分享
 
 
 

Two-interface Router With NAT

王朝other·作者佚名  2008-05-31
窄屏简体版  字體: |||超大  

2514 Router

Current configuration:

!

version 12.0

service timestamps debug uptime

service timestamps log uptime

no service passWord-encryption

!

hostname horton

!

enable secret 5 $1$GwRz$YS/82LXSYcgD1d5Nua9Ob1

enable password ww

!

ip subnet-zero

!

ip inspect name ethernetin cuseeme timeout 3600

ip inspect name ethernetin FTP timeout 3600

ip inspect name ethernetin h323 timeout 3600

ip inspect name ethernetin http timeout 3600

ip inspect name ethernetin rcmd timeout 3600

ip inspect name ethernetin realaudio timeout 3600

ip inspect name ethernetin smtp timeout 3600

ip inspect name ethernetin sqlnet timeout 3600

ip inspect name ethernetin streamworks timeout 3600

ip inspect name ethernetin tcp timeout 3600

ip inspect name ethernetin tftp timeout 30

ip inspect name ethernetin udp timeout 15

ip inspect name ethernetin vdolive timeout 3600

!

interface Ethernet0

ip address 20.20.20.2 255.255.255.0

ip Access-group 101 in

no ip directed-broadcast

ip nat inside

ip inspect ethernetin in

!

interface Ethernet1

no ip address

no ip directed-broadcast

shutdown

!

interface Serial0

ip address 150.150.150.1 255.255.255.0

ip access-group 112 in

no ip directed-broadcast

ip nat outside

clockrate 4000000

!

interface Serial1

no ip address

no ip directed-broadcast

shutdown

!

ip nat pool serialzero 150.150.150.3 150.150.150.255 netmask 255.255.255.0

ip nat inside source list 1 pool serialzero

ip classless

ip route 0.0.0.0 0.0.0.0 150.150.150.2

ip route 20.30.30.0 255.255.255.0 20.20.20.1

!

access-list 1 permit 20.0.0.0 0.255.255.255

access-list 101 permit tcp 20.0.0.0 0.255.255.255 any

access-list 101 permit udp 20.0.0.0 0.255.255.255 any

access-list 101 permit icmp 20.0.0.0 0.255.255.255 any

access-list 112 permit icmp any 150.150.150.0 0.0.0.255 unreachable

access-list 112 permit icmp any 150.150.150.0 0.0.0.255 echo-reply

access-list 112 permit icmp any 150.150.150.0 0.0.0.255 packet-too-big

access-list 112 permit icmp any 150.150.150.0 0.0.0.255 time-exceeded

access-list 112 permit icmp any 150.150.150.0 0.0.0.255 traceroute

access-list 112 permit icmp any 150.150.150.0 0.0.0.255 administratively-prohibited

access-list 112 permit icmp any 150.150.150.0 0.0.0.255 echo

access-list 112 permit tcp host 150.150.150.2 host 150.150.150.1 eq telnet

access-list 112 deny ip 127.0.0.0 0.255.255.255 any

access-list 112 deny ip any any

!

line con 0

transport input none

line aux 0

line vty 0 4

password ww

login

!

end

关于ip inspect name

if you deny SMTP mail on the external ACL, no external SMTP servers will ever be able to make a connection to the internal SMTP server.

CBAC is totally independent of access lists - CBAC is associated with ACLs because one function of CBAC is to ensure return traffic of a

session is permitted back to the source - however don't confuse CBAC by thinking ACLs are required. If you apply an inspect list to an interface, inspection takes place, no matter what ACLs are or are not in place. However, remember that ACLs are processed first, so the ACL must allow through the appropriate traffic to be passed thru to the inspection list.

I'm guessing your config would look something like this:

! Internal Interface

Interface e0 ip inspect WEB inbound

! External Interface

Interface e1 ip access-group 100 in

ip inspect SMTP inbound

access-list 100 permit tcp any host x.x.x.x eq smtp

access-list 100 deny ip any any

ip inspect name WEB http

ip inspect name WEB ftp

ip inspect name WEB smtp

ip inspect name WEB tcp

ip inspect name WEB udp

ip inspect name SMTP smtp

On your external ACL, you must have an opening to allow SMTP in - there is no way CBAC can automatically do this for you as traffic is first processed by the ACL and must pass. So once the SMTP traffic is allowed

in, it is passed to the inspection list SMTP, which applys SMTP protocol-based inspection (and opens up any ACLs if necessary - in this

example this function is not required).

Note that in this example you could place the SMTP inspection list on the internal interface in the outbound direction as well. This is a better placement option if you had say a DMZ interface that was also

receiving SMTP mail for the internal SMTP server, as you would only require a single inspection point (outbound on the internal interface)

rather than inbound on the external and DMZ interfaces.

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
2023年上半年GDP全球前十五强
 百态   2023-10-24
美众议院议长启动对拜登的弹劾调查
 百态   2023-09-13
上海、济南、武汉等多地出现不明坠落物
 探索   2023-09-06
印度或要将国名改为“巴拉特”
 百态   2023-09-06
男子为女友送行,买票不登机被捕
 百态   2023-08-20
手机地震预警功能怎么开?
 干货   2023-08-06
女子4年卖2套房花700多万做美容:不但没变美脸,面部还出现变形
 百态   2023-08-04
住户一楼被水淹 还冲来8头猪
 百态   2023-07-31
女子体内爬出大量瓜子状活虫
 百态   2023-07-25
地球连续35年收到神秘规律性信号,网友:不要回答!
 探索   2023-07-21
全球镓价格本周大涨27%
 探索   2023-07-09
钱都流向了那些不缺钱的人,苦都留给了能吃苦的人
 探索   2023-07-02
倩女手游刀客魅者强控制(强混乱强眩晕强睡眠)和对应控制抗性的关系
 百态   2020-08-20
美国5月9日最新疫情:美国确诊人数突破131万
 百态   2020-05-09
荷兰政府宣布将集体辞职
 干货   2020-04-30
倩女幽魂手游师徒任务情义春秋猜成语答案逍遥观:鹏程万里
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案神机营:射石饮羽
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案昆仑山:拔刀相助
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案天工阁:鬼斧神工
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案丝路古道:单枪匹马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:与虎谋皮
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:李代桃僵
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:指鹿为马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:小鸟依人
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:千金买邻
 干货   2019-11-12
 
推荐阅读
 
 
 
>>返回首頁<<
 
靜靜地坐在廢墟上,四周的荒凉一望無際,忽然覺得,淒涼也很美
© 2005- 王朝網路 版權所有