Исходное сообщение
"PAT на Cisco 871" Отправлено BooMbl4, 18-Июн-10 15:00
>Тут бред написан: >Перепутали вход-выход. Ой, это остатки экспериментов - потер. Итак внутренний интерфейс и ACL: ! interface Vlan1 description $FW_INSIDE$ ip address 10.0.0.211 255.255.255.0 ip access-group 104 in no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery ip flow ingress ip flow egress ip nat inside ip virtual-reassembly ! access-list 104 remark auto generated by CCP firewall configuration access-list 104 remark CCP_ACL Category=1 access-list 104 remark MS updates deny from WS access-list 104 deny   ip object-group WS object-group MSUpdates log-input access-list 104 permit ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 log-input access-list 104 permit udp host 10.0.0.221 eq 1645 host 10.0.0.211 access-list 104 permit udp host 10.0.0.221 eq 1646 host 10.0.0.211 access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.211 access-list 104 permit udp 10.0.0.0 0.0.0.255 host 10.0.0.211 access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq ftp access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq ftp-data access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq pop3 access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq smtp access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq telnet access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq www access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 443 access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 5190 access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 5002 access-list 104 permit gre 10.0.0.0 0.0.0.255 any access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 1723 access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.122 eq 88 access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.122 eq 83 access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.123 eq www access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.124 eq www access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 995 access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 465 access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 993 access-list 104 permit icmp 10.0.0.0 0.0.0.255 any echo-reply access-list 104 permit icmp 10.0.0.0 0.0.0.255 any echo access-list 104 permit udp host 10.0.0.221 any eq ntp access-list 104 permit udp host 10.0.0.221 any eq domain access-list 104 permit tcp host 10.0.0.221 any eq domain access-list 104 deny   ip any any log-input ! Внешний интерфейс и его ACL 101: ! interface FastEthernet4 description $ES_WAN$$ETH-WAN$$FW_OUTSIDE$ bandwidth 1024 ip address X.X.X.94 255.255.255.252 ip access-group 101 in ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery ip nat outside ip inspect INET_TO_LAN in ip inspect CCP_LOW out ip virtual-reassembly duplex auto speed auto snmp trap ip verify drop-rate service-policy input sdmappfwp2p_CCP_LOW service-policy output SDM-QoS-Policy-2 ! access-list 101 remark CCP_ACL Category=1 access-list 101 permit udp host X.X.X.X eq ntp host X.X.X.94 eq ntp access-list 101 permit udp host X.X.X.121 host X.X.X.122 eq tftp access-list 101 permit gre any host X.X.X.126 access-list 101 permit tcp any host X.X.X.122 eq www access-list 101 permit tcp any host X.X.X.123 eq www access-list 101 permit tcp any host X.X.X.124 eq www access-list 101 permit tcp any host X.X.X.126 eq 1723 access-list 101 permit udp any host X.X.X.122 eq domain access-list 101 permit tcp any host X.X.X.122 eq domain access-list 101 permit tcp any host X.X.X.122 eq smtp log-input access-list 101 permit tcp any host X.X.X.122 eq ftp access-list 101 permit tcp any host X.X.X.122 eq 88 log-input access-list 101 permit tcp any host X.X.X.122 eq 83 log-input access-list 101 permit tcp any host X.X.X.125 eq 5002 log-input access-list 101 permit tcp any host X.X.X.125 eq 5005 log-input access-list 101 permit udp host 10.0.0.222 eq domain host X.X.X.94 access-list 101 permit udp host 10.0.0.221 eq domain host X.X.X.94 access-list 101 permit icmp any host X.X.X.94 echo-reply access-list 101 permit icmp any host X.X.X.94 time-exceeded access-list 101 permit icmp any host X.X.X.94 unreachable access-list 101 deny   ip any any log-input ! Правила трансляции: ! ip nat inside source static tcp 10.0.0.222 88 X.X.X.123 80 extendable ip nat inside source static tcp 10.0.0.222 83 X.X.X.124 80 extendable ! Результаты sh ip nat tra: tcp Х.Х.Х.124:80   10.0.0.222:83      ---                ---                 tcp Х.Х.Х.123:80   10.0.0.222:88      ---                ---                 Стучусь из вне (http://ping.eu/port-chk/ или другого источника): еcp Х.Х.Х.124:80   10.0.0.222:83      85.25.86.50:45719  85.25.86.50:45719   Результат - порт закрыт.

