URL: https://www.opennet.me/cgi-bin/openforum/vsluhboard.cgi
Форум: vsluhforumID6
Нить номер: 20609
[ Назад ]
Исходное сообщение
"Помогите с DMZ на Pix"
Отправлено eric , 03-Мрт-10 13:19 

name 192.168.0.15 Web
access-list acl_dmz permit tcp host Web any eq www
access-list acl_inbound permit tcp any host 213.145.149.X eq www
ip address dmz 192.168.0.1 255.255.255.0
nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
static (dmz,outside) 213.145.149.X Web netmask 255.255.255.255 0 0
access-group acl_inbound in interface outside
access-group acl_outbound in interface inside
access-group acl_dmz in interface dmz

Изнутри работает, а извне нет...
где может быть ошибка?

попробовал так
access-list acl_dmz permit tcp host Web any eq www

и еще так

access-list acl_dmz permit tcp host Web eq www any

все равно нет.

порт вроде прослушивается...

Спасибо

Содержание
Сообщения в этом обсуждении
"Помогите с DMZ на Pix"
Отправлено GolDi , 03-Мрт-10 14:17 
>[оверквотинг удален]
>
>и еще так
>
>access-list acl_dmz permit tcp host Web eq www any
>
>все равно нет.
>
>порт вроде прослушивается...
>
>Спасибо

Может так?
access-list acl_dmz permit tcp any host Web eq www

"Помогите с DMZ на Pix"
Отправлено and , 04-Мрт-10 04:14 
>
>name 192.168.0.15 Web
>access-list acl_dmz permit tcp host Web any eq www
>access-list acl_inbound permit tcp any host 213.145.149.X eq www
>ip address dmz 192.168.0.1 255.255.255.0
>nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
>static (dmz,outside) 213.145.149.X Web netmask 255.255.255.255 0 0
>access-group acl_inbound in interface outside
>access-group acl_outbound in interface inside
>access-group acl_dmz in interface dmz

Строчка
> nat (dmz) 1 192.168.0.0 255.255.255.0 0 0

лишняя, поскольку nat работает в паре с global, которого здесь нет. static в nat не нуждается.
Все должно заработать.

"Помогите с DMZ на Pix"
Отправлено eric , 09-Мрт-10 08:59 

global (outside) 1 213.145.149.198
global (dmz) 1 192.168.0.10-192.168.0.160

вот так прописал глобал, нат убрал, не работает

"Помогите с DMZ на Pix"
Отправлено GolDi , 09-Мрт-10 09:37 
>
>global (outside) 1 213.145.149.198
>global (dmz) 1 192.168.0.10-192.168.0.160
>
>вот так прописал глобал, нат убрал, не работает

Там ещё масса примеров
http://www.ciscolab.ru/2006/12/06/pix_corporatiive_conf.html

"Помогите с DMZ на Pix"
Отправлено eric , 09-Мрт-10 13:12 
по каким-то не известным мне причинам заработало...

только тот, кто там находится, говорит что он подключил второй интерфейс сервера к локалке и заработало... не могу догнать, почему, помогите разобраться в конфиге, по логике же должен без локалки работать...

вот вся конфига

: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
interface ethernet3 auto
interface ethernet4 auto
interface ethernet5 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security30
nameif ethernet3 outside2 security0
nameif ethernet4 intf4 security8
nameif ethernet5 intf5 security10
enable password -------------- encrypted
passwd ------------- encrypted
hostname pix
domain-name ----------
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.0.0.1 pdc
name 10.0.0.2 proxy
name 10.0.0.3 exchange
name 192.168.0.15 Web
access-list acl_dmz permit tcp any host Web eq www
access-list acl_dmz permit udp host Web any eq domain
access-list acl_dmz permit tcp host Web any eq smtp
access-list acl_dmz permit tcp host Web any eq www
access-list acl_dmz permit tcp host Web any eq pop3
access-list acl_dmz deny ip any any
access-list acl_inbound permit tcp host ------------ host 213.145.149.--- eq s                                                                              sh
access-list acl_inbound permit icmp any host 213.145.149.---------- echo-reply
access-list acl_inbound permit icmp any host 213.145.149.---------- source-quench
access-list acl_inbound permit icmp any host 213.145.149.---------- unreachable
access-list acl_inbound permit icmp any host 213.145.149.---------- time-exceeded
access-list acl_inbound permit udp any host 213.145.149.--- eq domain
access-list acl_inbound permit tcp any host 213.145.149.--- eq ssh
access-list acl_inbound permit tcp any host 213.145.149.---eq https
access-list acl_inbound permit tcp any host 213.145.149.--- eq www
access-list acl_inbound deny ip any any
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 10051
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 9091
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 9090
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5269
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5223
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5222
access-list acl_outbound permit ip 10.0.0.0 255.255.255.0 host Web
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq https
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq www
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq smtp
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq pop3
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 995
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq imap4
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 993
access-list acl_outbound permit udp 10.0.0.0 255.255.255.0 any eq domain
access-list acl_outbound permit ip host pdc host 192.168.0.2
access-list acl_outbound permit icmp 10.0.0.0 255.255.255.0 any echo
access-list acl_outbound permit tcp host proxy any eq www
access-list acl_outbound permit tcp host proxy any eq https
access-list acl_outbound permit tcp host proxy any eq ftp
access-list acl_outbound permit tcp host proxy any range 1024 65535
access-list acl_outbound permit tcp host exchange any eq smtp
access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host --------------
access-list acl_outbound permit tcp host exchange any eq pop3
access-list acl_outbound deny ip any any
pager lines 24
logging on
logging buffered errors
logging trap notifications
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu outside2 1500
mtu intf4 1500
mtu intf5 1500
ip address outside 213.145.149.--- 255.255.255.248
ip address inside 10.0.0.254 255.255.255.0
ip address dmz 192.168.0.1 255.255.255.0
no ip address outside2
no ip address intf4
no ip address intf5
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz
no failover ip address outside2
no failover ip address intf4
no failover ip address intf5
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 213.145.149.--
global (dmz) 1 192.168.0.20-192.168.0.110
nat (inside) 1 10.0.0.0 255.255.255.0 0 0
nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.255.0 0 0
static (dmz,outside) 213.145.149.--- Web netmask 255.255.255.255 0 0
access-group acl_inbound in interface outside
access-group acl_outbound in interface inside
access-group acl_dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 213.145.149.--- 1
route outside2 10.0.0.0 255.0.0.0 10.1.44.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 30
ssh ----------- 255.255.255.255 outside
ssh proxy 255.255.255.255 inside
ssh timeout 60
management-access outside
console timeout 0
dhcpd address 10.0.0.100-10.0.0.200 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
username ----------- password ------------- encrypted privilege 2
terminal width 80
Cryptochecksum:----------------------------
: end

