Pix515 firewall Configuration Policy Instance analysis

Requirements: Want to do snat through PIX to make intranet users online, and then do Dnat to access the Internet IP HTTP service, SSH service to 192.168.4.2 HTTP service, SSH service, to 192.168.4.2 Open this pix telnet service

pix515 Firewall Configuration Policy instance

#转换特权用户

Pixfirewall>ena

pixfirewall#

#进入全局配置模式

pixfirewall# conf t

#激活内外端口

Interface Ethernet0 Auto

Interface Ethernet1 Auto

#下面两句配置内外端口的安全级别

Nameif Ethernet0 outside Security0

Nameif Ethernet1 inside security100

#配置防火墙的用户信息

Enable Password pix515

Hostname pix515

Domain-name Domain

#下面几句配置内外网卡的IP地址

IP address inside 192.168.4.1 255.255.255.0

IP address outside public IP network IP subnet mask

Global (outside) 1 interface

Nat (inside) 1 192.168.4.0 255.255.255.0 0 0

#下面两句将定义转发公网IP的ssh和www服务到192.168.4.2

Static (inside,outside) TCP public network IP www 192.168.4.2 www netmask 255.255.255.255 0 0

Static (inside,outside) TCP public network IP ssh 192.168.4.2 ssh netmask 255.255.255.255 0 0

#下面两句将定义外部允许访问内部主机的服务

Conduit permit TCP host public network IP eq www.

Conduit permit TCP host public network IP EQ SSH Trust IP 255.255.255.255

#允许内部服务器telnet pix

Telnet 192.168.4.2 255.255.255.0 inside

#下面这句允许ping

Conduit permit ICMP any

#下面这句路由网关

Route outside 0.0.0.0 0.0.0.0 public network IP Gateway 1

#保存配置

Write memory