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	>>Тут бред написан: >>Перепутали вход-выход. > Ой, это остатки экспериментов - потер. > Итак внутренний интерфейс и ACL: > ! > interface Vlan1 > description $FW_INSIDE$ > ip address 10.0.0.211 255.255.255.0 > ip access-group 104 in > no ip redirects > no ip unreachables > no ip proxy-arp > ip nbar protocol-discovery > ip flow ingress > ip flow egress > ip nat inside > ip virtual-reassembly > ! > access-list 104 remark auto generated by CCP firewall configuration > access-list 104 remark CCP_ACL Category=1 > access-list 104 remark MS updates deny from WS > access-list 104 deny ip object-group WS object-group MSUpdates log-input > access-list 104 permit ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 log-input > access-list 104 permit udp host 10.0.0.221 eq 1645 host 10.0.0.211 > access-list 104 permit udp host 10.0.0.221 eq 1646 host 10.0.0.211 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.211 > access-list 104 permit udp 10.0.0.0 0.0.0.255 host 10.0.0.211 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq ftp > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq ftp-data > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq pop3 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq smtp > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq telnet > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq www > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 443 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 5190 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 5002 > access-list 104 permit gre 10.0.0.0 0.0.0.255 any > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 1723 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.122 eq 88 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.122 eq 83 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.123 eq www > access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.124 eq www > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 995 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 465 > access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 993 > access-list 104 permit icmp 10.0.0.0 0.0.0.255 any echo-reply > access-list 104 permit icmp 10.0.0.0 0.0.0.255 any echo > access-list 104 permit udp host 10.0.0.221 any eq ntp > access-list 104 permit udp host 10.0.0.221 any eq domain > access-list 104 permit tcp host 10.0.0.221 any eq domain > access-list 104 deny ip any any log-input > ! > Внешний интерфейс и его ACL 101: > ! > interface FastEthernet4 > description $ES_WAN$$ETH-WAN$$FW_OUTSIDE$ > bandwidth 1024 > ip address X.X.X.94 255.255.255.252 > ip access-group 101 in > ip verify unicast reverse-path > no ip redirects > no ip unreachables > no ip proxy-arp > ip nbar protocol-discovery > ip nat outside > ip inspect INET_TO_LAN in > ip inspect CCP_LOW out > ip virtual-reassembly > duplex auto > speed auto > snmp trap ip verify drop-rate > service-policy input sdmappfwp2p_CCP_LOW > service-policy output SDM-QoS-Policy-2 > ! > access-list 101 remark CCP_ACL Category=1 > access-list 101 permit udp host X.X.X.X eq ntp host X.X.X.94 eq ntp > access-list 101 permit udp host X.X.X.121 host X.X.X.122 eq tftp > access-list 101 permit gre any host X.X.X.126 > access-list 101 permit tcp any host X.X.X.122 eq www > access-list 101 permit tcp any host X.X.X.123 eq www > access-list 101 permit tcp any host X.X.X.124 eq www > access-list 101 permit tcp any host X.X.X.126 eq 1723 > access-list 101 permit udp any host X.X.X.122 eq domain > access-list 101 permit tcp any host X.X.X.122 eq domain > access-list 101 permit tcp any host X.X.X.122 eq smtp log-input > access-list 101 permit tcp any host X.X.X.122 eq ftp > access-list 101 permit tcp any host X.X.X.122 eq 88 log-input > access-list 101 permit tcp any host X.X.X.122 eq 83 log-input > access-list 101 permit tcp any host X.X.X.125 eq 5002 log-input > access-list 101 permit tcp any host X.X.X.125 eq 5005 log-input > access-list 101 permit udp host 10.0.0.222 eq domain host X.X.X.94 > access-list 101 permit udp host 10.0.0.221 eq domain host X.X.X.94 > access-list 101 permit icmp any host X.X.X.94 echo-reply > access-list 101 permit icmp any host X.X.X.94 time-exceeded > access-list 101 permit icmp any host X.X.X.94 unreachable > access-list 101 deny ip any any log-input > ! > Правила трансляции: > ! > ip nat inside source static tcp 10.0.0.222 88 X.X.X.123 80 extendable > ip nat inside source static tcp 10.0.0.222 83 X.X.X.124 80 extendable > ! > Результаты sh ip nat tra: > tcp Х.Х.Х.124:80 10.0.0.222:83 --- > > --- > tcp Х.Х.Х.123:80 10.0.0.222:88 --- > > --- > Стучусь из вне (http://ping.eu/port-chk/ или другого источника): > еcp Х.Х.Х.124:80 10.0.0.222:83 85.25.86.50:45719 > 85.25.86.50:45719 > Результат - порт закрыт.
	Введите код, изображенный на картинке: