Cisco路由器防火墙配置模板

　　show running-config

    version 11.2

　　service timestamps debug datetime msec

　　service timestamps log datetime msec

　　service password-encryption

　　no service udp-small-servers

　　no service tcp-s mall-servers

　　!

　　hostname fw-rtr

　　!

　　enable password cisco

　　!

　　username admin password cisco

　　username chw10.Sydney password cisco

　　no ip source-route

　　ip nat pool inside-pool 203.1.1.2 203.1.1.254 netmask 255.255.255.0

　　ip nat inside source list 99 pool inside-pool

　　ip domain-list domain.com

　　ip domain-name domain.com

　　ip name-server 192.168.1.1

　　ip inspect name internet smtp

　　ip inspect name internet http java-list 42 timeout 60

　　ip inspect name internet ftp

　　ip inspect name internet tcp

　　ip inspect name internet udp

　　ip inspect name internet realaudio

　　ip inspect name internet h323

　　ip inspect name internet cuseeme

　　isdn switch-type basic-net3

　　clock timezone AEST 10

　　!

　　interface Loopback0

　　ip address 203.1.1.1 255.255.255.0

　　!

　　interface Ethernet0

　　ip address 192.168.1.253 255.255.255.0

　　ip nat inside

　　ip route-cache same-interface

　　!

　　interface BRI0

　　no ip address

　　encapsulation ppp

　　dialer pool-member 1

　　no fair-queue

　　ppp authentication chap callin

　　ppp multilink

　　!

　　interface Dialer0

　　description BigPond Dialup Link

　　ip address 139.130.98.32 255.255.254.0

　　ip access-group 169 in

　　ip access-group 158 out

　　no ip unreachables

　　no ip directed-broadcast

　　no ip proxy-arp

　　ip nat outside

　　ip inspect internet out

　　encapsulation ppp

　　dialer remote-name chw10.Sydney

　　dialer idle-timeout 999999

　　dialer string 84486000

　　dialer load-threshold 1 either

　　dialer pool 1

　　dialer-group 1

　　no fair-queue

　　no cdp enable

　　ppp chap hostname anixte0

　　ppp multilink

　　!

　　ip classless

　　ip route 0.0.0.0 0.0.0.0 139.130.98.1

　　ip route 192.168.0.0 255.255.0.0 192.168.1.254

　　ip http server

　　ip http access-class 1

　　logging buffered 16000 debugging

　　logging 192.168.1.1

　　access-list 1 permit 192.168.1.0 0.0.0.255

　　access-list 2 deny any

　　access-list 42 permit any

　　access-list 99 permit 192.168.0.0 0.0.255.255

　　access-list 101 deny udp any any eq rip

　　access-list 101 permit icmp any any

　　access-list 101 permit ip any any

　　access-list 158 permit icmp any any

　　access-list 158 permit udp any any

　　access-list 158 permit tcp any any

　　access-list 158 deny ip any any log-input

　　access-list 159 permit icmp any any

　　access-list 159 permit ip any any

　　access-list 159 permit tcp any any eq smtp

　　access-list 159 permit tcp any any eq www

　　access-list 159 permit tcp any any eq telnet

　　access-list 159 permit tcp any any eq ftp

　　access-list 159 permit tcp any any eq ftp-data

　　access-list 159 permit tcp any any eq domain

　　access-list 159 permit udp any any eq domain

　　access-list 159 permit tcp any any eq 554

　　access-list 159 permit tcp any any eq 7070

　　access-list 159 deny ip any any log-input

　　access-list 169 permit icmp any any

　　access-list 169 permit tcp any any eq smtp

　　access-list 169 permit tcp any any eq www

　　access-list 169 permit tcp any any eq ftp

　　access-list 169 permit tcp any any eq domain

　　access-list 169 permit udp any any eq domain

　　access-list 169 deny ip any any log-input

　　access-list 181 permit tcp any any eq www

　　access-list 181 permit tcp any eq www any

　　access-list 182 permit tcp any any eq ftp-data

　　access-list 182 permit tcp any eq ftp-data any

　　snmp-server community public RO 1

　　snmp-server community private RW 1

　　snmp-server trap-source Ethernet0

　　snmp-server contact Keith Sinclair

　　snmp-server host 192.168.1.1 public

　　dialer-list 1 protocol ip permit

　　dialer-list 2 protocol ip list 101

　　banner motd #

　　#

　　!

　　line con 0

　　login local

　　line vty 0 4

　　access-class 1 in

　　access-class 2 out

　　exec-timeout 15 0

　　login local

　　!

　　end

　　show version

　　Cisco Internetwork Operating System Software

　　IOS (tm) 1600 Software (C1600-OY-L), Version 11.2(17)P, RELEASE SOFTWARE (fc1)

　　Copyright (c) 1986-1999 by cisco Systems, Inc.

　　Compiled Tue 12-Jan-99 14:25 by pwade

　　Image text-base: 0x0801FC84, data-base: 0x02005000

　　ROM: System Bootstrap, Version 11.1(10)AA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc

　　1)

　　ROM: 1600 Software (C1600-BOOT-R), Version 11.1(10)AA, EARLY DEPLOYMENT RELEASE

　　SOFTWARE (fc1)

　　fw-rtr uptime is 4 weeks, 5 hours, 47 minutes

　　System restarted by reload

　　System image file is "flash:c1600-oy-l_112-17_P.bin", booted via flash

　　cisco 1603 (68360) processor (revision C) with 3584K/512K bytes of memory.

　　Processor board ID 07064947, with hardware revision 00000000

　　Bridging software.

　　X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.

　　Basic Rate ISDN software, Version 1.0.

　　1 Ethernet/IEEE 802.3 interface(s)

　　1 ISDN Basic Rate interface(s)

　　System/IO memory with parity disabled

　　2048K bytes of DRAM onboard 2048K bytes of DRAM on SIMM

　　System running from FLASH

　　8K bytes of non-volatile configuration memory.

　　4096K bytes of processor board PCMCIA flash (Read ONLY)

　　Configuration register is 0x2102

　　（责任编辑：城尘 68476636-8003）