"Помогите с DMZ на Pix"
Отправлено eric , 09-Мрт-10 13:19 
или так, обратите внимание, что hitcnt в acl_dmz везде (hitcnt=0) , получается что через acl_dmz вообще ничего не идет...

access-list acl_dmz; 6 elements
access-list acl_dmz line 1 permit tcp any host Web eq www (hitcnt=0)
access-list acl_dmz line 2 permit udp host Web any eq domain (hitcnt=0)
access-list acl_dmz line 3 permit tcp host Web any eq smtp (hitcnt=0)
access-list acl_dmz line 4 permit tcp host Web any eq www (hitcnt=0)
access-list acl_dmz line 5 permit tcp host Web any eq pop3 (hitcnt=0)
access-list acl_dmz line 6 deny ip any any (hitcnt=0)
access-list acl_inbound; 10 elements
access-list acl_inbound line 1 permit tcp host ------------ host 213.145.149.--- eq ssh (hitcnt=0)
access-list acl_inbound line 2 permit icmp any host 213.145.149.------ echo-reply (hitcnt=472)
access-list acl_inbound line 3 permit icmp any host 213.145.149.------ source-quench (hitcnt=0)
access-list acl_inbound line 4 permit icmp any host 213.145.149.------ unreachable (hitcnt=0)
access-list acl_inbound line 5 permit icmp any host 213.145.149.------ time-exceeded (hitcnt=21)
access-list acl_inbound line 6 permit udp any host 213.145.149.--- eq domain (hitcnt=0)
access-list acl_inbound line 7 permit tcp any host 213.145.149.--- eq ssh (hitcnt=0)
access-list acl_inbound line 8 permit tcp any host 213.145.149.--- eq https (hitcnt=41)
access-list acl_inbound line 9 permit tcp any host 213.145.149.--- eq www (hitcnt=69)
access-list acl_inbound line 10 deny ip any any (hitcnt=2253)
access-list acl_outbound; 25 elements
access-list acl_outbound line 1 permit tcp 10.0.0.0 255.255.255.0 host Web eq 10051 (hitcnt=0)
access-list acl_outbound line 2 permit tcp 10.0.0.0 255.255.255.0 host Web eq 9091 (hitcnt=0)
access-list acl_outbound line 3 permit tcp 10.0.0.0 255.255.255.0 host Web eq 9090 (hitcnt=0)
access-list acl_outbound line 4 permit tcp 10.0.0.0 255.255.255.0 host Web eq 5269 (hitcnt=0)
access-list acl_outbound line 5 permit tcp 10.0.0.0 255.255.255.0 host Web eq 5223 (hitcnt=0)
access-list acl_outbound line 6 permit tcp 10.0.0.0 255.255.255.0 host Web eq 5222 (hitcnt=0)
access-list acl_outbound line 7 permit ip 10.0.0.0 255.255.255.0 host Web (hitcnt=63)
access-list acl_outbound line 8 permit tcp 10.0.0.0 255.255.255.0 host Web eq https (hitcnt=0)
access-list acl_outbound line 9 permit tcp 10.0.0.0 255.255.255.0 host Web eq www (hitcnt=22)
access-list acl_outbound line 10 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq smtp (hitcnt=0)
access-list acl_outbound line 11 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq pop3 (hitcnt=0)
access-list acl_outbound line 12 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 995 (hitcnt=0)
access-list acl_outbound line 13 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq imap4 (hitcnt=0)
access-list acl_outbound line 14 permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 993 (hitcnt=0)
access-list acl_outbound line 15 permit udp 10.0.0.0 255.255.255.0 any eq domain (hitcnt=479570)
access-list acl_outbound line 16 permit ip host pdc host 192.168.0.2 (hitcnt=0)
access-list acl_outbound line 17 permit icmp 10.0.0.0 255.255.255.0 any echo (hitcnt=70415)
access-list acl_outbound line 18 permit tcp host proxy any eq www (hitcnt=729476)
access-list acl_outbound line 19 permit tcp host proxy any eq https (hitcnt=47073)
access-list acl_outbound line 20 permit tcp host proxy any eq ftp (hitcnt=8)
access-list acl_outbound line 21 permit tcp host proxy any range 1024 65535 (hitcnt=20315)
access-list acl_outbound line 22 permit tcp host exchange any eq smtp (hitcnt=1326)
access-list acl_outbound line 23 permit tcp 10.0.0.0 255.255.255.0 host 212.42.122.115 (hitcnt=15)
access-list acl_outbound line 24 permit tcp host exchange any eq pop3 (hitcnt=30458)
access-list acl_outbound line 25 deny ip any any (hitcnt=619340)