Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 535)

B-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Appendix B Sample Configurations

Example 3: Shared Resources for Multiple Contexts

route outside 0 0 209.165.201.1 1

nat (dept1) 1 10.1.1.0 255.255.255.0

nat (dept2) 1 10.1.2.0 255.255.255.0

The dept1 and dept2 networks use PAT when accessing the outside

global (outside) 1 209.165.201.9 netmask 255.255.255.255

Because we perform dynamic NAT on these addresses for outside access, we need to perform

NAT on them for all other interface access. This identity static statement just

translates the local address to the same address.

static (dept1,dept2) 10.1.1.0 10.1.1.0 netmask 255.255.255.0

static (dept2,dept1) 10.1.2.0 10.1.2.0 netmask 255.255.255.0

The syslog server uses a static translation so the outside management host can access

the server

static (dmz,outside) 209.165.201.5 192.168.2.2 netmask 255.255.255.255

access-list MANAGE remark Allows the management host to access the syslog server

access-list MANAGE extended permit tcp host 209.165.200.225 host 209.165.201.5 eq telnet

access-group MANAGE in interface outside

Advertises the security appliance IP address as the default gateway for the downstream

router. The security appliance does not advertise a default route to the router.

rip dept2 default version 2 authentication md5 scorpius 1

Listens for RIP updates from the downstream router. The security appliance does not

listen for RIP updates from the router because a default route to the router is all that

is required.

rip dept2 passive version 2 authentication md5 scorpius 1

The client uses a pre-shared key to connect to the security appliance over IPSec. The

key is the password in the username command following.

isakmp policy 1 authentication pre-share

isakmp policy 1 encryption 3des

isakmp policy 1 group 2

isakmp policy 1 hash sha

isakmp enable outside

crypto ipsec transform-set vpn_client esp-3des esp-sha-hmac

username admin password passw0rd

crypto ipsec transform-set vpn esp-3des esp-sha-hmac

crypto dynamic-map vpn_client 1 set transform-set vpn

crypto map telnet_tunnel 1 ipsec-isakmp dynamic vpn_client

crypto map telnet_tunnel interface outside

ip local pool client_pool 10.1.1.2

access-list VPN_SPLIT extended permit ip host 209.165.201.3 host 10.1.1.2

telnet 10.1.1.2 255.255.255.255 outside

telnet timeout 30

logging trap 5

System messages are sent to the syslog server on the DMZ network

logging host dmz 192.168.2.2

logging on

Example 3: Shared Resources for Multiple Contexts

This configuration includes multiple contexts for multiple departments within a company. Each

department has its own security context so that each department can have its own security policy.

However, the syslog, mail, and AAA servers are shared across all departments. These servers are placed

on a shared interface (see Figure B-3).

Department 1 has a web server that outside users who are authenticated by the AAA server can access.

1 2 ... 530 531 532 533 534 535 536 537 538 539 540 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 535

Kommentare zu diesen Handbüchern