在pix或asa如何防止内网用户乱改ip配置案例

核心提示： access-list inside_access_in extended deny ip any 192.168.0.0 255.255.255.0access-list inside_access_in extended permit ip object-group caiwu 192

****************************************************
access-list inside_access_in extended deny ip any 192.168.0.0 255.255.255.0
access-list inside_access_in extended permit ip object-group caiwu 192.168.0.0 255.255.255.0
access-list inside_access_in extended permit ip object-group www any
access-list inside_access_in extended permit ip object-group guest any inactive
access-list inside_access_in extended deny tcp any any eq 1863
access-list inside_access_in extended permit ip host lixiaoliang host 211.147.77.98
access-list inside_access_in extended permit ip host qizuomeng host 211.147.77.98
access-list inside_access_in extended permit ip object-group worktime any time-range worktime
access-list inside_access_in extended permit ip host ibm235 any time-range worktime inactive
****************************************************
access-list remote_splitTunnelAcl standard permit 10.64.64.0 255.255.240.0
access-list inside_nat0_outbound extended permit ip 10.64.64.0 255.255.240.0 1.1.1.0 255.255.255.0
access-list outside_cryptomap extended permit ip any 1.1.1.0 255.255.255.0
access-list caiwu_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list outside_cryptomap_1 extended permit ip any 1.1.1.0 255.255.255.0
access-list dmz_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 1.1.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool remote 1.1.1.1-1.1.1.254 mask 255.255.255.0
ip local pool caiwu 2.2.2.1-2.2.2.254 mask 255.255.255.0
no failover
asdm image flash:/asdm.bin
no asdm history enable

把ip和mac绑定