【正文】 34 [Facladv3001]quit在內(nèi)網(wǎng)接口處使用防病毒列表[F]interface Ethernet 0/0[FEthernet0/0]ip add 24[FEthernet0/0]firewall packetfilter 3001 inbound [FEthernet0/0]quit在外網(wǎng)出口處應(yīng)用防病毒列表[F]interface Ethernet 0/1[FEthernet0/1]ip add 24[FEthernet0/1]firewall packetfilter 3001 inbound 將對(duì)外網(wǎng)口的訪問通過NAT server映射到內(nèi)網(wǎng)WEB服務(wù)器上[FEthernet0/1]nat outbound 2001[FEthernet0/1]nat server protocol tcp global inside [FEthernet0/1]quit[F]firewall zone trust [Fzonetrust]add interface Ethernet 0/0[Fzonetrust]quit[F]firewall zone untrust [Fzoneuntrust]add interface e0/1[Fzoneuntrust]quit防火墻郵件主題過濾、網(wǎng)頁地址過濾實(shí)現(xiàn)。圖 過濾前訪問百度網(wǎng)網(wǎng)頁地址過濾后，我們?cè)L問百度網(wǎng)頁。郵件不成功發(fā)送接收。 組網(wǎng)圖圖 實(shí)驗(yàn)拓?fù)鋱D IP地址劃分表 41 IP地址規(guī)劃服務(wù)器端口IP地址R1E0/0E0/1S2/0R2S1/0E0/0S2/0R3S1/0E0/0E0/1SVLAN1VLAN2VLAN3PC1PC2PC3PC4PC5WEB服務(wù)器 實(shí)驗(yàn)配置文檔 R1配置給各個(gè)端口配置IP地址[R1]int e0/0[R1Ethernet0/0]ip add 24[R1Ethernet0/0]int e0/1[R1Ethernet0/1]ip add 24[R1Ethernet0/1]%Jan 14 14:38:05:663 2013 R1 IFNET/4/UPDOWN: Line protocol on the interface Ethernet0/1 is UP [R1Ethernet0/1]int s2/0[R1Serial2/0]ip add 24[R1Serial2/0]quit給路由器本身配置IP地址[R1]router id OSPF配置area0區(qū)域[R1]ospf 1[R1ospf1]area 0[]network []network []network []network []quitACL配置，配置目的是為了讓PC1與PC2不能互通[R1]int e0/0[R1Ethernet0/0]acl number 3000[R1acladv3000]rule 0 deny ip source destination [R1acladv3000]quit[R1]int e0/1[R1Ethernet0/1]acl number 3001[R1acladv3001]rule 1 deny ip source destination [R1acladv3001]quit加入端口進(jìn)行運(yùn)用[R1]firewall enable [R1]int e0/0[R1Ethernet0/0]firewall packetfilter 3000 inbound [R1Ethernet0/0]quit[R1]int e0/1[R1Ethernet0/1]firewall packetfilter 3001 inbound [R1Ethernet0/1]quit R2配置配置各個(gè)端口的IP地址[R2]int e0/0[R2Ethernet0/0]ip add 24[R2Ethernet0/0]ip add 24[R2Ethernet0/0]int s1/0[R2Serial1/0]ip add 24[R2Serial1/0]%Jan 14 14:23:36:391 2013 R2 IFNET/4/UPDOWN: Protocol PPP IPCP on the interface Serial1/0 is UP [R2Serial1/0]int s2/0[R2Serial2/0]ip add 24[R2]router id [R2]ospf 1[R2ospf1]area 0[]network []%Jan 14 14:50:03:660 2013 R2 RM/3/RMLOG:OSPFNBRCHANGE: Process 1, Neighbor (Serial1/0) from Loading to Full[]quit[R2ospf1]area 1[]network []network []network []quit[R2ospf1]area 0[]network []quit[R2ospf1]quitOSPF的虛鏈接配置[R2]ospf 1[R2ospf1]area 1[]vlinkpeer []quit[R2ospf1]quit進(jìn)行ACL配置，不允許PC1與PC2訪問PC5。 要求PC1與PC2不能互通。原因：我們要在加載之前，要先保存，所以要先在目錄中有這兩個(gè)文件夾，那么文件才能夠加載到里面去。[F] firewall urlfilter host enable[F]firewall urlfilter host ipaddress permit顯示關(guān)鍵字。打開防火墻[F]firewall packetfilter enable [F]firewall packetfilter default permit [F]firewall statistic system enable 設(shè)置阻止到達(dá)server的IP分片報(bào)文，并且允許FTP分片報(bào)文通過。