pix 的问题.急,求助~~!

sunshuang

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 out security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name domain.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
pager lines 24
mtu out 1500
mtu inside 1500
mtu dmz 1500
ip address out 222.57.98.154 255.255.255.0
ip address inside 192.1.1.1 255.255.255.0
ip address dmz 192.1.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (out) 1 interface
global (dmz) 1 192.1.2.50-192.1.2.250
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.1.2.3 255.255.255.255 0 0
static (dmz,out) tcp 222.57.98.154 www 192.1.2.3 www netmask 255.255.255.255 0 0

static (dmz,out) tcp 222.57.98.154 pcanywhere-data 192.1.2.3 pcanywhere-data net
mask 255.255.255.255 0 0
static (dmz,out) tcp 222.57.98.154 241 192.1.2.3 241 netmask 255.255.255.255 0 0

static (dmz,out) tcp 222.57.98.154 ftp 192.1.2.3 ftp netmask 255.255.255.255 0 0

static (dmz,out) tcp 222.57.98.154 13000 192.1.2.3 13000 netmask 255.255.255.255
0 0
static (dmz,out) tcp 222.57.98.154 14000 192.1.2.3 14000 netmask 255.255.255.255
0 0
static (dmz,out) tcp 222.57.98.154 15000 192.1.2.3 15000 netmask 255.255.255.255
0 0
static (dmz,out) udp 222.57.98.154 15000 192.1.2.3 15000 netmask 255.255.255.255
0 0
static (dmz,out) udp 222.57.98.154 14000 192.1.2.3 14000 netmask 255.255.255.255
0 0
static (dmz,out) udp 222.57.98.154 13000 192.1.2.3 13000 netmask 255.255.255.255
0 0
static (dmz,out) 222.57.98.154 192.1.2.3 netmask 255.255.255.255 0 0
conduit permit icmp any any
conduit permit ip any any
route dmz 0.0.0.0 0.0.0.0 222.57.98.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.1.1.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 out
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:9e01e520a745d21cba7051bbd3b728b3

: end
pixfirewall#

sunshuang

DMZ的服务器.可以PING通.外网网关.可是打不开网页.

INSIDE的用户不能访问,DMZ的服务器.????
为什么?为什么?我是哪里错了呀.555555555555555555555


求大家帮帮帮帮帮帮帮帮帮帮帮帮忙.....................

sunshuang

唉.真不知道我上辈子做错了什么.

qintel

你只有一个IP地址吗，如果你有多个，请把globla地址换成另外的地址试试。
你的其它配置我和这边是一样的，我这边是正常的，就是我这边不是用接口地址作NAT。

或者你用PDM配置，那里有如何设置用接口地址作NAT>

sunshuang

谢谢.楼上..的同包..~~~~~!万分感谢谢..我只有一个地址

hotmango

pat的情况，最好再申请一个或者以上的ip地址来配置就没问题。

badeager

1. 
   
2. static (dmz,out) tcp 222.57.98.154 www 192.1.2.3 www netmask 255.255.255.255 0 0
   
3. 
   
4. static (dmz,out) tcp 222.57.98.154 pcanywhere-data 192.1.2.3 pcanywhere-data net
   
5. mask 255.255.255.255 0 0
   
6. static (dmz,out) tcp 222.57.98.154 241 192.1.2.3 241 netmask 255.255.255.255 0 0
   
7. 
   
8. static (dmz,out) tcp 222.57.98.154 ftp 192.1.2.3 ftp netmask 255.255.255.255 0 0
   
9. 
   
10. static (dmz,out) tcp 222.57.98.154 13000 192.1.2.3 13000 netmask 255.255.255.255
    
11. 0 0
    
12. static (dmz,out) tcp 222.57.98.154 14000 192.1.2.3 14000 netmask 255.255.255.255
    
13. 0 0
    
14. static (dmz,out) tcp 222.57.98.154 15000 192.1.2.3 15000 netmask 255.255.255.255
    
15. 0 0
    
16. static (dmz,out) udp 222.57.98.154 15000 192.1.2.3 15000 netmask 255.255.255.255
    
17. 0 0
    
18. static (dmz,out) udp 222.57.98.154 14000 192.1.2.3 14000 netmask 255.255.255.255
    
19. 0 0
    
20. static (dmz,out) udp 222.57.98.154 13000 192.1.2.3 13000 netmask 255.255.255.255
    
21. 0 0
    

复制代码

这些都需要改
比如
static (dmz,out) udp 222.57.98.154 13000 192.1.2.3 13000 netmask 255.255.255.255
0 0
就必须要添
static (dmz,inside) udp 222.57.98.154 13000 192.1.2.3 13000 netmask 255.255.255.255
0 0
inside才可以访问,
依次类推,这个问题很奇怪的,
还有再做一个access-list 这样,把端口给配上,
找这种方法做,应该没有问题.

[ 本帖最后由 badeager 于 2006-8-1 17:16 编辑 ]

onebuyone

global (out) 1 interface
global (dmz) 1 192.1.2.50-192.1.2.250
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.1.2.3 255.255.255.255 0 0
         你DMZ的计算机只能有一台192.1.2.3可以进行地址转换，如果所有DMZ的计算机都需要访问，请修改NAT(DMZ).

static (dmz,out) tcp 222.57.98.154 ftp 192.1.2.3 ftp netmask 255.255.255.255 0 0
         STATIC的语句错误了，记住这样的顺序static(高安全区,低安全区) 低安全区IP 高安全区IP。

route dmz 0.0.0.0 0.0.0.0 222.57.98.1 1
          路由也修改一下 route outside 0.0.0.0 0.0.0.0 222.57.98.1.1