 |
||
| ||
| |||||
| Dernière réponse | ||
|---|---|---|
| Sujet : Configuration NAT sur un Cisco pix 501 | ||
| dsp62 | Merci pour votre aide
:hello: :)
|
|
| Aperçu |
|---|
| Vue Rapide de la discussion |
|---|
| dsp62 | Merci pour votre aide
:hello: :)
|
| dsp62 | Salut,
J'ai un petit pb avec mon pix (501) Je n'arrive pas faire du PPTP sortant ??? Avec ma conf, lorsque j'etablie une connexion PPTP, la connexion se bloque sur : "Vérification du nom d'utilisateur et du mot de passe" Descriptif de ma conf : Internet -> Box FAI -> Cisco pix -> Wifi -> PC (Quand je me connecte directement sur ma box je peux faire du PPTP sortant et me connecter en PPTP sur mon pix) Config pix : PIX Version 6.2(2) nameif ethernet0 outside security0 nameif ethernet1 inside security100 clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol sip 5060 fixup protocol skinny 2000 names name 192.168.123.X Cyrus name 192.168.1.1 router name 192.168.1.254 FwOUT name 192.168.123.254 FwIN object-group network LAN network-object 192.168.123.0 255.255.255.0 object-group service P2P tcp-udp port-object range yyyy yyyy object-group icmp-type icmp-answer icmp-object echo-reply icmp-object source-quench icmp-object unreachable icmp-object time-exceeded object-group protocol TcpUdp protocol-object tcp protocol-object udp object-group service TSE tcp port-object eq zzzz access-list 101 permit object-group TcpUdp any host FwOUT object-group P2P access-list 101 permit tcp any host FwOUT object-group TSE access-list 101 permit icmp any any object-group icmp-answer pager lines 24 logging on logging monitor errors logging trap warnings logging history errors interface ethernet0 10baset interface ethernet1 10full mtu outside 1500 mtu inside 1500 ip address outside FwOUT 255.255.255.0 ip address inside FwIN 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool pool_VPN1 192.168.123.140-192.168.123.145 ip local pool pool_VPN2 192.168.123.146-192.168.123.149 pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface yyyy Cyrus yyyy netmask 255.255.255.255 0 0 static (inside,outside) udp interface yyyy Cyrus yyyy netmask 255.255.255.255 0 0 static (inside,outside) tcp interface yyyy Cyrus yyyy netmask 255.255.255.255 0 0 static (inside,outside) udp interface yyyy Cyrus yyyy netmask 255.255.255.255 0 0 static (inside,outside) tcp interface yyyy Cyrus yyyy netmask 255.255.255.255 0 0 static (inside,outside) udp interface yyyy Cyrus yyyy netmask 255.255.255.255 0 0 static (inside,outside) tcp interface zzzz Cyrus zzzz netmask 255.255.255.255 0 0 access-group 101 in interface outside route outside 0.0.0.0 0.0.0.0 router 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec sysopt connection permit-pptp no sysopt route dnat telnet timeout 30 ssh 0.0.0.0 0.0.0.0 inside ssh timeout 30 vpdn group PPTP-VPDN-GROUP accept dialin pptp vpdn group PPTP-VPDN-GROUP ppp authentication mschap vpdn group PPTP-VPDN-GROUP ppp encryption mppe 128 required vpdn group PPTP-VPDN-GROUP client configuration address local pool_VPN1 vpdn group PPTP-VPDN-GROUP pptp echo 60 vpdn group PPTP-VPDN-GROUP client authentication local vpdn username administrateur password ********* vpdn enable outside dhcpd address 192.168.123.20-192.168.123.50 inside dhcpd dns router dhcpd lease 86400 dhcpd ping_timeout 750 dhcpd auto_config outside dhcpd enable inside terminal width 80 Cryptochecksum:77fda0ba829a82e0cd88967ae9942480 : end |
| symbiosis | voila ce que j'ai essayé mais tj pas d'acces au ftp directement (fonctionne via la connexion vpn) :
