在pix或asa如何防止内网用户乱改ip配置案例

核心提示： access-group inside_access_in in interface insideroute outside 0.0.0.0 0.0.0.0 X.X.76.25 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0

****************************************************
access-group inside_access_in in interface inside
****************************************************
route outside 0.0.0.0 0.0.0.0 X.X.76.25 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy caiwu internal
group-policy caiwu attributes
dns-server value 219.150.32.132
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value caiwu_splitTunnelAcl
group-policy remote internal
group-policy remote attributes
dns-server value 219.150.32.132
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value remote_splitTunnelAcl
username chufw password hs6C0g7Y0Zza/dVN encrypted privilege 15
username chufw attributes
vpn-group-policy remote
vpn-framed-ip-address 1.1.1.111 255.255.255.0
http server enable
http chufw 255.255.255.255 inside
http 219.148.242.228 255.255.255.255 outside
http 219.148.242.227 255.255.255.255 outside
http 1.1.1.111 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal　20
tunnel-group remote type ipsec-ra
tunnel-group remote general-attributes
address-pool remote
default-group-policy remote
tunnel-group remote ipsec-attributes
pre-shared-key *
tunnel-group caiwu type ipsec-ra
tunnel-group caiwu general-attributes
address-pool remote
default-group-policy caiwu
tunnel-group caiwu ipsec-attributes
pre-shared-key *
telnet chufw 255.255.255.255 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
　message-length maximum 512
policy-map global_policy
class inspection_default
　inspect dns preset_dns_map
　inspect ftp
　inspect h323 h225
　inspect h323 ras
　inspect netbios
　inspect rsh
　inspect rtsp
　inspect skinny
　inspect esmtp
　inspect sqlnet
　inspect sunrpc
　inspect tftp
　inspect sip
　inspect xdmcp
!
service-policy global_policy global
ntp server 207.46.130.100 source outside
tftp-server inside chufw pix
prompt hostname context
Cryptochecksum:c02e836587f08fa6ce4699df28408774
: end
pix515e#