Исходное сообщение
"PIX 515e SNAT" Отправлено Gerk, 06-Сен-10 19:36
Доброго времени суток! Есть PIX 515e с 2мя интерфейсами (inside(192.168.4.249), outside (195.xxx.xxx.217)). C помощью Cisco установлен VPN IPSec-тунель с другим офисом (192.168.{0,1,2}.0). Есть WWW-сервер за CISCO IP для внешнего мира - 195.ххх.ххх.214, локальный IP - 192.168.4.6.  На циске используется трансляция IP-адресов для 195.ххх.ххх.214 Проблема: невозможно обратиться к WWW-серверу по внешнему IP, извне работает, из локалки по локальному тоже работает. ------------------------- Как я предполагаю нужно задать CISCO правило - аналог правила iptables вида: iptables -t nat -A POSTROUTING -p tcp --dst 195.xxx.xxx.214 --dport 80 -j SNAT \ --to-source 192.168.4.6 Но написать не получилось ------------------------- Конфиг: ---------------- PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password ххх encrypted passwd ххх encrypted hostname SMPIX domain-name ххх fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol pptp 1723 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol rtsp 6000 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1433-1434 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list 101 permit ip 192.168.4.0 255.255.255.0 192.168.4.0 255.255.255.0 access-list 101 permit ip 192.168.4.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 101 permit ip 192.168.4.0 255.255.255.0 192.168.0.0 255.255.254.0 access-list 110 permit ip 192.168.4.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list 110 permit ip 192.168.4.0 255.255.255.0 192.168.0.0 255.255.254.0 access-list 102 permit icmp any any echo-reply access-list 102 permit icmp any any unreachable access-list 102 permit icmp any any time-exceeded access-list 102 permit tcp any host 195.xxx.xxx.214 eq ftp access-list 102 permit tcp any host 195.xxx.xxx.214 eq ftp-data access-list 102 permit tcp any host 195.xxx.xxx.214 eq www access-list 102 permit tcp any host 195.xxx.xxx.214 eq https access-list 102 permit tcp any host 195.xxx.xxx.214 eq 3389 access-list 102 permit tcp any host 195.xxx.xxx.214 eq 21234 access-list 102 deny ip any host 195.xxx.xxx.214 access-list 103 permit ip any any pager lines 300 mtu outside 1500 mtu inside 1500 ip address outside 195.xxx.xxx.217 255.255.255.240 ip address inside 192.168.4.249 255.255.255.0 ip audit info action alarm ip audit attack action alarm no failover failover timeout 0:00:00 failover poll 15 no failover ip address outside no failover ip address inside pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list 101 nat (inside) 1 192.168.4.0 255.255.255.0 0 0 static (inside,outside) 195.xxx.xxx.214 192.168.4.6 netmask 255.255.255.255 0 0 access-group 102 in interface outside access-group 103 in interface inside route outside 0.0.0.0 0.0.0.0 195.xxx.xxx.209 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa-server partnerauth protocol radius aaa-server partnerauth max-failed-attempts 3 aaa-server partnerauth deadtime 10 aaa-server partnerauth (inside) host 192.168.1.100 password123 timeout 5 snmp-server host outside 63.xxx.xxx.42 poll no snmp-server location no snmp-server contact snmp-server community xxx no snmp-server enable traps floodguard enable sysopt connection permit-ipsec sysopt connection permit-pptp sysopt connection permit-l2tp crypto ipsec transform-set cisco-l2tp esp-3des esp-sha-hmac crypto ipsec transform-set cisco-l2tp mode transport crypto ipsec transform-set myset esp-3des esp-md5-hmac crypto dynamic-map l2tp 30 set transform-set cisco-l2tp crypto map dmu 30 ipsec-isakmp dynamic l2tp crypto map mymap 10 ipsec-isakmp crypto map mymap 10 match address 110 crypto map mymap 10 set peer 63.xxx.xxx.xxx crypto map mymap 10 set transform-set myset crypto map mymap client authentication partnerauth crypto map mymap interface outside isakmp enable outside isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255 no-xauth no-config-mode isakmp identity address isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 isakmp policy 15 authentication pre-share isakmp policy 15 encryption 3des isakmp policy 15 hash sha isakmp policy 15 group 2 isakmp policy 15 lifetime 28800 telnet timeout 60 ssh 0.0.0.0 0.0.0.0 outside ssh 0.0.0.0 0.0.0.0 inside ssh timeout 60 console timeout 0 terminal width 80 : end ---------------- Помогите пожалуйста, всё больше с Linux&FreeBSD сталкивался, а тут Win-серваков куча без фаерволов и...