安全 : Cisco PIX 500 系列安全设备

配置 PIX 防火墙,以允许内部网络对邮件服务器的访问

2015 年 8 月 28 日 - 机器翻译
其他版本: PDFpdf | 英语 (2015 年 4 月 22 日) | 反馈


目录


简介

此示例配置展示如何设置Cisco PIX防火墙,来访问位于内部网络的邮件服务器。

注意: 在本文中配置的SMTP检查不能与到服务器的ESMTP连接兼容,例如Microsoft替换。请勿配置SMTP检查,如果使用依靠ESMTP的邮件服务器。或者, PIX软件版本7.0及以后支持SMTP和ESMTP检查。

先决条件

要求

本文档没有任何特定的要求。

使用的组件

本文档中的信息基于以下软件和硬件版本:

  • PIX防火墙10000

  • PIX防火墙软件软件版本5.1(4)

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您使用的是真实网络,请确保您已经了解所有命令的潜在影响。

规则

有关文档规则的详细信息,请参阅 Cisco 技术提示规则

配置

本部分提供有关如何配置本文档所述功能的信息。

注意: 使用命令查找工具仅限注册用户)可获取有关本部分所使用命令的详细信息。

网络图

本文档使用此网络设置。

/image/gif/paws/8122/mailserver_in.gif

配置

本文档使用以下配置。

PIX 防火墙
PIX Version 5.1(4)

 !--- These commands name and set the security level for each PIX interface.

 nameif ethernet0 outside security0
 nameif ethernet1 inside security100
 enable password 8Ry2YjIyt7RRXU24 encrypted
 passwd 2KFQnbNIdI.2KYOU encrypted
 hostname PIX_1
 domain-name noplace.com
 fixup protocol ftp 21
 fixup protocol http 80
 fixup protocol h323 1720
 fixup protocol rsh 514
 fixup protocol smtp 25
 fixup protocol sqlnet 1521
 no names

 !--- Create an access list that permits SMTP traffic from anywhere
 !--- to the host at 209.164.3.5 (our server).  The name of this list is 
 !--- smtp. Add additional lines to this access list as required.
 !--- Note: There is one and only one access list allowed per
 !--- interface per direction (for example, inbound on the outside interface).
 !--- Because of limitation, any additional lines that need placement in
 !--- the access list need to be specified here.  If the server
 !--- in question is not SMTP, replace the occurrences of SMTP with
 !--- www, DNS, POP3, or whatever else is required. The access-list
 !--- command was introduced in PIX Software Release 5.0; it is used
 !--- here instead of a conduit statement.

 access-list smtp permit tcp any host 209.164.3.5 eq smtp
 pager lines 24
 logging on
 logging timestamp
 no logging standby
 logging console debugging
 logging monitor debugging
 logging buffered debugging
 logging trap debugging
 no logging history
 logging facility 23
 logging queue 512

 !--- Set each Ethernet interface to auto-detect its media type.

 interface ethernet0 auto
 interface ethernet1 auto
 mtu outside 1500
 mtu inside 1500

 !--- Define the IP address for each interface.

 ip address inside 192.168.1.1 255.255.255.0
 ip address outside 209.164.3.1 255.255.255.252
 no failover
 arp timeout 14400

 !--- Specify that any traffic that originates inside from the
 !--- 192.168.2.x network NATs (PAT) to 209.164.3.129 if
 !--- such traffic passes through the outside interface.

 global (outside) 1 209.164.3.129
 nat (inside) 1 192.168.2.0 255.255.255.0

 !--- Define a static translation between 192.168.2.57 on the inside and
 !--- 209.164.3.5 on the outside.  These are the addresses to be used by
 !--- the server located inside the firewall.

 static (inside,outside) 209.164.3.5 192.168.2.57 netmask 255.255.255.255

 !--- Apply the access list named smtp inbound on the outside interface.

