pix7.x
- HQPIX(config)#show run
- PIX Version 7.0(0)102
- names
- !
- interface Ethernet0
- description WAN interface
- nameif outside
- security-level 0
- ip address 172.17.63.229 255.255.255.240
- !
- interface Ethernet1
- nameif inside
- security-level 100
- ip address 10.1.1.1 255.255.255.0
- !
- interface Ethernet2
- shutdown
- no nameif
- no security-level
- no ip address
- !
- interface Ethernet3
- shutdown
- no nameif
- no security-level
- no ip address
- !
- interface Ethernet4
- shutdown
- no nameif
- no security-level
- no ip address
- !
- interface Ethernet5
- shutdown
- no nameif
- no security-level
- no ip address
- !
- enable password 8Ry2YjIyt7RRXU24 encrypted
- passwd 2KFQnbNIdI.2KYOU encrypted
- hostname HQPIX
- domain-name cisco.com
- ftp mode passive
- clock timezone AEST 10
- access-list Ipsec-conn extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
- access-list nonat extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
- pager lines 24
- logging enable
- logging buffered debugging
- mtu inside 1500
- mtu outside 1500
- no failover
- monitor-interface inside
- monitor-interface outside
- asdm image flash:/asdmfile.50073
- no asdm history enable
- arp timeout 14400
- nat-control
- global (outside) 1 interface
- nat (inside) 0 access-list nonat
- nat (inside) 1 10.1.1.0 255.255.255.0
- access-group 100 in interface inside
- route outside 0.0.0.0 0.0.0.0 172.17.63.230 1
- timeout xlate 3:00:00
- timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
- sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
- sip 0:30:00 sip_media 0:02:00
- timeout uauth 0:05:00 absolute
- aaa-server TACACS+ protocol tacacs+
- aaa-server RADIUS protocol radius
- aaa-server partner protocol tacacs+
- username cisco password 3USUcOPFUiMCO4Jk encrypted
- http server enable
- http 10.1.1.2 255.255.255.255 inside
- no snmp-server location
- no snmp-server contact
- snmp-server community public
- snmp-server enable traps snmp
- crypto ipsec transform-set avalanche esp-des esp-md5-hmac
- crypto ipsec security-association lifetime seconds 3600
- crypto ipsec df-bit clear-df outside
- crypto map forsberg 21 match address Ipsec-conn
- crypto map forsberg 21 set peer 172.17.63.230
- crypto map forsberg 21 set transform-set avalanche
- crypto map forsberg interface outside
- isakmp identity address
- isakmp enable outside
- isakmp policy 1 authentication pre-share
- isakmp policy 1 encryption 3des
- isakmp policy 1 hash sha
- isakmp policy 1 group 2
- isakmp policy 1 lifetime 86400
- isakmp policy 65535 authentication pre-share
- isakmp policy 65535 encryption 3des
- isakmp policy 65535 hash sha
- isakmp policy 65535 group 2
- isakmp policy 65535 lifetime 86400
- telnet timeout 5
- ssh timeout 5
- console timeout 0
- tunnel-group 172.17.63.230 type ipsec-l2l
- tunnel-group 172.17.63.230 ipsec-attributes
- pre-shared-key *
- !
- class-map inspection_default
- match default-inspection-traffic
- !
- !
- policy-map asa_global_fw_policy
- class inspection_default
- inspect dns maximum-length 512
- inspect ftp
- inspect h323 h225
- inspect h323 ras
- inspect netbios
- inspect rsh
- inspect rtsp
- inspect skinny
- inspect esmtp
- inspect sqlnet
- inspect sunrpc
- inspect tftp
- inspect sip
- inspect xdmcp
- inspect http
- !
- service-policy asa_global_fw_policy global
- Cryptochecksum:3a5851f7310d14e82bdf17e64d638738
- : end
- SV-2-8#
- BranchRouter#show run
- Building configuration...
-
- Current configuration : 1719 bytes
- !
- ! Last configuration change at 13:03:25 AEST Tue Apr 5 2005
- ! NVRAM config last updated at 13:03:44 AEST Tue Apr 5 2005
- !
- version 12.2
- service timestamps debug datetime msec
- service timestamps log uptime
- no service password-encryption
- !
- hostname BranchRouter
- !
- logging queue-limit 100
- logging buffered 4096 debugging
- !
- username cisco privilege 15 password 0 cisco
- memory-size iomem 15
- clock timezone AEST 10
- ip subnet-zero
- !
- !
- !
- ip audit notify log
- ip audit po max-events 100
- !
- !
- !
- crypto isakmp policy 11
- encr 3des
- authentication pre-share
- group 2
- crypto isakmp key cisco123 address 172.17.63.229
- !
- !
- crypto ipsec transform-set sharks esp-des esp-md5-hmac
- !
- crypto map nolan 11 ipsec-isakmp
- set peer 172.17.63.229
- set transform-set sharks
- match address 120
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- no voice hpi capture buffer
- no voice hpi capture destination
- !
- !
- mta receive maximum-recipients 0
- !
- !
- !
- !
- interface Ethernet0/0
- ip address 172.17.63.230 255.255.255.240
- ip nat outside
- no ip route-cache
- no ip mroute-cache
- half-duplex
- crypto map nolan
- !
- interface Ethernet0/1
- ip address 10.2.2.1 255.255.255.0
- ip nat inside
- half-duplex
- !
- ip nat pool branch 172.17.63.230 172.17.63.230 netmask 255.255.255.0
- ip nat inside source route-map nonat pool branch overload
- no ip http server
- no ip http secure-server
- ip classless
- ip route 10.1.1.0 255.255.255.0 172.17.63.229
- !
- !
- !
- access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
- access-list 130 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
- access-list 130 permit ip 10.2.2.0 0.0.0.255 any
- !
- route-map nonat permit 10
- match ip address 130
- !
- call rsvp-sync
- !
- !
- mgcp profile default
- !
- dial-peer cor custom
- !
- !
- !
- !
- !
- line con 0
- line aux 0
- line vty 0 4
- login
- !
- !
- end
- 清除安全关联 (SA)
- 在 PIX 的特权模式下使用以下这些命令：
- clear [crypto] ipsec sa - 删除活动 IPsec SA。关键字 crypto 是可选的。
- clear [crypto] isakmp sa - 删除活动 IKE SA。关键字 crypto 是可选的。
- show crypto isakmp sa
- show crypto ipsec sa
- show crypto engine connections active - 显示有关加密和解密数据包（仅限路由器）的当前连接和信息。
- PIX 安全设备 - debug 输出
- debug crypto ipsec 7 - 显示第 2 阶段的 IPsec 协商。
- debug crypto isakmp 7 - 显示第 1 阶段的 ISAKMP 协商。
- 远程 IOS 路由器 - debug 输出
- debug crypto ipsec - 显示第 2 阶段的 IPsec 协商。
- debug crypto isakmp - 显示第 1 阶段的 ISAKMP 协商。