cisco PIX
防火墙虽然产品不同，但策略都差不多。这是我以前公司的防火墙配置，你参考一下。
/＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝/
Welcome to the PIX firewall
Type help or '?' for a list of available commands.
pixfirewall> en
Password: ********
pixfirewall# sh conf
: Saved
:
PIX Version 6.0(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security10
enable password AWscCCgtxtzhawkT encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list ping_acl permit icmp any any
access-list ping_acl permit ip 192.168.0.0 255.255.0.0 any
access-list ping_acl permit tcp 192.168.0.0 255.255.0.0 any eq telnet
access-list ping_acl permit ip 211.144.19.96 255.255.255.240 any
access-list ping_acl permit tcp any host 211.144.19.100 eq www
access-list ping_acl permit tcp host 211.144.19.100 host 211.144.19.99 eq telnet
access-list ping_acl permit tcp any host 211.144.19.99 eq telnet
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 211.144.19.66 eq smtp
access-list acl_out permit tcp any host 211.144.19.100 eq www
access-list acl_out permit tcp any host 211.144.19.66 eq pop3
access-list acl_out permit tcp host 211.144.19.89 host 211.144.19.100 eq ftp
access-list acl_out permit tcp any host 211.144.19.69 eq www
access-list acl_out permit tcp any host 211.144.19.69 eq ftp
access-list acl_out permit tcp any host 211.144.19.69 eq 10000
access-list acl_out permit tcp any host 211.144.19.69 eq 443
access-list acl_out permit tcp any host 211.144.19.68 eq pop3
access-list acl_out permit tcp any host 211.144.19.68 eq smtp
access-list acl_out permit tcp any host 211.144.19.68 eq www
access-list acl_out permit tcp any host 211.144.19.69 eq 22
access-list filter_in deny ip 172.29.0.0 255.255.192.0 any
access-list filter_in deny ip 172.22.2.0 255.255.255.192 any
access-list filter_in permit ip 192.168.5.0 255.255.255.248 any
access-list filter_in permit ip 192.168.5.64 255.255.255.248 any
access-list filter_in permit ip 192.168.5.128 255.255.255.248 any
access-list filter_in permit ip 192.168.5.192 255.255.255.248 any
access-list filter_in permit ip 192.168.6.0 255.255.255.248 any
access-list filter_in permit ip 192.168.6.64 255.255.255.248 any
access-list filter_in permit ip 192.168.6.128 255.255.255.248 any
access-list filter_in permit ip 192.168.6.192 255.255.255.248 any
access-list filter_in permit ip 192.168.7.0 255.255.255.248 any
access-list filter_in permit ip 192.168.7.64 255.255.255.248 any
access-list filter_in permit ip 192.168.7.128 255.255.255.248 any
access-list filter_in permit ip 192.168.7.192 255.255.255.248 any
access-list filter_in permit ip 192.168.8.0 255.255.255.248 any
access-list filter_in permit ip 192.168.8.64 255.255.255.248 any
access-list filter_in permit ip 192.168.8.128 255.255.255.248 any
access-list filter_in permit ip 192.168.8.192 255.255.255.248 any
access-list filter_in permit ip 192.168.9.0 255.255.255.248 any
access-list filter_in permit ip 192.168.9.64 255.255.255.248 any
access-list filter_in permit ip 192.168.9.128 255.255.255.248 any
access-list filter_in permit ip 192.168.9.192 255.255.255.248 any
access-list filter_in permit ip 192.168.10.0 255.255.255.248 any
access-list filter_in permit ip 192.168.10.64 255.255.255.248 any
access-list filter_in permit ip 192.168.10.128 255.255.255.248 any
access-list filter_in permit ip 192.168.10.192 255.255.255.248 any
access-list filter_in permit ip 192.168.11.0 255.255.255.248 any
access-list filter_in permit ip 192.168.11.64 255.255.255.248 any
access-list filter_in permit ip 192.168.11.128 255.255.255.248 any
