204实验指导(ASA基本配置).docVIP

实验指导(防火墙基本配置) 实验任务 任务： 从内网能主动访问DMZ区、外网，反之不然 DMZ区能主动访问外网，反之不然 实验步骤 预配： R1： hostname R1 interface e0/0 no shutdown duplex full ip address interface loo0 ip address ip route line vty 0 4 password cisco login R2： hostname R2 interface e0/0 no shutdown duplex full ip address interface loo0 ip address router rip network line vty 0 4 password cisco login R3： hostname R3 interface e0/0 no shutdown duplex full ip address interface loo0 ip address router rip network line vty 0 4 password cisco login S1：（在“#”下执行以下命令） vlan database vlan 2 vlan 3 exit conf t hostname Switch interface FastEthernet0/0 shutdown interface FastEthernet0/5 no shutdown switchport trunk native vlan 1000 switchport trunk en dot switchport mode trunk duplex full speed 10 interface FastEthernet0/2 switchport mode access switchport access vlan 2 interface FastEthernet0/3 switchport mode access switchport access vlan 3 基本配置（PIX上）： hostname PIX1 interface Ethernet0 no shutdown ! interface Ethernet0.1 vlan 1 nameif Outside ip address ! interface Ethernet0.2 vlan 2 nameif Inside ip address ! interface Ethernet0.3 vlan 3 nameif DMZ ip address ！ route outside 0 0 测试：从PIX ping各个路由器，检测网络的连通性 配置路由协议（PIX）： router rip network redistribute static 在PIX上show route检测路由表，在其他路由器上也检测路由表 配置安全等级（PIX）： interface Ethernet0.1 security-level 0 interface Ethernet0.2 security-level 100 interface Ethernet0.3 security-level 50 测试： 三个路由之间互相telnet，查看是否只有从高安全等级到底安全等级才能telnet成功？ 完整配置 R1 ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ! ! ip cef ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address ! interface Ethernet0/0 ip address full-duplex ! interface Ethernet0/1 no ip address shutdown half-duplex ! interface Ethernet0/2 no ip address shutdown half-duplex ! interfac