【正文】 0S2/0R3S1/0E0/0E0/1SVLAN1VLAN2VLAN3PC1PC2PC3PC4PC5WEB服務(wù)器 實驗配置文檔 R1配置給各個端口配置IP地址[R1]int e0/0[R1Ethernet0/0]ip add 24[R1Ethernet0/0]int e0/1[R1Ethernet0/1]ip add 24[R1Ethernet0/1]%Jan 14 14:38:05:663 2013 R1 IFNET/4/UPDOWN: Line protocol on the interface Ethernet0/1 is UP [R1Ethernet0/1]int s2/0[R1Serial2/0]ip add 24[R1Serial2/0]quit給路由器本身配置IP地址[R1]router id OSPF配置area0區(qū)域[R1]ospf 1[R1ospf1]area 0[]network []network []network []network []quitACL配置，配置目的是為了讓PC1與PC2不能互通[R1]int e0/0[R1Ethernet0/0]acl number 3000[R1acladv3000]rule 0 deny ip source destination [R1acladv3000]quit[R1]int e0/1[R1Ethernet0/1]acl number 3001[R1acladv3001]rule 1 deny ip source destination [R1acladv3001]quit加入端口進行運用[R1]firewall enable [R1]int e0/0[R1Ethernet0/0]firewall packetfilter 3000 inbound [R1Ethernet0/0]quit[R1]int e0/1[R1Ethernet0/1]firewall packetfilter 3001 inbound [R1Ethernet0/1]quit R2配置配置各個端口的IP地址[R2]int e0/0[R2Ethernet0/0]ip add 24[R2Ethernet0/0]ip add 24[R2Ethernet0/0]int s1/0[R2Serial1/0]ip add 24[R2Serial1/0]%Jan 14 14:23:36:391 2013 R2 IFNET/4/UPDOWN: Protocol PPP IPCP on the interface Serial1/0 is UP [R2Serial1/0]int s2/0[R2Serial2/0]ip add 24[R2]router id [R2]ospf 1[R2ospf1]area 0[]network []%Jan 14 14:50:03:660 2013 R2 RM/3/RMLOG:OSPFNBRCHANGE: Process 1, Neighbor (Serial1/0) from Loading to Full[]quit[R2ospf1]area 1[]network []network []network []quit[R2ospf1]area 0[]network []quit[R2ospf1]quitOSPF的虛鏈接配置[R2]ospf 1[R2ospf1]area 1[]vlinkpeer []quit[R2ospf1]quit進行ACL配置，不允許PC1與PC2訪問PC5。圖 過濾前訪問百度網(wǎng)網(wǎng)頁地址過濾后，我們訪問百度網(wǎng)頁。（1）配置文檔給各個端口配置IP地址[F]interface Ethernet 0/0[FEthernet0/0]ip add 24[FEthernet0/0]quit[F]interface Ethernet0/1[FEthernet0/1]ip add 24[FEthernet0/1]quit防火墻打開[F]firewall packetfilter enable [F]firewall packetfilter default permit 全局模式啟用統(tǒng)計功能[F]firewall statistic system enable 啟用黑名單功能[F]firewall blacklist enable手工添加到黑名單條目[F]firewall blacklist [F]firewall zone trust [Fzonetrust]add interface Ethernet 0/0[Fzonetrust] statistic enable ip inzone//連接發(fā)起域入方向啟用IP統(tǒng)計功能[Fzonetrust]quit[F]firewall zone untrust [Fzoneuntrust]add interface Ethernet 0/1[Fzoneuntrust]statistic enable ip outzone//連接發(fā)起域出方向啟用IP統(tǒng)計功能[Fzoneuntrust]statistic enable ip inzone[Fzoneuntrust]quit配置ipsweep防范屬性[F]firewall defend ipsweep maxrate 300 blacklisttimeout 15配置portscan防范屬性[F]firewall defend portscan maxrate 300 blacklisttimeout 10 （2）當我們將配置全部敲完后，我們將要查看實驗效果，然后就是用軟件nmap來攻擊我們的web服務(wù)器，也可以說是要掃描web服務(wù)器端口。圖 實驗組網(wǎng)圖 實驗配置（1）MCU終端添加如下圖所示。GRE（Generic Routing Encapsulation，通用路由封裝）協(xié)議是對某些網(wǎng)絡(luò)層協(xié)議（如IP 和IPX）的數(shù)據(jù)報文進行封裝，使這些被封裝的數(shù)據(jù)報文能夠在另一個網(wǎng)絡(luò)層協(xié)議（如IP）中傳輸。它不支持數(shù)據(jù)加密。