完整的pix525配置

　　PIX Version 6.3(3)

　　\\配置接口名称，安全级别，主机名，使用的域名

　　interface ethernet0 100full

　　interface ethernet1 100full

　　interface gb-ethernet0 1000auto

　　interface gb-ethernet1 1000auto

　　nameif ethernet0 cimo security10

　　nameif ethernet1 intf3 security15

　　nameif gb-ethernet0 outside security0

　　nameif gb-ethernet1 inside security100

　　enable password 52network encrypted

　　passwd 52network encrypted

　　hostname PIX-A

　　domain-name 52network.com

　　\\ 配置PIX允许的协议类型，要加密保护的数据流量

　　fixup protocol dnsmaximum-length 512

　　fixup protocol ftp21

　　fixup protocol h323 h225 1720

　　fixup protocol h323 ras 1718-1719

　　fixup protocol http 80

　　fixup protocol ils 389

　　fixup protocol rsh 514

　　fixup protocol rtsp 554

　　fixup protocol sip5060

　　fixup protocol skinny 2000

　　fixup protocol smtp 25

　　fixup protocol splnet 1521

　　fixup protocoltftp 69

　　names

　　access-list inside_outbound_nat0_acl permit ip 202.102.54.0 255.255.255.0 10.0.1.0 255.255.255.0

　　access-list outside_cryptomap_20 permit ip 202.102.54.0 255.255.255.0 10.0.1.0 255.255.255.0