 access-group smtp in interface outside

 !--- Set the default route to  209.164.3.2. 
 !--- The PIX assumes that this address is that of a router.

 route outside 0.0.0.0 0.0.0.0 209.164.3.2 1
 
 !--- Instruct the PIX to hand any traffic destined for 192.168.x.x
 !--- to the router at 192.168.1.2.

 route inside 192.168.0.0 255.255.0.0 192.168.1.2 1
 timeout xlate 1:30:00 conn 1:00:00 half-closed 0:10:00 udp 0:00:00
 timeout rpc 0:10:00 h323 0:05:00
 timeout uauth 0:00:00 absolute
 aaa-server TACACS+ protocol tacacs+
 aaa-server RADIUS protocol radius
 no snmp-server location
 no snmp-server contact
 snmp-server community public
 no snmp-server enable traps
 floodguard enable
 terminal width 200
 Cryptochecksum:d66eb04bc477f21ffbd5baa21ce0f85a
 : end
 
 !--- Alternate command:
 !--- conduit permit tcp host 209.164.3.5 eq smtp any
 !--- The conduit command is equivalent to 
 !--- the access-list statements this configuration shows.
 !--- In this case a path known as a conduit is created in order to allow any SMTP 
 !--- traffic to host 209.164.3.5.  Use of this command replaces the 
 !--- access-list and access-group 
 !--- statements that this configuration presents.

路由器
Current configuration:
 !
 version 12.0
 service timestamps debug uptime
 service timestamps log uptime
 no service password-encryption
 !
 hostname 2522-R5
 !
 enable secret 5 $1$N0F3$XE2aJhJlCbLWYloDwNvcV.
 !
 ip subnet-zero
 !
 !
 !
 !
 !
 interface Ethernet0
 
 !--- Sets the IP address of the Ethernet interface to 209.164.3.2.

  ip address 209.164.3.2 255.255.255.252
 !
 interface Serial0

  !--- Instructs the serial interface to use 
  !--- the address of the Ethernet interface when the need arises.

  ip unnumbered ethernet 0 
 !
 interface Serial1
  no ip address
  no ip directed-broadcast
 !
 ip classless

 !--- Instructs the router to send all traffic 
 !--- destined for 209.164.3.x to 209.164.3.1.

 ip route 209.164.3.0 255.255.255.0 209.164.3.1

 !--- Instructs the router to send 
 !--- all other remote traffic out serial 0.

 ip route 0.0.0.0 0.0.0.0 serial 0
 !
 !
 line con 0
  transport input none
 line aux 0
  autoselect during-login
 line vty 0 4
  exec-timeout 5 0
  password ww
  login
 !
 end

验证

当前没有可用于此配置的验证过程。

故障排除

logging console debugging 命令将邮件导向到 PIX 控制台。如果与邮件服务器的连接有问题,请检查控制台调试消息,查找发送站和接收站的 IP 地址以便确定问题所在。

建立技术支持请求时应收集的信息

如果还需要援助,在您完成在本文的故障排除步骤并且要开有思科技术支持的后一个Case,请务必包括排除故障的您的PIX防火墙此信息。
  • 问题说明,包括邮件服务器的拓扑和 IP 地址详细信息。
  • 请在打开案例之前完成所有故障排除。
  • 来自 show tech-support 命令的输出。
  • (若有)展示问题从show log命令的输出,在以logging buffered debugging命令后运行或者控制台获取
请以非压缩的纯文本格式 (.txt) 将收集的数据附加到请求中。您可以使用 TAC 服务请求工具仅限注册用户),通过上载信息来将信息附加到案例中。如果无法访问 TAC 服务请求工具,可在邮件的主题行中注明案例号,然后以电子邮件附件形式将信息发送到 attach@cisco.com

相关的思科支持社区讨论

思科支持社区是您提问、解答问题、分享建议以及与工作伙伴协作的论坛。


相关信息


Document ID: 8122