為了能夠快速高效地完成課程實訓，掌握一些常用工具是必要的，這些工具包括：TFTP Server、SecureCRT、WildPackets EtherPeek、FLUKE網(wǎng)絡(luò)協(xié)議分析儀、NT955線纜測試儀。本次實訓我們主要做的事四個題目，題目一是有關(guān)于IPSec的GRE實現(xiàn)，主要ACL定義的是內(nèi)網(wǎng)數(shù)據(jù)流，而Ike peer中指定的remoteaddress是對方GRE tunnel地址，應(yīng)用端口為GRE tunnel上。AH一般是單獨實現(xiàn)的，但是它也可以與ESP一起實現(xiàn)。GRE采用了Tunnel（隧道）技術(shù)，是VPN（Virtual Private Network）的第三層隧道協(xié)議。圖 終端添加（2）ME5000終端會議管理。下圖就是我們軟件端口掃描。圖 過濾后訪問百度網(wǎng)（3）郵件主題過濾[F] firewall packetfilter enable[F]firewall packetfilter default permit[F]firewall smtpfilter subject enable //啟用郵件主題過濾功能[F]aspfpolicy 1 [Faspfpolicy1]detect smtp [Faspfpolicy1] detect tcp[Faspfpolicy1]detect udp[Faspfpolicy1]dhcp server ippool test [Fdhcppooltest] network mask [Fdhcppooltest]gatewaylist [Fdhcppooltest]dnslist [Fdhcppooltest]acl number 3000[Facladv3000] rule 0 permit ip source [Facladv3000]rule 1 deny ip[F]int Ethernet0/0[FEthernet0/0] ip address [FEthernet0/0]dhcp server dnslist [FEthernet0/0]quit [F]int eth0/1[FEthernet0/1]ip add 24[FEthernet0/1] firewall aspf 1 outbound[FEthernet0/1]nat outbound 3000 [FEthernet0/1]firewall zone trust[F]firewall zone trust[Fzonetrust]add int eth0/0[Fzonetrust]firewall zone untrust[Fzoneuntrust]add int eth0/1[Fzoneuntrust]quit[F]ip routestatic [F]firewall smtpfilter subject add hello //添加郵件主題關(guān)鍵字 The configuration has been added successfully.[F]dis firewall smtpfilter subject itemall //顯示郵件主題過濾條目 Firewall smtpfilter subject items item(s) added manually : 1 item(s) loaded from file : 0 SN MatchTimes Keyword 1 0 hello[F]firewall smtpfilter subject savefile mailsubject..... The configuration has been saved successfully.[F]firewall smtpfilter subject loadfile flash:/mailsubject The keyword is found in filter when loading line:1. Item(s) loaded :0.（4）郵件主題過濾效果驗證新建賬戶圖 新建賬戶發(fā)送郵件，但是郵件主題不是“hello”。[R2]firewall enable [R2]acl number 3003[R2acladv3003]rule 2 deny ip source destination [R2acladv3003]rule 3 deny ip source destination [R2acladv3003]quit[R2]int e0/0[R2Ethernet0/0]firewall packetfilter 3003 outbound R3配置給各個端口進行IP配置[R3]int e0/0[R3Ethernet0/0]ip add 24[R3Ethernet0/0]int s1/0[R3Serial1/0]ip add 24[R3Serial1/0]%Jan 14 14:42:47:628 2013 R3 IFNET/4/UPDOWN: Protocol PPP IPCP on the interface Serial1/0 is UP [R3Serial1/0]int e0/1[R3Ethernet0/1]ip add 24[R3Ethernet0/1]%Jan 14 14:43:00:831 2013 R3 IFNET/4/UPDOWN: Line protocol on the interface Ethernet0/1 is UP [R3]route id [R3]ospf 1[R3ospf1]area 1[]network []network [R3ospf1]area 2[]network []quit[R3ospf1]quit[R3]ospf 1[R3ospf1]area 1[]vlinkpeer []quit[R3ospf1]quit地址池轉(zhuǎn)換配置[R3]nat addressgroup 1 [R3]acl number 2000[R3aclbasic2000]rule 1 permit source [R3]int e0/0[R3Ethern。圖 發(fā)送郵件主題“hello”的阻止 實驗中疑問解答firewall s