Suggested prerequisite reading:
»Cisco Forum FAQ »Things to expect when setup network for home or small business
Typical network environment that might utilize following sample PIX configuration is as follows
* There is a modem in front of the PIX, which the modem connects to the ISP
* ISP is providing Public IP address to the PIX statically
* There is NAT/PAT in place on the PIX to translate internal IP addresses to the ISP-provided Public IP address
* The router behind the PIX is directly connected physically to the PIX LAN (inside) interface using crossover patch cableN
* No devices (workstations, servers, switches, hubs) are sitting between the PIX and the router
* All the switches, workstations, and servers are sitting behind the router
* The router is acting as DHCP server, which provide dynamic IP info for hosts behind the router
* The router is not able to provide stateful firewall protection; hence PIX is setup in front of the router before connecting to the ISP (the modem) to protect your LAN from unauthorized accesses
This sample configuration assumes the followings:
* You receive a static IP address from ISP as 1.1.1.2
* The ISP default gateway is 1.1.1.1
* You are running servers visible to the public
* The servers are web, mail, and ftp
* Your internal webserver IP address is 192.168.100.1
* Your internal ftp server IP address is 192.168.100.2
* Your internal mail server IP address is 192.168.100.3
* You have syslog server with IP address of 192.168.100.5
* You use 1.1.1.2 (the PIX outside interface IP address) to be your three server's public IP address (static PAT)
* You permit only internal host of 192.168.100.4 to telnet and to pdm to the PIX
* Internal hosts are receiving IP address automatically (as DHCP clients) from the router
* Since the PIX inside interface subnet is /30, there would be no other IP-based hosts between the PIX and the router within the same subnet
PIX Configuration
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ***** encrypted
passwd ***** encrypted
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 1.1.1.2 PUBLIC_IP_01
name 192.168.100.1 WEB_SERVER_01
name 192.168.100.2 FTP_SERVER_01
name 192.168.100.3 MAIL_SERVER_01
name 192.168.100.4 TERMINAL_SERVER_01
name 192.168.100.5 SYSLOG_SERVER_01
object-group icmp-type ICMP-INBOUND
description Allowable inbound ICMP traffic
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded
object-group service PUBLIC_SERVER-TCP tcp
description Allowable inbound TCP traffic
port-object range ftp-data ftp
port-object eq smtp
port-object eq www
access-list INBOUND permit icmp any host PUBLIC_IP_01 object-group ICMP-INBOUND
access-list INBOUND permit tcp any host PUBLIC_IP_01 object-group PUBLIC_SERVER-TCP
pager lines 24
logging on
logging trap informational
logging host inside SYSLOG_SERVER_01
mtu outside 1500
mtu inside 1500
ip address outside PUBLIC_IP_01 255.255.255.0
ip address inside 10.0.0.1 255.255.255.252
ip audit info action alarm
ip audit attack action alarm
pdm location TERMINAL_SERVER_01 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www WEB_SERVER_01 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp-data FTP_SERVER_01 ftp-data netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp FTP_SERVER_01 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp MAIL_SERVER_01 smtp netmask 255.255.255.255 0 0
access-group INBOUND in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
route inside 192.168.100.0 255.255.255.0 10.0.0.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http TERMINAL_SERVER_01 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet TERMINAL_SERVER_01 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Router Configuration
service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
enable password 7 ******
!
memory-size iomem 25
clock timezone eastern -2
no aaa new-model
ip subnet-zero
!
!
ip name-server 68.87.64.196
ip name-server 68.87.66.196
ip dhcp excluded-address 192.168.100.1 192.168.100.5
ip dhcp excluded-address 192.168.100.254
!
ip dhcp pool INSIDE-LAN
network 192.168.100.0 255.255.255.0
default-router 192.168.100.254
dns-server 68.87.64.196 68.87.66.196
!
no ip bootp server
ip cef
!
!
!
!
interface FastEthernet0
ip address 10.0.0.2 255.255.255.252
no ip redirects
no ip proxy-arp
speed auto
duplex auto
no cdp enable
!
interface FastEthernet1
ip address 192.168.100.254 255.255.255.0
no ip redirects
no ip proxy-arp
speed 100
full-duplex
no cdp enable
hold-queue 100 out
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.1
no ip http server
!
logging history warnings
logging 192.168.100.5
no cdp run
!
line con 0
line aux 0
line vty 0 4
exec-timeout 120 0
password 7 ******
login
!
end
 feedback form
 feedback form
by aryoba 
last modified: 2008-01-13 16:30:03 |
