奇怪的网络问题请教!

hbysgzdl

我们内部局域网(分别有S10和Linux两种操作系统主机)通过防火墙CISCO 515E 出去另网段其中一台主机A1,按照正常情况下我们的系统需要在A1主机上telnet 和FTP到内部局域网上的任何一台机器,奇怪的问题是在SUN 890主机上与A1都可以进行网络互访,但是在从A1主机不能telnet 和FTP 到Linux主机上,现在的问题是首先必须先从linux主机上先telnet 到A1主机上后,才能从A1主机telnet 和FTP 到Linux主机上,不知道这是什么原因?请高手们解释或者解决一下,谢谢了!

ylping

o..o....是不是设置了,只能从s10telnet  a1啊....

chl1983

能看到配置吗?~
感觉有可能是TCP连接的原因

kentchoi

这个什么可能性都有，，干嘛不贴上pix的配置呢？

shenbo7

出来早锻炼,随便打酱油
先TELNET到SUN 890,再从SUN 890 telnet到LINUX
(不好意思,习惯性思维)

[ 本帖最后由 shenbo7 于 2008-8-1 10:00 编辑 ]

hbysgzdl

User Access Verification

Password:
Type help or '?' for a list of available commands.
zc> en
Password: *******
zc# show conf
: Saved
: Written by enable_15 at 06:01:27.216 UTC Fri Jan 1 1993
!
PIX Version 7.0(6)
!
hostname zc
domain-name default.domain.invalid
enable password S4lRmsvyCcXs9BmU encrypted
names
dns-guard
!
interface Ethernet0
description outside
nameif e0
security-level 0
ip address 10.201.65.166 255.255.255.252
!
interface Ethernet1
description inside
nameif e1
security-level 100
ip address 10.201.92.143 255.255.255.224
!
passwd S4lRmsvyCcXs9BmU encrypted
ftp mode passive
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq 2640
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq 123
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq 4100
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq 6504
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq 6505
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq ftp
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq telnet
access-list outside extended permit tcp any 10.201.92.0 255.255.255.0 eq 3389
access-list outside extended permit tcp any 192.168.55.0 255.255.255.0 eq www
access-list outside extended permit icmp any any
pager lines 24
mtu e0 1500
mtu e1 1500
icmp permit any e0
icmp permit any e1
asdm image flash:/asdm502.bin
no asdm history enable
arp timeout 14400
nat (e1) 0 0.0.0.0 0.0.0.0
route e0 0.0.0.0 0.0.0.0 10.201.65.165 1
route e1 10.201.92.0 255.255.255.0 10.201.65.166 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 e1
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 0.0.0.0 0.0.0.0 e0
telnet 10.201.92.128 255.255.255.224 e1
telnet 10.201.92.0 255.255.255.0 e1
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map class_ftp
match port tcp range 1024 65535
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect http
class class_ftp
  inspect ftp
!
service-policy global_policy global
Cryptochecksum:989eb9b963c8500f2d757a55cf694203

hbysgzdl

为什么没有答案?

hisysjrw

但是在从A1主机不能telnet 和FTP 到Linux主机上,现在的问题是首先必须先从linux主机上先telnet 到A1主机上后,才能从A1主机telnet 和FTP 到Linux主机上,不知道这是什么原因?请高手们解释或者解决一下,谢谢了!
怎么看这段话也有问题..

hisysjrw

从配置上看
1.没有Global
2.ACL没有应用到接口