route
- Router#show running-config
- Current configuration : 1354 bytes
- !
- version 12.4
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- !
- hostname Router
- !
- boot-start-marker
- boot-end-marker
- !
- !
- no aaa new-model
- !
- resource policy
- !
- ip cef
- !--- Configuration for IKE policies. !--- Enables the IKE policy configuration (config-isakmp) !--- command mode, where you can specify the parameters that !--- are used during an IKE negotiation.
- crypto isakmp policy 1
- encr 3des
- hash md5
- authentication pre-share
- group 2
- !--- Specifies the preshared key "cisco123" which should !--- be identical at both peers. This is a global !--- configuration mode command.
- crypto isakmp key cisco123 address 192.168.1.2
- !
- !
- !--- Configuration for IPsec policies. !--- Enables the crypto transform configuration mode, !--- where you can specify the transform sets that are used !--- during an IPsec negotiation.
- crypto ipsec transform-set pix-set esp-3des esp-md5-hmac
- !--- Indicates that IKE is used to establish !--- the IPsec Security Association for protecting the !--- traffic specified by this crypto map entry.
- crypto map pix 10 ipsec-isakmp
- !--- Sets the IP address of the remote end.
- set peer 192.168.1.2
- !--- Configures IPsec to use the transform-set !--- "pix-set" defined earlier in this configuration.
- set transform-set pix-set
- !--- Specifies the interesting traffic to be encrypted.
- match address 101
- !
- !
- !
- !
- interface Ethernet0/0
- !--- The interface dynamically learns its IP address !--- from the service provider.
-
- ip address DHCP
- ip virtual-reassembly
- half-duplex
- !--- Configures the interface to use the !--- crypto map "pix" for IPsec.
- crypto map pix
- !
- interface FastEthernet1/0
- no ip address
- shutdown
- duplex auto
- speed auto
- !
- interface Serial2/0
- ip address 10.1.1.2 255.255.255.0
- ip nat inside
- ip virtual-reassembly
- no fair-queue
- !
- interface Serial2/1
- no ip address
- shutdown
- !
- interface Serial2/2
- no ip address
- shutdown
- !
- interface Serial2/3
- no ip address
- shutdown
- !
- ip http server
- no ip http secure-server
- !
- ip route 0.0.0.0 0.0.0.0 Ethernet0/0
- !
- ip nat inside source route-map nonat interface Ethernet0/0 overload
- !
- !--- This crypto ACL 101 -permit identifies the !--- matching traffic flows to be protected via encryption.
- access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
- !--- This ACL 110 identifies the traffic flows using route map and !--- are PATed via outside interface (Ethernet0/0).
- access-list 110 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
- access-list 110 permit ip 10.1.1.0 0.0.0.255 any
- !
- route-map nonat permit 10
- match ip address 110
- !
- !
- control-plane
- !
- !
- line con 0
- line aux 0
- line vty 0 4
- !
- !
- end
- pixfirewall#show running-config
- PIX Version 7.2(1)
- !
- hostname pixfirewall
- enable password 8Ry2YjIyt7RRXU24 encrypted
- names
- !
- !--- Configure the outside and inside interfaces.
- interface Ethernet0
- nameif outside
- security-level 0
- ip address 192.168.1.2 255.255.255.0
- !
- interface Ethernet1
- nameif inside
- security-level 100
- ip address 10.2.2.1 255.255.255.0
- !
- !
- !--- Output is suppressed.
- !
- passwd 2KFQnbNIdI.2KYOU encrypted
- ftp mode passive
- !--- This access list is used for a nat zero command that prevents !--- traffic which matches the access list from undergoing NAT.
- access-list nonat extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0
- pager lines 24
- mtu outside 1500
- mtu inside 1500
- no failover
- no asdm history enable
- arp timeout 14400
- !--- NAT 0 prevents NAT for networks specified in the ACL - nonat. !--- The nat 1 command specifies PAT using !--- the outside interface for all other traffic.
- global (outside) 1 interface
- nat (inside) 0 access-list nonat
- nat (inside) 1 0.0.0.0 0.0.0.0
- route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
- timeout xlate 3:00:00
- timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
- timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
- timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
- timeout uauth 0:05:00 absolute
- no snmp-server location
- no snmp-server contact
- snmp-server enable traps snmp authentication linkup linkdown coldstart
- !--- PHASE 2 CONFIGURATION ---! !--- The encryption types for Phase 2 are defined here. !--- A triple single 3DES encryption with !--- the md5 hash algorithm is used.
- crypto ipsec transform-set router-set esp-3des esp-md5-hmac
- !--- Defines a dynamic crypto map with !--- the specified encryption settings.
- crypto dynamic-map cisco 1 set transform-set router-set
- !--- Enable Reverse Route Injection (RRI), which allows the Security Appliance !--- to learn routing information for connected clients.
- crypto dynamic-map cisco 1 set reverse-route
- !--- Binds the dynamic map to the IPsec/ISAKMP process.
- crypto map dyn-map 10 ipsec-isakmp dynamic cisco
- !--- Specifies the interface to be used with !--- the settings defined in this configuration.
- crypto map dyn-map interface outside
- !--- PHASE 1 CONFIGURATION ---! !--- This configuration uses isakmp policy 10. !--- Policy 65535 is included in the config by default. !--- The configuration commands here define the Phase !--- 1 policy parameters that are used.
- crypto isakmp policy 10
- authentication pre-share
- encryption 3des
- hash md5
- group 2
- lifetime 86400
- crypto isakmp policy 65535
- authentication pre-share
- encryption 3des
- hash sha
- group 2
- lifetime 86400
- !--- The security appliance provides the default tunnel groups !--- for Lan to Lan access (DefaultL2LGroup) and configure the preshared key !--- (cisco123) to authenticate the remote router.
- tunnel-group DefaultL2LGroup ipsec-attributes
- pre-shared-key *
- telnet timeout 5
- ssh timeout 5
- console timeout 0
- !
- class-map inspection_default
- match default-inspection-traffic
- !
- !
- policy-map type inspect dns preset_dns_map
- parameters
- message-length maximum 512
- policy-map global_policy
- class inspection_default
- inspect dns preset_dns_map
- inspect ftp
- inspect h323 h225
- inspect h323 ras
- inspect netbios
- inspect rsh
- inspect rtsp
- inspect skinny
- inspect esmtp
- inspect sqlnet
- inspect sunrpc
- inspect tftp
- inspect sip
- inspect xdmcp
- !
- service-policy global_policy global
- prompt hostname context
- Cryptochecksum:6ed4a7bce392a439d0a16e86743e2663
- 清除安全关联 (SA)
- 在 PIX 的特权模式下使用以下这些命令：
- clear [crypto] ipsec sa - 删除活动 IPsec SA。关键字 crypto 是可选的。
- clear [crypto] isakmp sa - 删除活动 IKE SA。关键字 crypto 是可选的。
- show crypto isakmp sa
- show crypto ipsec sa
- PIX 安全设备 - debug 输出
- debug crypto ipsec 7 - 显示第 2 阶段的 IPsec 协商。
- debug crypto isakmp 7 - 显示第 1 阶段的 ISAKMP 协商。
- 远程 IOS 路由器 - debug 输出
- debug crypto ipsec - 显示第 2 阶段的 IPsec 协商。
- debug crypto isakmp - 显示第 1 阶段的 ISAKMP 协商。