所有来自内部接口转换都转换成pix的outside接口IP地址
但是1.1.10.1该地址被静态转换为192.168.1.10，并且当访问1.10的telnet服务时，自动转到10.1的telnet
而所有访问外部接口FTP服务时，被转换到1.1.21.1的FTP服务上了
pixfirewall(config)# sh run
interface Ethernet0
nameif inside
security-level 100
ip address 172.16.1.1 255.255.255.0
!
interface Ethernet1
nameif outside
security-level 0
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet2
nameif dmz
security-level 50
ip address 10.10.1.1 255.255.255.0
!
access-list 1 extended permit tcp any host 192.168.1.10 eq telnet
access-list 1 extended permit tcp any host 192.168.1.1 eq ftp
global (outside) 1 interface
nat (inside) 1 1.1.0.0 255.255.0.0
static (inside,outside) tcp 192.168.1.10 telnet 1.1.10.1 telnet netmask 255.255.255.255 ----当访问192.168.1.10的telnet服务时，自动转换到1.1.10.1的telnet服务
static (inside,outside) tcp interface ftp 1.1.21.1 ftp netmask 255.255.255.255 ----当访问外部接口地址上的FTP服务时，自动转换到1.1.21.1的FTP服务
access-group 1 in interface outside
access-group 1 in interface outside
route inside 1.1.0.0 255.255.0.0 172.16.1.2 1
route outside 2.2.2.0 255.255.255.0 192.168.1.2 1
route dmz 3.3.3.0 255.255.255.0 10.10.1.2 1
pixfirewall(config)# sh xl
2 in use, 5 most used
PAT Global 192.168.1.10(23) Local 1.1.10.1(23)
PAT Global 192.168.1.1(21) Local 1.1.21.1(21)
pixfirewall(config)#
R1#sh run
enable password user
username user password 0 user
interface Loopback0
ip address 1.1.10.1 255.255.255.0
!
interface Loopback1
ip address 1.1.1.1 255.255.255.0
!
interface Loopback2
ip address 1.1.21.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 172.16.1.1
line vty 5 15
login local
R2#sh run
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface FastEthernet0/0
ip address 192.168.1.2 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1
R2#192.168.1.10
Trying 192.168.1.10 ... Open
User Access Verification
Username: user
Password: user
R1>who
Line User Host(s) Idle Location
0 con 0 idle 00:02:03
*226 vty 0 user idle 00:00:00 192.168.1.2
Interface User Mode Idle Peer Address
R1>enable
Password: user
R1#
阅读(779) | 评论(0) | 转发(0) |
