Исходное сообщение
"Помогите с DMZ на Pix" Отправлено eric, 09-Мрт-10 13:12
по каким-то не известным мне причинам заработало... только тот, кто там находится, говорит что он подключил второй интерфейс сервера к локалке и заработало... не могу догнать, почему, помогите разобраться в конфиге, по логике же должен без локалки работать... вот вся конфига : Saved : PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto interface ethernet3 auto interface ethernet4 auto interface ethernet5 auto shutdown nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security30 nameif ethernet3 outside2 security0 nameif ethernet4 intf4 security8 nameif ethernet5 intf5 security10 enable password -------------- encrypted passwd ------------- encrypted hostname pix domain-name ---------- fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 10.0.0.1 pdc name 10.0.0.2 proxy name 10.0.0.3 exchange name 192.168.0.15 Web access-list acl_dmz permit tcp any host Web eq www access-list acl_dmz permit udp host Web any eq domain access-list acl_dmz permit tcp host Web any eq smtp access-list acl_dmz permit tcp host Web any eq www access-list acl_dmz permit tcp host Web any eq pop3 access-list acl_dmz deny ip any any access-list acl_inbound permit tcp host ------------ host 213.145.149.--- eq s                                                                              sh access-list acl_inbound permit icmp any host 213.145.149.---------- echo-reply access-list acl_inbound permit icmp any host 213.145.149.---------- source-quench access-list acl_inbound permit icmp any host 213.145.149.---------- unreachable access-list acl_inbound permit icmp any host 213.145.149.---------- time-exceeded access-list acl_inbound permit udp any host 213.145.149.--- eq domain access-list acl_inbound permit tcp any host 213.145.149.--- eq ssh access-list acl_inbound permit tcp any host 213.145.149.---eq https access-list acl_inbound permit tcp any host 213.145.149.--- eq www access-list acl_inbound deny ip any any access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 10051 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 9091 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 9090 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5269 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5223 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq 5222 access-list acl_outbound permit ip 10.0.0.0 255.255.255.0 host Web access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq https access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host Web eq www access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq smtp access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq pop3 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 995 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq imap4 access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host 192.168.0.2 eq 993 access-list acl_outbound permit udp 10.0.0.0 255.255.255.0 any eq domain access-list acl_outbound permit ip host pdc host 192.168.0.2 access-list acl_outbound permit icmp 10.0.0.0 255.255.255.0 any echo access-list acl_outbound permit tcp host proxy any eq www access-list acl_outbound permit tcp host proxy any eq https access-list acl_outbound permit tcp host proxy any eq ftp access-list acl_outbound permit tcp host proxy any range 1024 65535 access-list acl_outbound permit tcp host exchange any eq smtp access-list acl_outbound permit tcp 10.0.0.0 255.255.255.0 host -------------- access-list acl_outbound permit tcp host exchange any eq pop3 access-list acl_outbound deny ip any any pager lines 24 logging on logging buffered errors logging trap notifications mtu outside 1500 mtu inside 1500 mtu dmz 1500 mtu outside2 1500 mtu intf4 1500 mtu intf5 1500 ip address outside 213.145.149.--- 255.255.255.248 ip address inside 10.0.0.254 255.255.255.0 ip address dmz 192.168.0.1 255.255.255.0 no ip address outside2 no ip address intf4 no ip address intf5 ip audit info action alarm ip audit attack action alarm no failover failover timeout 0:00:00 failover poll 15 no failover ip address outside no failover ip address inside no failover ip address dmz no failover ip address outside2 no failover ip address intf4 no failover ip address intf5 pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 213.145.149.-- global (dmz) 1 192.168.0.20-192.168.0.110 nat (inside) 1 10.0.0.0 255.255.255.0 0 0 nat (dmz) 1 192.168.0.0 255.255.255.0 0 0 static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.255.0 0 0 static (dmz,outside) 213.145.149.--- Web netmask 255.255.255.255 0 0 access-group acl_inbound in interface outside access-group acl_outbound in interface inside access-group acl_dmz in interface dmz route outside 0.0.0.0 0.0.0.0 213.145.149.--- 1 route outside2 10.0.0.0 255.0.0.0 10.1.44.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa authentication ssh console LOCAL http server enable http 192.168.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet timeout 30 ssh ----------- 255.255.255.255 outside ssh proxy 255.255.255.255 inside ssh timeout 60 management-access outside console timeout 0 dhcpd address 10.0.0.100-10.0.0.200 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside dhcpd enable inside username ----------- password ------------- encrypted privilege 2 terminal width 80 Cryptochecksum:---------------------------- : end