hpux公网出口不通，是防火墙问题还是主机问题？pix+netscreen!!!!

guozhongyan

客户的公网出口是两台防火墙串接，Pix525作为内网防火墙，netscreen作为外网防火墙，采用两层地址映射的方式

pix后有两台主机，一台为unix服务器，地址为134.64.2.10,之前仅在公网上开放了7001与9001端口，另一台为pc server作为测试机地址为134.64.2.18此前没有出公网，pix将两台主机分别mip为192.168.200.100与 192.168.200.104，netscreen再将这两个192地址映射为公网地址；

出于业务需要，主机需要调用公网上的某台服务器的smtp，即需要开放两台主机外出访问25端口的权限，我对pix和netscreen做了如下配置：

pix的acl配置：

access-list 101 permit tcp any host 192.168.200.100 eq 7001
access-list 101 permit tcp any host 192.168.200.100 eq 9001
access-list 101 permit tcp any host 192.168.200.103 eq 7001
access-list 101 permit tcp any host 192.168.200.103 eq 9001
access-list 101 permit tcp any host 192.168.200.104 eq smtp
access-list 101 permit tcp any host 192.168.200.100 eq smtp
access-list 101 permit icmp any host 192.168.200.100 echo-reply
access-list 101 permit icmp any host 192.168.200.104 echo-reply
access-group 101 in interface outside

netscreen上做了如下policy配置：
set policy id 14 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.35)\" \"7001\" Permit
set policy id 0 name \"go-out\" from \"Trust\" to \"Untrust\"  \"192.168.100.0/24\" \"192.168.100.0/24\" \"7001\" Permit
set policy id 13 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.35)\" \"9001\" Permit
set policy id 1 from \"Trust\" to \"Untrust\"  \"192.168.100.0/24\" \"192.168.100.0/24\" \"9001\" Permit
set policy id 2 from \"Untrust\" to \"Trust\"  \"Any\" \"Any\" \"MAIL\" Permit
set policy id 3 from \"Trust\" to \"Untrust\"  \"Any\" \"Any\" \"MAIL\" Permit
set policy id 4 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.35)\" \"MAIL\" Permit
set policy id 5 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.3\" \"MAIL\" Permit

x.x.x.35是134.64.2.10的公网地址
x.x.x.38是134.64.2.18的公网地址

经过配置以后做测试，测试机可以顺利联通远端25端口，但是正式机却怎么也联不上公网地址
1、是否与unix本地没有打开25端口有关？连接远程25端口需要本地主机自身也同时打开25端口吗？
2、是否与主机双网卡多地址绑定有关？我已经在主机里面添加了目标主机route add net 210.x.x.0 gateway 134.64.2.1（内网pix地址）的静态路由了，还是不通.

guozhongyan

把netscreen的配置改为
set policy id 2 from \"Untrust\" to \"Trust\"  \"Any\" \"Any\" \"any\" Permit
set policy id 3 from \"Trust\" to \"Untrust\"  \"Any\" \"Any\" \"any\" Permit

测试机能ping出到公网，而业务机还是不行！

lhyis

是不是防火墙也需要把25端口开开,为了收到连到远端主机的信息,需要开放25端口通信协议
set service \"25duankou\" protocal tcp dst-port 25-25
set policy from untrust to global any mip \"25duankou\" permit
你试一下,不行的话,考虑pix的设置是否缺少哪些配置.

sunyone

trace一下不行么，猜啥呀