防火墻上實(shí)現(xiàn)分片報(bào)文攻擊防范、常見flood攻擊防范。圖 加入會(huì)議2）程序共享圖 程序共享3）文件傳輸圖 文件傳輸 問題回答，？，它是主叫用戶為呼叫移動(dòng)通信網(wǎng)中用戶所需撥號(hào)的號(hào)碼。（2）配置ME5000服務(wù)器。擴(kuò)大了網(wǎng)絡(luò)的工作范圍，包括那些路由網(wǎng)關(guān)有限的協(xié)議。IKE協(xié)議負(fù)責(zé)管理IPsec VPN節(jié)點(diǎn)的ISAKMP中的IPsec安全關(guān)聯(lián)。ESP可以單獨(dú)實(shí)現(xiàn)，也可以與AH一起實(shí)現(xiàn)。interface Serial1/0linkprotocol pppip address ipsec policy centerinterface Serial2/0linkprotocol pppip address ipsec policy center靜態(tài)路由配置ip routestatic [branch1]int e0/1[branch1Ethernet0/1]ip add 24[branch1Ethernet0/1][branch1Ethernet0/1]int s2/0[branch1Serial2/0]ip add 30acl number 3001 rule 0 permit gre source 0 destination 0interface Tunnel0 ip address source destination ospf 1 area network network network ike peer center exchangemode aggressive presharedkey cipher J5fBBpuCrvQ= idtype name remotename center remoteaddress ipsec proposal 1ipsec policy branch1 10 isakmp ikepeer center proposal 1interface Serial2/0 linkprotocol ppp ip address ipsec policy branch1ip routestatic [branch2]int e0/1[branch2Ethernet0/1]ip add 24[branch2Ethernet0/1]int s1/0[branch2Serial1/0]ip add 30[branch2Serial1/0][branch2Serial1/0]quit[branch2]acl number 3002[branch2acladv3002]rule 0 permit gre source 0 destination 0[branch2acladv3002]quit[branch2]int Tunnel 1[branch2Tunnel1]ip add 30[branch2Tunnel1]source [branch2Tunnel1]destination [branch2Tunnel1]quit[branch2]ospf 1[]network []network []quit[branch2ospf1]quit[branch2]ike localname branch2[branch2]ike peer center //配置ike對(duì)等體peer[branch2ikepeercenter]exchangemode aggressive [branch2ikepeercenter]presharedkey abc[branch2ikepeercenter]idtype name[branch2ikepeercenter]remotename center[branch2ikepeercenter]remoteaddress [branch2ikepeercenter]quit[branch2]ipsec proposal 1 //創(chuàng)建ipsec安全提議[branch2ipsecproposal1]quit[branch2]ipsec policy branch2 20 isakmp [branch2ipsecpolicyisakmpbranch220]quit[branch2]ipsec policy branch2 20 isakmp //在分配ipsec policy時(shí)通過ike協(xié)商建立sa[branch2ipsecpolicyisakmpbranch220]security acl 3002 //指定安全策略所引用的訪問控制列表號(hào)[branch2ipsecpolicyisakmpbranch220]ikepeer center[branch2ipsecpolicyisakmpbranch220]proposal 1[branch2ipsecpolicyisakmpbranch220]quit[branch2]int s1/0[branch2Serial1/0]ipsec policy branch2[branch2Serial1/0]quit[branch2]ip routestatic preference 60 效果查看（1） 中心上的ike sa 狀態(tài)；[center]dis ike sa total phase1 SAs: 2 connectionid peer flag phase doi 106 RD|ST 1 IPSEC 107 RD|ST 2 IPSEC 10 RD 2 IPSEC 1 RD 1 IPSEC flag meaning RDREADY STSTAYALIVE RLREPLACED FDFADING TO—TIMEOUT（2）中心上的IPSec sa狀態(tài)；[center]dis ipsec sa===============================Interface: Serial1/0 path MTU: 1500===============================