论坛: 系统集成 标题: 加装防火墙前后的路由器配置 复制本贴地址

作者: feng5 [feng5]

登录

随着人们对网络知识的普及，企业或公司的网络安全性，就变得更加重要起来了。关于网络安全的最可靠方法是加装防火墙。 在这里我讲述一下关于加装防火墙前后的路由配置变化，因为在原先没有防火墙的情况下，路由既起到路由选择的作用，又起到网关的作用。当加装防火墙的后，局域网的网关就设为防火墙的局域网IP地址。要修改路由首先还是先看该网络的拓扑结构。在这里我所描述的是这样拓扑结构： 图　1 一、先将进入路由器设置将原来的配置备份一份，虽然这一份备份以后不一定用的上，可是万一防火墙安装失败呢？ 图　2 下面为没有安装防火墙以前的路由器配置情况。 User Access Verification Password: （键入TELNET密码，如果你是直接用CONSOLE口进入没有此项提示） Router>en Password: Router#show config （察看ROUTER配置情况命令） Using 810 out of 7506 bytes ! version 12.1 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Router （ROUTER名字，这里为默认名字ROUTER） ! enable secret 5 $1$FreK$4oQGtvDEF1jv8dh3NNXnN0. enable password 123456789 （特权密码，当然这是加密的） ! ip subnet-zero ! interface Ethernet0 (配置局域网e0口) ip address 192.168.1.1 255.255.255.0 （e0口在其局域网中对应的ip为192.168.1.1 ip nat inside 255.255.255.0是表示为C类网络) ! interface Ethernet1 (E1口没有激活,也没有配置) no ip address shutdown ! interface Serial0 bandwidth 2048 ip address 211.97.213.41 255.255.255.252 (此为定义ROUTER外部接口的IP ip nat outside 255.255.255.252表示此合法的INTERNET-IP) encapsulation ppp ! ip nat pool 165 211.97.213.41 211.97.213.46 netmask 255.255.255.248 (isp给你分配的ip) ip nat inside source list 1 pool 165 overload ip classless ip route 0.0.0.0 0.0.0.0 Serial0 no ip http server ! access-list 1 permit 192.168.1.0 0.0.0.255 ! line con 0 transport input none line vty 0 1 password 123456 login ! end Router# 二、按照图1装上防火墙。 将从路由器到交换机上的线，改为先从路由器到防火墙，然后用防火墙的E0口接交换机。 图　3 进入路由器配置模式修改，将路由器的配置改为： Using 942 out of 7506 bytes ! version 12.1 service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname router !enable secret 5 $1$FreK$4oQGtvDEF1jv8dh3NNXnN0 enable password 123455676! ! ip subnet-zero ! crypto ipsec transform-set test esp-des esp-md5-hmac ! crypto map vpnmap 1 ipsec-isakmp ! Incomplete set transform-set test match address 100 interface Ethernet0 ip address 211.97.213.41 255.255.255.248 interface Ethernet1 no ip address ip nat inside no ip route-cache no ip mroute-cache shutdown ! ! interface Serial0 description internet bandwidth 2048 ip address 211.97.209.145 255.255.255.252 ip nat outside encapsulation ppp no ip route-cache no ip mroute-cache ! ip classless ip route 0.0.0.0 0.0.0.0 Serial0 ip http server ! route-map nonat permit 10 match ip address 110 ! ! line con 0 transport input none line vty 0 4 password 123456 login ! end 三、这时候，你可以配置你的防火墙了，以下是防火墙的配置情况： PIX Version 5.1(2) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 pix/intf2 security10 hostname imrac_c_pix fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 1720 fixup protocol rsh 514 fixup protocol smtp 25 fixup protocol sqlnet 1521 no names access-list 100 permit ip 192.168.1.1 255.255.255.0 192.168.0.0 255.255.255.0 access-list 100 permit ip 192.168.1.1 255.255.255.0 192.100.0.0 255.255.255.0 pager lines 24 logging on no logging timestamp no logging standby no logging console no logging monitor no logging buffered no logging trap logging facility 20 logging queue 512 interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto shutdown mtu outside 1500 mtu inside 1500 mtu pix/intf2 1500 ip address outside 211.97.213.44 255.255.255.248 ip address inside 192.168.1.1 255.255.255.0 ip address pix/intf2 127.0.0.1 255.255.255.255 no failover failover timeout 0:00:00 failover ip address outside 0.0.0.0 failover ip address inside 0.0.0.0 failover ip address pix/intf2 0.0.0.0 arp timeout 14400 global (outside) 1 211.97.213.45 netmask 255.255.255.248 nat (inside) 0 access-list 100 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 route outside 0.0.0.0 0.0.0.0 211.97.213.41 1 timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00 timeout rpc 0:10:00 h323 0:05:00 aaa-server RADIUS protocol radius no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set trans esp-des esp-md5-hmac crypto map vpnmap 40 ipsec-isakmp crypto map vpnmap 40 match address 100 crypto map vpnmap 40 set transform-set trans crypto map vpnmap interface outside isakmp enable outside isakmp identity address isakmp policy 1 authentication pre-share isakmp policy 1 encryption des isakmp policy 1 hash md5 isakmp policy 1 group 1 isakmp policy 1 lifetime 86400 telnet 192.168.1.88 255.255.255.255 inside telnet timeout 5 terminal width 80 Cryptochecksum:7fd10854228b7e32b2808508f49a65a7 [此贴被 交换机(feng5) 在 05月19日12时27分 编辑过]

回复: lobam [xx_js]   论坛用户

登录

回复: feng5 [feng5]

登录

20CN网络安全小组版权所有
Copyright © 2000-2010 20CN Security Group. All Rights Reserved.
论坛程序编写：NetDemon

粤ICP备05087286号