配置PIX Failover(四)

　2008-12-18 12:18:53　来源：WEB开发网　闂傚倸鍊搁崐椋庢濮橆兗缂氱憸宥堢亱闂佸湱铏庨崰鏍不椤栫偞鐓ラ柣鏇炲€圭€氾拷

闂傚倸鍊搁崐椋庣矆娓氣偓楠炲鏁撻悩鎻掔€梺姹囧灩閻忔艾鐣烽弻銉︾厵闁规鍠栭。濂告煕鎼达紕校闁靛洤瀚伴獮鎺楀箣濠靛啫浜鹃柣銏⑶圭壕濠氭煙閻愵剚鐏辨俊鎻掔墛缁绘盯宕卞Δ鍐冣剝绻涘畝濠佺敖缂佽鲸鎹囧畷鎺戭潩閹典焦鐎搁梻浣烘嚀閸ゆ牠骞忛敓锟�

婵犵數濮烽弫鍛婃叏椤撱垹绠柛鎰靛枛瀹告繃銇勯幘瀵哥畼闁硅娲熷缁樼瑹閳ь剙岣胯鐓ら柕鍫濇偪濞差亜惟闁宠桨鑳堕崝锕€顪冮妶鍡楃瑐闁煎啿鐖奸崺濠囧即閵忥紕鍘梺鎼炲劗閺呮稒绂掕缁辨帗娼忛埡浣锋闂佽桨鐒﹂幑鍥极閹剧粯鏅搁柨鐕傛嫹闂傚倸鍊搁崐椋庢濮橆兗缂氱憸宥堢亱闂佸湱铏庨崰鏍不椤栫偞鐓ラ柣鏇炲€圭€氾拷　　闂傚倸鍊搁崐鐑芥嚄閼哥數浠氱紓鍌欒兌缁垶銆冮崨鏉戠厺鐎广儱顦崡鎶芥煏韫囨洖校闁诲寒鍓熷铏圭磼濡搫顫嶅銈嗗姉閸樠囧煡婢跺á鐔兼煥鐎ｎ兘鍋撴繝姘拺鐟滅増甯掓禍浼存煕閹惧鈽夐柍缁樻煥椤繈鎳滅喊妯诲闂備礁鎲＄粙鎴︺偑閺夋垟鏋旈柡鍐ｅ亾缂佺粯绋撴禒锕傚磼濮橆剦鐎抽梻浣哥－缁垶骞戦崶顒傚祦閻庯綆浜栭弨浠嬫煙闁箑澧い鏂垮€规穱濠囨倷椤忓嫧鍋撻弽褜娼栧┑鐘宠壘閸屻劎鎲歌箛娑樼疅闁圭虎鍠楅弲鎼佹煥閻曞倹瀚�

核心提示： 例2 基于LAN的Failover主PIX配置nameif ethernet0 outside security0nameif ethernet1 inside security100nameif ethernet2 stateful security10nameif ethernet3

例2 基于LAN的Failover主PIX配置

　　nameif ethernet0 outside security0 　　nameif ethernet1 inside security100 　　nameif ethernet2 stateful security10 　　nameif ethernet3 lanfover security20 　　enable password xxx encrypted 　　passwd xxx encrypted 　　hostname pixfirewall 　　fixup protocol ftp 21 　　fixup protocol http 80 　　fixup protocol smtp 25 　　fixup protocol h323 1720 　　fixup protocol rsh 514 　　fixup protocol sqlnet 1521 　　names 　　pager lines 20 　　no logging timestamp 　　no logging standby 　　logging console errors 　　no logging monitor 　　no logging buffered 　　no logging trap 　　logging facility 20 　　logging queue 512 　　interface ethernet0 100full 　　interface ethernet1 100full 　　interface ethernet2 100full 　　interface ethernet3 100full 　　mtu outside 1500 　　mtu inside 1500 　　mtu failover 1500 　　mtu unused 1500 　　ip address outside 209.165.201.1 255.255.255.224 　　ip address inside 192.168.2.1 255.255.255.0 　　ip address failover 192.168.254.1 255.255.255.0 　　ip address unused 192.168.253.1 255.255.255.252 　　failover 　　failover ip address outside 209.165.201.2 　　failover ip address inside 192.168.2.2 　　failover ip address stateful 192.168.254.2 　　failover ip address lanfover 192.168.253.2 　　failover link stateful 　　failover lan unit primary 　　failover lan interface lanfover 　　failover lan key 12345678 　　failover lan enable 　　arp timeout 14400 　　global (outside) 1 209.165.201.3 netmask 255.255.255.224 　　nat (inside) 1 0.0.0.0 0.0.0.0 0 0 　　static (inside,outside) 209.165.201.5 192.168.2.5 netmask 255.255.255.255 0 0 　　access-list acl_out permit tcp any 209.165.201.5 eq 80 　　access-list acl_out permit icmp any any 　　access-group acl_out in interface outside 　　access-list acl_ping permit icmp any any 　　access-group acl_ping in interface inside 　　no rip outside passive 　　no rip outside default 　　no rip inside passive 　　no rip inside default 　　no rip failover passive 　　no rip failover default 　　route outside 0 0 209.165.201.4 1 　　timeout xlate 3:00:00 　　timeout conn 1:00:00 half-closed 0:10:00 　　udp 0:02:00 rpc 0:10:00 h323 0:05:00 　　sip 0:30:00 sip_media 0:02:00 　　timeout uauth 0:05:00 absolute 　　aaa-server TACACS+ protocol tacacs+ 　　aaa-server RADIUS protocol radius 　　no snmp-server location 　　no snmp-server contact 　　snmp-server community public 　　no snmp-server enable traps 　　telnet timeout 5 　　terminal width 80　　

例3 基于LAN的Failover备用PIX配置

　　nameif ethernet3 stateful security20 　　interface ethernet3 100full 　　ip address lanfover 192.168.253.1 255.255.255.252 　　failover ip address lanfover 192.168.254.2 　　failover lan unit primary 　　failover lan interface lanfover 　　failover lan key 12345678 　　failover lan enable 　　failover

上一页 1 2