access-list filter_in permit ip 192.168.11.192 255.255.255.248 any
access-list filter_in permit ip 192.168.12.0 255.255.255.248 any
access-list filter_in permit ip 192.168.12.64 255.255.255.248 any
access-list filter_in permit ip 192.168.12.128 255.255.255.248 any
access-list filter_in permit ip 192.168.12.192 255.255.255.248 any
access-list filter_in permit ip 192.168.13.0 255.255.255.248 any
access-list filter_in permit ip 192.168.13.64 255.255.255.248 any
access-list filter_in permit ip 192.168.13.128 255.255.255.248 any
access-list filter_in permit ip 192.168.13.192 255.255.255.248 any
access-list filter_in permit ip 192.168.14.0 255.255.255.248 any
access-list filter_in permit ip 192.168.14.64 255.255.255.248 any
access-list filter_in permit ip 192.168.14.128 255.255.255.248 any
access-list filter_in permit ip 192.168.14.192 255.255.255.248 any
access-list filter_in permit ip 192.168.15.0 255.255.255.248 any
access-list filter_in permit ip 192.168.15.64 255.255.255.248 any
access-list filter_in permit ip 192.168.15.128 255.255.255.248 any
access-list filter_in permit ip 192.168.15.192 255.255.255.248 any
access-list filter_in permit ip 192.168.16.0 255.255.255.248 any
access-list filter_in permit ip 192.168.16.64 255.255.255.248 any
access-list filter_in permit ip 192.168.16.128 255.255.255.248 any
access-list filter_in permit ip 192.168.16.192 255.255.255.248 any
access-list filter_in permit ip 192.168.17.0 255.255.255.248 any
access-list filter_in permit ip 192.168.17.64 255.255.255.248 any
access-list filter_in permit ip 192.168.17.128 255.255.255.248 any
access-list filter_in permit ip 192.168.17.192 255.255.255.248 any
access-list filter_in permit ip 192.168.18.0 255.255.255.248 any
access-list filter_in permit ip 192.168.18.64 255.255.255.248 any
access-list filter_in permit ip 192.168.18.128 255.255.255.248 any
access-list filter_in permit ip 192.168.18.192 255.255.255.248 any
access-list filter_in permit ip 192.168.19.0 255.255.255.248 any
access-list filter_in permit ip 192.168.19.64 255.255.255.248 any
access-list filter_in permit ip 192.168.19.128 255.255.255.248 any
access-list filter_in permit ip 192.168.19.192 255.255.255.248 any
access-list filter_in permit ip 192.168.20.0 255.255.255.248 any
access-list filter_in permit ip 192.168.20.64 255.255.255.248 any
access-list filter_in permit ip 192.168.20.128 255.255.255.248 any
access-list filter_in permit ip 192.168.20.192 255.255.255.248 any
access-list filter_in permit ip 192.168.21.0 255.255.255.248 any
access-list filter_in permit ip 192.168.21.64 255.255.255.248 any
access-list filter_in permit ip 192.168.21.128 255.255.255.248 any
access-list filter_in permit ip 192.168.21.192 255.255.255.248 any
access-list filter_in permit ip 192.168.22.0 255.255.255.248 any
access-list filter_in permit ip 192.168.22.64 255.255.255.248 any
access-list filter_in permit ip 192.168.22.128 255.255.255.248 any
access-list filter_in permit ip 192.168.22.192 255.255.255.248 any
access-list filter_in permit ip 192.168.23.0 255.255.255.248 any
access-list filter_in permit ip 192.168.23.64 255.255.255.248 any
access-list filter_in permit ip 192.168.23.128 255.255.255.248 any
access-list filter_in permit ip 192.168.23.192 255.255.255.248 any
access-list filter_in permit ip 192.168.24.0 255.255.255.248 any
access-list filter_in permit ip 192.168.24.64 255.255.255.248 any
access-list filter_in permit ip 192.168.24.128 255.255.255.248 any
access-list filter_in permit ip 192.168.24.192 255.255.255.248 any