Building configuration... : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password ******** encrypted passwd ********* encrypted hostname pixfirewall domain-name ciscopix.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list inside_access_in permit ip any any access-list outside_access_in permit ip any any access-list inside_outbound_nat0_acl permit ip any 192.168.1.192 255.255.255.192 access-list outside_in permit tcp any any eq ftp pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside 192.168.10.2 255.255.255.0 ip address inside 192.168.1.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool vpnpool 192.168.1.220-192.168.1.225 mask 255.255.255.0 pdm location 192.168.1.192 255.255.255.192 outside pdm location 192.168.1.5 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface ftp 192.168.1.5 ftp netmask 255.255.255.255 0 0 static (inside,outside) tcp interface ftp-data 192.168.1.5 ftp-data netmask 255.255.255.255 0 0 access-group outside_access_in in interface outside access-group inside_access_in in interface inside route outside 0.0.0.0 0.0.0.0 192.168.10.1 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http 0.0.0.0 0.0.0.0 outside http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-pptp telnet timeout 5 ssh timeout 5 console timeout 0 vpdn group vpngroup accept dialin pptp vpdn group vpngroup ppp authentication mschap vpdn group vpngroup ppp encryption mppe auto vpdn group vpngroup client configuration address local vpnpool vpdn group vpngroup pptp echo 60 vpdn group vpngroup client authentication local vpdn username **** password ********* vpdn enable outside dhcpd address 192.168.1.2-192.168.1.33 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside terminal width 80 Cryptochecksum:1cf2b0c4b3ee7c66ad42674102da49d5 : end [OK] |
| ben_ty | Me revoila :D
|
| symbiosis | up.... sniffff |
| symbiosis | up |
| symbiosis | merci beaucoup ben_ty, t'assure trop :jap: une petite question egalement, pour les regles nat. si je veut faire du nat par numero de port il faut juste qe je remplace le protocole et www par le numero de port ?? |
| ben_ty | Choses à supprimmer de ta config:
ca ne sert à rien no aaa authentication match outside_authentication_LOCAL outside LOCAL no access-list outside_authentication_LOCAL deny tcp any interface outside eq www tu autorise l'accès à pdm depuis l'extérieur!!! c'est TRES dangereux no http 0.0.0.0 0.0.0.0 outside Petites choses que tu peux rajouter dans ta config: Personnalisation du nom d'hote et de domaine hostname toto domain-name titi.tata Paramétrage via dhcp des dns et nom de domaine de tes postes clients En auto a partir de ce qu'a récupéré l'interface outside grave au dhcp de ton FAI dhcpd auto_config En manuel dhcpd dns ip_serveur_dns1 ip_serveur_dns2 dhcpd domain titi.tata Paramétrage du fuseau horaire et du passage automatique à l'heure d'été clock timezone CET 1 clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00 Synchronisation sur un serveur de temps ntp server ip_du_serveur_ntp source outside Utilisation de ssh depuis le reseau interne pour administrer ton pix ssh 192.168.1.0 255.255.255.0 inside Une access list sur l'interface inside pour autoriser uniquement certains flux dans le sens lan -> internet access-list inside_access_in permit tcp 192.168.1.0 any eq www .... access-list inside_access_in permit icmp any any access-list inside_access_in deny ip any any access-group inside_access_in in interface inside Protection contre le spoofing ip verify reverse-path interface outside Filtrage des activeX filter activex 80 192.168.1.0 255.255.255.0 0.0.0.0 0.0.0.0 Filtrage des applets java filter java 80 192.168.1.0 255.255.255.0 0.0.0.0 0.0.0.0 Utilisation des fonctionnalité d'IDS du pix : (log lorsque un paquet correspond à une signature de type info, drop du paquet et reset de la connexion en cas de correspondance avec une signature de type attack): ip audit name sig_info info action alarm ip audit name sig_attack attack action alarm drop reset ip audit interface outside sig_info ip audit interface outside sig_attack Il y a encore d'autres choses mais je pense que c'est déjà une bonne base! Une fois ta config terminée, pense à l'enregistrer (write memory) et la sauvegarder dans un coin! |
| symbiosis | ma conf actuel (ca peut servir a d'autre) :
PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password ??? encrypted passwd ??? encrypted hostname pixfirewall domain-name domaine.lan fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list outside_access_in permit tcp any interface outside eq www access-list outside_access_in permit icmp any any echo-reply access-list outside_access_in permit icmp any any unreachable access-list outside_access_in permit icmp any any time-exceeded access-list outside_access_in deny ip any any access-list outside_authentication_LOCAL deny tcp any interface outside eq www pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 192.168.1.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 192.168.1.2 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface www 192.168.1.2 www netmask 255.255.255.255 0 0 access-group outside_access_in in interface outside timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa authentication match outside_authentication_LOCAL outside LOCAL http server enable http 0.0.0.0 0.0.0.0 outside http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 192.168.1.2-192.168.1.33 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside terminal width 80 |
| symbiosis | ca fonctionne :love: un grand merci ben_ty :jap: |
| ben_ty |
|
| symbiosis | voilou ma config :
pixfirewall# sh run : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password ???? encrypted passwd ???? encrypted hostname pixfirewall domain-name domaine.lan fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list outside_access_in permit tcp any host 192.168.1.2 eq www access-list outside_access_in permit icmp any any echo-reply access-list outside_access_in permit icmp any any unreachable access-list outside_access_in permit icmp any any time-exceeded access-list outside_access_in deny ip any any access-list outside_authentication_LOCAL deny tcp any interface outside eq www pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 192.168.1.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 192.168.1.2 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface www 192.168.1.2 www netmask 255.255.255.25 5 0 0 access-group outside_access_in in interface outside timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa authentication match outside_authentication_LOCAL outside LOCAL http server enable http 0.0.0.0 0.0.0.0 outside http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 192.168.1.2-192.168.1.33 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside terminal width 80 Cryptochecksum:04252c2d30f7803d8f627d18a50af927 : end |
| ben_ty | bizarre tout ca!
si tu veux envoie moi ta config complete en mp et je jetterais un coup d'oeil pour voir si je vois d'où ca viens! |
| symbiosis | ca fonctionne tj pas
voila un schema de mo reseau, ca peut aidé : http://img65.imageshack.us/img65/1 [...] 4pl.th.jpg |
| ben_ty | Quand tu dit que ca ne marche pas c'est que l'on peut toujours pas accéder à ton serveur web internet depuis l'extérieur?
As tu bien une access-list sur l'interface outside en in permettant le trafic sur le port 80 vers ton serveur? quelque chose qui ressemble à ca: access-list outside_access_in permit tcp any host 192.168.1.2 eq www access-list outside_access_in permit icmp any any echo-reply access-list outside_access_in permit icmp any any unreachable access-list outside_access_in permit icmp any any time-exceeded access-list outside_access_in deny ip any any access-group outside_access_in in interface outside |
| symbiosis | j'ai appliqué la regle et j'ai le resultat suivant : http://img399.imageshack.us/img399/3285/cisco3bn.jpg mais cela ce fonctionne pas... |
| ben_ty | Si on considère que tu a choisi comme adressage interne le reseau 192.168.1.0/24 et que ton serveur Apache à pour adresse 192.168.1.1 la regle de nat s'écrit comme ca:
static (inside,outside) tcp interface www 192.168.1.1 www |
| symbiosis | bonjour tout l'monde,
j'ai un cisco pix connecté a ma freebox du coté wan (dhcp free) et a un serveur apache de l'autre coté mais je n'arrive pas a fait la translation nat. je passe pas la console PDM de cisco mais apparement pour la translation il veut une adresse ip fixe. quelqu'un a une idée ?? merci d'avance |
