PIX 一例

　　PIX Version 5.1(2)

　　nameif ethernet0 outside security0

　　nameif ethernet1 inside security100

　　nameif ethernet2 dmz security10

　　enable password 8Ry2YjIyt7RRXU24 encrypted

　　passwd 2KFQnbNIdI.2KYOU encrypted

　　hostname pixfirewall

　　fixup protocol ftp21

　　fixup protocol http 80

　　fixup protocol h323 1720

　　fixup protocol rsh 514

　　fixup protocol smtp 25

　　fixup protocol sqlnet 1521

　　names

　　pager lines 24

　　logging on

　　no logging timestamp

　　no logging standby

　　no logging console

　　no logging monitor

　　no logging buffered

　　logging trap debugging

　　no logging history

　　logging facility 20

　　logging queue 512

　　logging host inside 10.1.1.55

　　interface ethernet0 10baset

　　interface ethernet1 10baset

　　interface ethernet2 100full

　　mtu outside 1500

　　mtu inside 1500

　　mtu DMZ 1500

　　ip address outside 209.165.200.225 255.255.255.224

　　ip address inside 10.1.1.1 255.255.255.0

　　ip address DMZ 172.16.31.1 255.255.255.0

　　no failover

　　failover timeout 0:00:00

　　failover ip address outside 0.0.0.0

　　failover ip address inside 0.0.0.0

　　failover ip address DMZ 0.0.0.0

　　arptimeout 14400

　　global (outside) 1 209.165.200.228-209.165.200.253 netmask 255.255.255.224

　　global (outside) 1 209.165.200.254

　　nat(inside) 1 10.1.1.0 255.255.255.0 0 0

　　!--- This network static does not use address translation.

　　!--- Inside hosts appear on the DMZ with their own addresses.

　　static (inside,DMZ) 10.1.1.0 10.1.1.0 netmask 255.255.255.0 0 0

　　!--- This network static does use address translation.

　　!--- Hosts accessing the mail serverfrom the outside

　　!--- use the 209.165.200.227 address.

　　static (DMZ,outside) 209.165.200.227 172.16.31.10 netmask 255.255.255.255 0 0

　　conduit permit tcp host 209.165.200.227 eq smtp any

　　route outside 0.0.0.0 0.0.0.0 209.165.200.226 1

　　timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00

　　timeout rpc 0:10:00 h323 0:05:00

　　timeout uauth 0:05:00 absolute

　　aaa-server TACACS+ protocol tacacs+

　　aaa-server RADIUS protocol radius

　　no snmp-server location

　　no snmp-server contact

　　snmp-server community public

　　no snmp-server enable traps

　　floodguard enable

　　crypto map mymap 30 ipsec-isakmp

　　isakmp identity hostname

　　telnettimeout 5

　　terminal width 80

　　Cryptochecksum:f79e39120fb2cd4e05553467aa73926d

　　: end