access-list filter_in permit ip 192.168.25.0 255.255.255.248 any
access-list filter_in permit ip 192.168.25.64 255.255.255.248 any
access-list filter_in permit ip 192.168.25.128 255.255.255.248 any
access-list filter_in permit ip 192.168.25.192 255.255.255.248 any
access-list filter_in permit ip 192.168.26.0 255.255.255.248 any
access-list filter_in permit ip 192.168.26.64 255.255.255.248 any
access-list filter_in permit ip 192.168.26.128 255.255.255.248 any
access-list filter_in permit ip 192.168.26.192 255.255.255.248 any
access-list filter_in permit ip 192.168.27.0 255.255.255.248 any
access-list filter_in permit ip 192.168.27.64 255.255.255.248 any
access-list filter_in permit ip 192.168.27.128 255.255.255.248 any
access-list filter_in permit ip 192.168.27.192 255.255.255.248 any
access-list filter_in permit ip 192.168.28.0 255.255.255.248 any
access-list filter_in permit ip 192.168.28.64 255.255.255.248 any
access-list filter_in permit ip 192.168.28.128 255.255.255.248 any
access-list filter_in permit ip 192.168.28.192 255.255.255.248 any
access-list filter_in permit ip 192.168.29.0 255.255.255.248 any
access-list filter_in permit ip 192.168.29.64 255.255.255.248 any
access-list filter_in permit ip 192.168.29.128 255.255.255.248 any
access-list filter_in permit ip 192.168.29.192 255.255.255.248 any
access-list filter_in permit ip 192.168.30.0 255.255.255.248 any
access-list filter_in permit ip 192.168.30.64 255.255.255.248 any
access-list filter_in permit ip 192.168.30.128 255.255.255.248 any
access-list filter_in permit ip 192.168.30.192 255.255.255.248 any
access-list filter_in permit ip 192.168.31.0 255.255.255.248 any
access-list filter_in permit ip 192.168.31.64 255.255.255.248 any
access-list filter_in permit ip 192.168.31.128 255.255.255.248 any
access-list filter_in permit ip 192.168.31.192 255.255.255.248 any
access-list filter_in permit ip 192.168.32.0 255.255.255.248 any
access-list filter_in permit ip 192.168.32.64 255.255.255.248 any
access-list filter_in permit ip 192.168.32.128 255.255.255.248 any
access-list filter_in permit ip 192.168.32.192 255.255.255.248 any
access-list filter_in permit ip 192.168.33.0 255.255.255.248 any
access-list filter_in permit ip 192.168.33.64 255.255.255.248 any
access-list filter_in permit ip 192.168.33.128 255.255.255.248 any
access-list filter_in permit ip 192.168.33.192 255.255.255.248 any
access-list filter_in permit ip 192.168.34.0 255.255.255.248 any
access-list filter_in permit ip 192.168.34.64 255.255.255.248 any
access-list filter_in permit ip 192.168.34.128 255.255.255.248 any
access-list filter_in permit ip 192.168.34.192 255.255.255.248 any
access-list filter_in permit ip 192.168.35.0 255.255.255.248 any
access-list filter_in permit ip 192.168.35.64 255.255.255.248 any
access-list filter_in permit ip 192.168.35.128 255.255.255.248 any
access-list filter_in permit ip 192.168.35.192 255.255.255.248 any
access-list filter_in permit ip 192.168.36.0 255.255.255.248 any
access-list filter_in permit ip 192.168.36.64 255.255.255.248 any
access-list filter_in permit ip 192.168.36.128 255.255.255.248 any
access-list filter_in permit ip 192.168.36.192 255.255.255.248 any
access-list filter_in permit ip 192.168.37.0 255.255.255.248 any
access-list filter_in permit ip 192.168.37.64 255.255.255.248 any
access-list filter_in permit ip 192.168.37.128 255.255.255.248 any
access-list filter_in permit ip 192.168.37.192 255.255.255.248 any
access-list filter_in permit ip 192.168.38.0 255.255.255.248 any