　　\\设置日志服务器，PIX各接口的IP地址，PIX设备的故障切换功能

　　pager lines 24

　　logging timestamp

　　logging standby

　　logging trap informational

　　logging facility 22

　　logging host inside 202.102.54.5

　　mtu cimo 1500

　　mtu intf3 1500

　　mtu outside 1500

　　mtu inside 1500

　　ip address cimo 192.168.0.1 255.255.255.252

　　ip address intf3 127.0.0.1 255.255.255.255

　　ip address outside 202.102.53.6 255.255.255.0

　　ip address inside 202.102.54.1 255.255.255.248

　　ip audit info action alarm

　　ip audit attack action alarm

　　failover

　　failover timeout 0:00:00

　　failover poll 15

　　failover replication http

　　failover ip address shaying 192.168.0.2

　　failover ip address intf3 127.0.0.2

　　failover ip address outside 202.102.53.69

　　failover ip address inside 202.102.54.3

　　failover link shaying

　　\\配置能通过WEB界面管理PIX设备的工作站。

　　pdm location 219.238.213.192 255.255.255.192 outside

　　pdm location 202.102.54.0 255.255.255.0 inside

　　pdm location 202.102.54.28 255.255.255.255 inside

　　pdm location 202.102.54.88 255.255.255.255 inside

　　pdm location 202.102.54.89 255.255.255.255 inside

　　pdm location 202.102.54.90 255.255.255.255 inside

　　pdm location 202.102.54.208 255.255.255.240 inside

　　pdm location 202.102.54.48 255.255.255.240 outside

　　pdm location 202.102.54.48 255.255.255.240 inside

　　pdm location 202.102.54.128 255.255.255.240 inside

　　pdm location 219.238.213.245 255.255.255.255 outside

　　pdm location 10.0.0.0 255.255.255.0 outside

　　pdm location 10.0.1.0 255.255.255.0 outside

　　pdm location 202.102.54.208 255.255.255.240 outside

　　pdm location 172.16.201.0 255.255.255.0 inside

　　pdm location 202.102.54.0 255.255.255.0 outside

　　pdm location 219.239.218.192 255.255.255.192 outside

　　pdm location 219.238.218.248 255.255.255.255 outside

　　pdm location 219.238.218.241 255.255.255.255 outside

　　pdm logging information 100

　　no pdm history enable

　　arp timeout 14400

　　\\配置地址转换，静态路由，双向访问列表，用ACL也可做。

　　nat (inside) 0 access-list inside_outbound_nat0_acl

　　nat (inside)0 202.102.54.0 255.255.255.0 0 0

　　static (inside,outside) 202.102.54.0 202.102.54.0 netmask 255.255.255.0 0 0

　　conduit permit tcp 202.102.54.208 255.255.255.240 ep www any

　　conduit permit udp 202.102.54.208 255.255.255.240 ep domain any

　　conduit permit tcp host 202.102.54.33 eq 15000 any

　　conduit permit tcp host 202.102.54.34 eq 15010 any

　　conduit permit tcp host 202.102.54.33 eq 15010 any

　　conduit permit tcp host 202.102.54.34 eq 15020 any

　　conduit permit tcp host 202.102.54.33 eq 15010 any

　　conduit permit tcp host 202.102.54.34 eq 15000 any

　　conduit permit tcp host 202.102.54.212 eq 1433 220.168.249.64 255.255.255.192

　　conduit permit tcp host 202.102.54.213 eq 1433 220.168.249.64 255.255.255.192

　　conduit permit tcp host 202.102.54.60 eq 1433 220.168.249.64 255.255.255.192

　　conduit permit ip host 202.102.54.35 220.168.249.64 255.255.255.192

　　conduit permit tcp host 202.102.54.214 eq 1433 host 220.168.249.100

　　conduit permit tcp host 202.102.54.214 eq ftp host 220.168.249.100

　　conduit permit tcp host 202.102.54.131 eq 1433 220.168.249.64 255.255.255.192

　　conduit permit tcp host 202.102.54.216 eq ftp host 220.168.249.92

　　conduit permit tcp host 202.102.54.213 eq 81 host 220.168.249.101

　　conduit permit ip host 202.102.54.137 host 220.168.249.100

　　conduit permit tcp host 202.102.54.133 eq www any

　　conduit permit tcp host 202.102.54.132 eq smtp any

　　conduit permit tcp host 202.102.54.132 eq www any

　　conduit permit tcp host 202.102.54.134 eq ftp any

　　conduit permit tcp host 202.102.54.132 eq pop3any

　　conduit permit tcp host 202.102.54.210 eq ftp any

　　conduit permit tcp host 202.102.54.102 eq www any

　　conduit permit tcp host 202.102.54.216 eq www any

　　conduit permit tcp host 202.102.54.217 eq www any

　　conduit permit tcp host 202.102.54.134 eq www any

　　conduit permit tcp host 202.102.54.84 eq 10100 any

　　conduit permit tcp host 202.102.54.221 eq www any

　　conduit permit tcp host 202.102.54.68 eq 10100 any

　　conduit permit tcp host 202.102.54.213 eq 4662 any

　　conduit permit tcp host 202.102.54.213 eq 4672 any

　　conduit permit tcp host 202.102.54.68 eq 4662 any

　　conduit permit tcp host 202.102.54.68 eq 4672 any

　　conduit permit tcp host 202.102.54.213 eq www any

　　conduit permit tcp host 202.102.54.221 eq ftp any

　　conduit permit tcp 202.102.54.48 255.255.255.240 eq 1000 any

　　conduit permit tcp 202.102.54.64 255.255.255.240 eq 1000 any

　　conduit permit tcp 202.102.54.80 255.255.255.240 eq 1000 any

　　conduit deny ip 202.102.54.0 255.255.255.0 63.0.0.0 255.0.0.0

　　conduit deny ip 202.102.54.0 255.255.255.0 210.92.0.0 255.255.0.0

　　conduit permit tcp 202.102.54.0 255.255.255.0 eq ftp host 219.239.218.250

　　conduit permit tcp 202.102.54.0 255.255.255.0 eq 37631 host 219.239.218.250

　　conduit permit udp 202.102.54.0 255.255.255.0 eq 37632 host 219.239.218.250

　　conduit permit tcp 202.102.54.0 255.255.255.0 eq 1433 host 219.239.218.250

　　conduit permit tcp 202.102.54.0 255.255.255.0 eq ssh host 219.238.218.250

　　conduit permit tcp 202.102.54.0 255.255.255.0 eq 11050 host 219.238.218.250

　　conduit permit tcp host 202.102.54.131 eq 8294 host 219.239.218.250

　　conduit permit tcp host 202.102.54.131 eq 3389 host 219.238.218.250

　　conduit permit tcp 202.102.54.0 255.255.255.0 eq 8080 hsot 219.238.218.250

　　conduit permit tcp host 202.102.54.134 range 1500 1600 any

　　conduit permit udp host 202.102.54.134 range 1500 1600 any

　　conduit permit udp host 202.102.54.134 range 4000 6000 any

　　conduit permit tcp host 202.202.54.134 range 4000 6000 any

　　conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.246

　　conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.248

　　conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.249

　　conduit permit ip 202.102.54.0 255.255.255.o host 219.238.218.250

　　conduit permit ip any host 219.234.81.66

　　conduit permit tcp host 202.102.54.75 range 8881 9999 any

　　route outside 0.0.0.0 0.0.0.0 202.102.53.65 1

　　route inside 202.102.54.0 255.255.255.0 202.102.54.2 1

　　\\配置IPSEC，在PIX上设置加密算法，加密的接口

　　timeout xlate 3:00:00

　　timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

　　timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

　　timeout uauth 0:05)00 absolute

　　aaa-server TACACS+ protocol tacacs+

　　aaa-server RADIUS protocol raduis

　　aaa-sever LOCAL protocol local

　　http server enable

　　http 220.168.249.102 255.255.255.255 outside

　　http 219.238.218.192 255.255.255.192 outside

　　no snmp-server location

　　no snmp-server contact

　　snmp-server community public

　　no snmp-server enable traps

　　floodguard enable

　　sysopt connection permit-ipsec

　　crypto ipsec transform-set ESP-3DES-MD5 esp -3des esp -md5-hmac

　　crypto map outside_map 20 ipsec-isakmp

　　crypto map outside_map 20 match address outside_cryptomap_20

　　crypto map outside_map 20 set peer 219.239.218.247

　　crypto map outside_map 20 set transform-set ESP-3DES-MD5

　　crypto map outside_map interface outside

　　\\配置IKE，指定认证的方式为PRE-SHARE。

　　isakmp enable outside

　　isakmp key 52network address 219.239.218.247 netmask 255.255.255.255 no-xauth no-config-mode

　　isakmp identity address

　　isakmp policy 20 authentication pre-share

　　isakmp policy 20 encryption 3des

　　isakmp policy 20 hash md5

　　isakmp policy 20 group 2

　　isakmp policy 20 lifetime 28800

　　其他：

　　telnet timeout 15

　　ssh 220.168.249.105 255.255.255.255 outside

　　ssh 219.238.218.192 255.255.255.192 outside

　　ssh 202.102.54.0 255.255.255.0 inside

　　ssh timeout 15

　　console timeout 0

　　terminal width 80

　　banner exec welcome

　　banner login XXXX Login

　　cryptochecksum:**********************

　　:end