Newsgroup: it.comp.reti.cisco
Titolo: Mia configurazione PIX 515E e problema DMZ

Come detto in un post di qualche giorno fa sono alle prime armi con la 
configurazione di un Cisco Pix Firewall 515e, sono in fase di test e non 
riesco a far funzionare la dmz (il cavo dell'ethernet2 è collegato ad uno 
switch dedicato ai server dmz). Sicuramente in questa configurazione ci sono 
errori o settaggi inutili se c'è qualcuno che vuol buttarci un'occhiata e 
dirmi dove sbaglio o darmi qualsiasi consiglio gliene sono grato. Ringrazio 
chi risponde.
St.1
Ho 8 ip pubblici di telecom Italia su 255.255.255.248
Result of firewall command: "show running-config"
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password m5*********** encrypted
passwd 2K********** encrypted
hostname pixtest**
domain-name c****
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.2.248 webserver
object-group service Ultravnc5800 tcp
  port-object range 5800 5800
  port-object range 5900 5900
object-group service RemoteDesktop3389 tcp
  port-object range 3389 3389
object-group service Ntp tcp-udp
  description Orario Ntp su Server ien
  port-object range 123 123
access-list inside_access_in permit ip any any
access-list inside_access_in remark Ntp orario server ien
access-list inside_access_in permit tcp host 192.168.1.253 object-group Ntp 
interface outside object-group Ntp
access-list inside_access_in remark Da Inside a Dmz Ultravnc
access-list inside_access_in permit tcp any object-group Ultravnc5800 any 
object-group Ultravnc5800
access-list inside_access_in remark Ping icmp da inside a outside
access-list inside_access_in permit icmp any any
access-list acl_out deny tcp any any eq telnet
access-list acl_out permit ip any any
access-list acl_out permit tcp any eq 1433 any eq 1433
access-list acl_out permit udp any eq 1434 any eq 1434
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 8*.***.**.*3
access-list inside_outbound_nat0_acl permit ip any 192.168.1.240 
255.255.255.252
pager lines 24
logging on
icmp deny any outside
icmp deny any echo-reply outside
icmp deny any echo outside
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 8*.***.**.*2 255.255.255.248
ip address inside 192.168.1.31 255.255.255.0
ip address dmz 192.168.2.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNRangeIP 192.168.1.240-192.168.1.242
pdm location 10.1.0.0 255.255.0.0 inside
pdm location 192.168.1.120 255.255.255.255 inside
pdm location 192.168.1.153 255.255.255.255 inside
pdm location 192.168.1.207 255.255.255.255 inside
pdm location 192.168.1.253 255.255.255.255 inside
pdm location 192.168.1.240 255.255.255.252 outside
pdm location 8*.***.**.*2 255.255.255.255 outside
pdm location webserver 255.255.255.255 dmz
pdm location 192.168.2.249 255.255.255.255 dmz
pdm logging critical 100
pdm history enable
arp timeout 14400
global (outside) 10 interface
global (dmz) 1 webserver-192.168.2.250
global (dmz) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.2.0 255.255.255.0 0 0
static (dmz,outside) 8*.***.**.*2 webserver netmask 255.255.255.255 0 0
static (dmz,outside) 8*.***.**:*5 192.168.2.249 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 8*.***.**.*1 1
route inside 10.1.0.0 255.255.0.0 192.168.1.201 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
ntp server 193.204.114.232 source outside prefer
ntp server 193.204.114.233 source outside prefer
http server enable
http 192.168.1.153 255.255.255.255 inside
http 192.168.1.207 255.255.255.255 inside
http 192.168.1.253 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
telnet 192.168.1.153 255.255.255.255 inside
telnet 192.168.1.207 255.255.255.255 inside
telnet 192.168.1.253 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
management-access outside
console timeout 0
vpdn group UtentiPPTP accept dialin pptp
vpdn group UtentiPPTP ppp authentication pap
vpdn group UtentiPPTP ppp authentication chap
vpdn group UtentiPPTP client configuration address local VPNRangeIP
vpdn group UtentiPPTP client configuration dns 192.168.1.253 192.168.1.247
vpdn group UtentiPPTP pptp echo 60
vpdn group UtentiPPTP client authentication local
vpdn username test password *********
vpdn enable outside
username m**** password h*********** encrypted privilege 2
terminal width 80
Cryptochecksum:bf73b90
: end

 configurazione di un Cisco Pix Firewall 515e, sono in fase di test e non 
potresti continuare nel thread precedente?


wrote:


 ...scusa funziona??
Sě, funziona bene. E' il server dell'Istituto Galileo Ferraris di Torino, le 
porte da aprire (a scapito della sicurezza credo...) 123tcp 123udp