PIX 配置中的一个奇怪问题.(PEMU + Dynamips)
PIX 配置中的一个奇怪问题.(PEMU + Dynamips)
拓扑很简单. 用dynamips and pemu 模拟的.
PIX 内网口 ip 10.2.2.22, 接了一个Router, (10.2.2.33 and 10.1.1.33), router再接了一个VMware PC1.(ip 10.1.1.2)
PIX 外网口 ip 192.168.3.22, 接了一个Router, (192.168.3.33 and 192.168.2.33), router再接了一个VMware PC2.(ip 192.168.2.54)
PIX的DMZ这次先没有用来实验,配置不管他
做static (LAN,WAN) 192.168.3.24 10.1.1.2 netmask 255.255.255.255 转换内网PC110.1.1.2 到外网 192.168.3.24. 从内网PC1 怎么也ping不通外网router和pc2(192.168.2.54)
去掉static (LAN,WAN) 192.168.3.24 10.1.1.2 netmask 255.255.255.255命令后, 就可以通. 因为配置了Global 和Nat.
请教各位朋友及老师了.谢谢
pixfirewall(config)# show run
: Saved
:
PIX Version 8.0(2)
!
hostname pixfirewall
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0
nameif LAN
security-level 100
ip address 10.2.2.22 255.255.255.0
!
interface Ethernet1
nameif WAN
security-level 0
ip address 192.168.3.22 255.255.255.0
!
interface Ethernet2
nameif DMZ
security-level 50
ip address 192.168.151.22 255.255.255.0
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list acl-wan extended permit icmp any any echo-reply
access-list acl-wan extended permit icmp any any source-quench
access-list acl-wan extended permit icmp any any unreachable
access-list acl-wan extended permit icmp any any time-exceeded
access-list acl-wan extended permit icmp any any echo
pager lines 24
mtu LAN 1500
mtu WAN 1500
mtu DMZ 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-521.bin
no asdm history enable
arp timeout 14400
global (WAN) 1 interface
nat (LAN) 1 10.0.0.0 255.0.0.0
static (LAN,WAN) 192.168.3.24 10.1.1.2 netmask 255.255.255.255
access-group acl-wan in interface LAN
access-group acl-wan out interface LAN
access-group acl-wan in interface WAN
access-group acl-wan out interface WAN
!
router rip
network 10.0.0.0
network 192.168.3.0
network 192.168.120.0
network 192.168.151.0
version 2
!
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sysopt noproxyarp LAN
sysopt noproxyarp WAN
sysopt noproxyarp DMZ
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
prompt hostname context
Cryptochecksum:d005609ad3fbb682af0073c657ea214d
: end
pixfirewall(config)#
