Cisco PIX 525 Especificações descarregar pdf (Página 533)

100

101

B-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Appendix B Sample Configurations

Example 2: Single Mode Firewall Using Same Security Level

Example 1: Customer C Context Configuration

interface gigabitethernet 0.3

nameif outside

security-level 0

ip address 209.165.201.5 255.255.255.224

no shutdown

interface gigabitethernet 1.7

nameif inside

security-level 100

ip address 10.1.4.1 255.255.255.0

no shutdown

interface gigabitethernet 1.8

nameif dmz

security-level 50

ip address 192.168.2.1 255.255.255.0

no shutdown

passwd fl0wer

enable password treeh0u$e

route outside 0 0 209.165.201.1 1

url-server (dmz) vendor websense host 192.168.2.2 url-block block 50

url-cache dst 128

filter url http 10.1.4.0 255.255.255.0 0 0

When inside users access an HTTP server, the security appliance consults with a

Websense server to determine if the traffic is allowed

nat (inside) 1 10.1.4.0 255.255.255.0

This context uses dynamic NAT for inside users that access the outside

global (outside) 1 209.165.201.9 netmask 255.255.255.255

A host on the admin context requires access to the Websense server for management using

pcAnywhere, so the Websense server uses a static translation for its private address

static (dmz,outside) 209.165.201.6 192.168.2.2 netmask 255.255.255.255

access-list MANAGE remark Allows the management host to use pcAnywhere on the Websense

server

access-list MANAGE extended permit tcp host 209.165.201.30 host 209.165.201.6 eq

pcanywhere-data

access-list MANAGE extended permit udp host 209.165.201.30 host 209.165.201.6 eq

pcanywhere-status

access-group MANAGE in interface outside

Example 2: Single Mode Firewall Using Same Security Level

This configuration creates three internal interfaces. Two of the interfaces connect to departments that are

on the same security level, which allows all hosts to communicate without using access lists. The DMZ

interface hosts a Syslog server. The management host on the outside needs access to the Syslog server

and the security appliance. To connect to the security appliance, the host uses a VPN connection. The

security appliance uses RIP on the inside interfaces to learn routes. Because the security appliance does

not advertise routes with RIP, the upstream router needs to use static routes for security appliance traffic

(see Figure B-2).

The Department networks are allowed to access the Internet, and use PAT.

1 2 ... 528 529 530 531 532 533 534 535 536 537 538 ... 603 604

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 533

Comentários a estes Manuais

Related products and manuals for Computer hardware Datoptic uNAS – tNAS