответить | Правка | ^ | Наверх | Cообщить модератору

Архив | Удалить

Рекомендовать для помещения в FAQ | Индекс форумов | Темы | Пред. тема | След. тема