access-list filter_in permit ip 192.168.38.64 255.255.255.248 any
access-list filter_in permit ip 192.168.38.128 255.255.255.248 any
access-list filter_in permit ip 192.168.38.192 255.255.255.248 any
access-list filter_in permit ip 192.168.39.0 255.255.255.248 any
access-list filter_in permit ip 192.168.39.64 255.255.255.248 any
access-list filter_in permit ip 192.168.39.128 255.255.255.248 any
access-list filter_in permit ip 192.168.39.192 255.255.255.248 any
access-list filter_in permit ip 192.168.40.0 255.255.255.248 any
access-list filter_in permit ip 192.168.40.64 255.255.255.248 any
access-list filter_in permit ip 192.168.40.128 255.255.255.248 any
access-list filter_in permit ip 192.168.40.192 255.255.255.248 any
access-list filter_in permit ip 192.168.41.0 255.255.255.248 any
access-list filter_in permit ip 192.168.41.64 255.255.255.248 any
access-list filter_in permit ip 192.168.41.128 255.255.255.248 any
access-list filter_in permit ip 192.168.41.192 255.255.255.248 any
access-list filter_in permit ip 192.168.42.0 255.255.255.248 any
access-list filter_in permit ip 192.168.42.64 255.255.255.248 any
access-list filter_in permit ip 192.168.42.128 255.255.255.248 any
access-list filter_in permit ip 192.168.42.192 255.255.255.248 any
access-list filter_in permit ip 192.168.43.0 255.255.255.248 any
access-list filter_in permit ip 10.0.0.0 255.0.0.0 any
access-list filter_in permit ip 192.168.255.0 255.255.255.0 any
access-list filter_in permit icmp 10.0.0.0 255.0.0.0 any
access-list filter_in permit icmp 192.168.0.0 255.255.0.0 any
access-list filter_in permit icmp 172.16.0.0 255.240.0.0 any
access-list filter_in permit ip 192.168.253.0 255.255.255.0 any
access-list filter_in permit ip 172.16.0.0 255.240.0.0 any
access-list filter_in permit tcp 192.168.0.0 255.255.0.0 any
pager lines 24
logging on
logging trap debugging
logging history debugging
logging facility 23
logging host inside 192.168.255.222
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 211.144.19.93 255.255.255.224
ip address inside 192.168.255.1 255.255.255.0
ip address dmz 211.144.19.97 255.255.255.240
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 60
global (outside) 1 211.144.19.72-211.144.19.82
global (outside) 1 211.144.19.65
global (dmz) 1 211.144.19.102-211.144.19.109
global (dmz) 1 211.144.19.110
nat (inside) 1 192.168.0.0 255.255.0.0 0 0
nat (inside) 1 172.16.0.0 255.240.0.0 0 0
nat (inside) 1 10.0.0.0 255.0.0.0 0 0
static (inside,outside) 211.144.19.66 192.168.255.2 netmask 255.255.255.255 0 0
static (inside,dmz) 211.144.19.101 192.168.255.2 netmask 255.255.255.255 0 0
static (dmz,outside) 211.144.19.100 211.144.19.100 netmask 255.255.255.255 0 0
static (inside,dmz) 211.144.19.99 10.1.1.100 netmask 255.255.255.255 0 0
static (inside,outside) 211.144.19.69 192.168.255.3 netmask 255.255.255.255 0 0
static (inside,outside) 211.144.19.68 192.168.255.8 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group filter_in in interface inside
access-group ping_acl in interface dmz
route outside 0.0.0.0 0.0.0.0 211.144.19.94 1
route inside 10.0.0.0 255.0.0.0 192.168.255.4 1
route inside 10.100.192.0 255.255.192.0 192.168.255.18 1
route inside 172.16.0.0 255.240.0.0 192.168.255.4 1
route inside 192.168.0.0 255.255.0.0 192.168.255.4 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 192.168.255.0 255.255.255.0 inside
telnet timeout 60
ssh timeout 5
terminal width 80
Cryptochecksum:9cdfdc86dc945a079b40032ef55ad112
pixfirewall#
