- 论坛徽章:
- 0
|
客户的公网出口是两台防火墙串接,Pix525作为内网防火墙,netscreen作为外网防火墙,采用两层地址映射的方式\r\n\r\npix后有两台主机,一台为unix服务器,地址为134.64.2.10,之前仅在公网上开放了7001与9001端口,另一台为pc server作为测试机地址为134.64.2.18此前没有出公网,pix将两台主机分别mip为192.168.200.100与 192.168.200.104,netscreen再将这两个192地址映射为公网地址;\r\n\r\n出于业务需要,主机需要调用公网上的某台服务器的smtp,即需要开放两台主机外出访问25端口的权限,我对pix和netscreen做了如下配置:\r\n\r\npix的acl配置:\r\n\r\naccess-list 101 permit tcp any host 192.168.200.100 eq 7001\r\naccess-list 101 permit tcp any host 192.168.200.100 eq 9001\r\naccess-list 101 permit tcp any host 192.168.200.103 eq 7001\r\naccess-list 101 permit tcp any host 192.168.200.103 eq 9001\r\naccess-list 101 permit tcp any host 192.168.200.104 eq smtp\r\naccess-list 101 permit tcp any host 192.168.200.100 eq smtp\r\naccess-list 101 permit icmp any host 192.168.200.100 echo-reply\r\naccess-list 101 permit icmp any host 192.168.200.104 echo-reply\r\naccess-group 101 in interface outside\r\n\r\nnetscreen上做了如下policy配置:\r\nset policy id 14 from \"Untrust\" to \"Global\" \"Any\" \"MIP(x.x.x.35)\" \"7001\" Permit\r\nset policy id 0 name \"go-out\" from \"Trust\" to \"Untrust\" \"192.168.100.0/24\" \"192.168.100.0/24\" \"7001\" Permit\r\nset policy id 13 from \"Untrust\" to \"Global\" \"Any\" \"MIP(x.x.x.35)\" \"9001\" Permit\r\nset policy id 1 from \"Trust\" to \"Untrust\" \"192.168.100.0/24\" \"192.168.100.0/24\" \"9001\" Permit\r\nset policy id 2 from \"Untrust\" to \"Trust\" \"Any\" \"Any\" \"MAIL\" Permit\r\nset policy id 3 from \"Trust\" to \"Untrust\" \"Any\" \"Any\" \"MAIL\" Permit\r\nset policy id 4 from \"Untrust\" to \"Global\" \"Any\" \"MIP(x.x.x.35)\" \"MAIL\" Permit\r\nset policy id 5 from \"Untrust\" to \"Global\" \"Any\" \"MIP(x.x.x.3\" \"MAIL\" Permit\r\n\r\nx.x.x.35是134.64.2.10的公网地址\r\nx.x.x.38是134.64.2.18的公网地址\r\n\r\n经过配置以后做测试,测试机可以顺利联通远端25端口,但是正式机却怎么也联不上公网地址\r\n1、是否与unix本地没有打开25端口有关?连接远程25端口需要本地主机自身也同时打开25端口吗?\r\n2、是否与主机双网卡多地址绑定有关?我已经在主机里面添加了目标主机route add net 210.x.x.0 gateway 134.64.2.1(内网pix地址)的静态路由了,还是不通. |
|