pix515E,7.03版本关于subinterface的路由问题

magictao

现在一台pix515E,outside连接的公网,inside 192.168.219.1连接的内网,另外还有一块4口扩展卡,其中一个端口interface设置了子网接口.该子网接口上面配置了两个网段10.185.10.0和137.45.43.0同时也配置了两个vlan,现在针对两个不同的子网段设置了路由,并且能够从pix上面ping通目的主机,但是从inside网段的主机却无法ping通,请问是什么问题导致?

ssffzz1

1、检查下面PC的网关是否正确。
2、检查是否划分到了正确的安全区域。
3、检查时候有ACL隔离。
4、检查子接口以及VLAN ID是否配置正确。

seven007

inside端的主机网关是指到你的子接口上吗？画个图吧

magictao

汗,不知道怎么贴图上来,我内网主机的默认网关就是pix的inside端口地址,另外子接口也配置了相应的路由.
PIX Version 7.0(1)
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 219.149.156.145 255.255.255.192
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.219.1 255.255.255.0
!
interface Ethernet2
no nameif
security-level 4
no ip address
!
interface Ethernet2.1
vlan 114
nameif crm
security-level 10
ip address 10.233.85.10 255.255.255.248
!            
interface Ethernet2.2
vlan 216
nameif dcn
security-level 10
ip address 137.64.14.146 255.255.255.248
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet5
shutdown
no nameif
no security-level
no ip address
!            
enable password WJCaW6GQa.Tci67l encrypted
passwd WJCaW6GQa.Tci67l encrypted
hostname ty-snl-cdmata-pix
domain-name tycdma.com
ftp mode passive
access-list 111 extended permit ip 192.168.219.0 255.255.255.0 192.10.11.0 255.255.255.0
access-list 111 extended permit ip 192.168.219.0 255.255.255.0 192.168.219.0 255.255.255.0
access-list 120 extended permit ip 192.168.219.0 255.255.255.0 192.10.11.0 255.255.255.0
access-list 101 extended permit ip host 192.168.219.244 any
access-list 101 extended permit ip host 192.168.219.222 any
access-list 101 extended permit ip host 192.168.219.40 any
access-list 101 extended permit ip host 192.168.219.111 any
access-list 101 extended permit ip host 192.168.219.254 any
access-list 101 extended permit ip host 192.168.219.177 any
access-list 101 extended permit ip host 192.168.219.5 any
access-list 101 extended permit ip host 192.168.219.8 any
access-list 101 extended permit ip host 192.168.219.51 any
access-list 101 extended permit ip host 192.168.219.61 any
access-list acl_out extended permit tcp any any
access-list acl_out extended permit udp any any
access-list acl_out extended permit ip any any
access-list acl_out extended permit icmp any any
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dcn 1500
mtu crm 1500
no failover
monitor-interface outside
monitor-interface inside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (dcn) 1 137.64.14.147 netmask 255.255.255.248
nat (inside) 0 access-list 111
nat (inside) 1 192.168.219.0 255.255.255.0
access-group acl_out in interface outside
access-group 101 in interface inside
access-group acl_out in interface dcn
route outside 0.0.0.0 0.0.0.0 219.149.156.129 1
route dcn 137.64.24.0 255.255.255.0 137.64.14.145 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp
crypto ipsec transform-set tycdma esp-des esp-md5-hmac
crypto map newmap 10 match address 120
crypto map newmap 10 set peer 117.32.249.206
crypto map newmap 10 set transform-set tycdma
crypto map newmap interface outside
isakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 3600
telnet 192.168.219.0 255.255.255.0 inside
telnet timeout 60
ssh 222.66.21.94 255.255.255.255 outside
ssh timeout 30
ssh version 1
console timeout 30
tunnel-group 117.32.249.206 type ipsec-l2l
tunnel-group 117.32.249.206 ipsec-attributes
pre-shared-key *
!
class-map insepection_default
match port tcp eq sqlnet
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect http
  inspect pptp
!

ssffzz1

ip address 137.64.14.146 255.255.255.248

这个网段是干吗的？

magictao

这个也是我需要往外访问的两个网段中的其中一个网络.

ssffzz1

也就是说
ip address 137.64.14.146 255.255.255.248

这个接口下的机器不受你控制是吗？

ssffzz1

记得515E，上7.2可能不行的。
不过你可以升级一下试试，记好 授权序列号 。
CISCO的PIX不是很熟悉。我有台PIX520最高是6.3了。


发错了，你另一个帖子的。

[ 本帖最后由 ssffzz1 于 2009-1-5 12:00 编辑 ]

magictao

是的,接口后面的就是另外人家华为的设备了

ssffzz1

哦，这样啊，做NAT.