cisco防火墻問題，

yhy7786

兩臺(tái)unix設(shè)備不同網(wǎng)段，中間有一臺(tái)cisco防火墻，兩臺(tái)設(shè)備可相互ping通。當(dāng)防火墻上設(shè)置策略為只開放部分端口時(shí)，如5510到5519，5510、5514能通，但是5512、5513等其它端口都不通。但是如果將策略改為兩個(gè)ip地址間所有端口都放開，則所有端口就都正常了。
此問題如何解決？如何定位？以下為策略配置：
access-list out-in extended permit tcp host 134.32.32.93 any eq ftp
access-list out-in extended permit tcp host 134.32.32.94 any eq ftp
access-list out-in extended permit tcp host 134.32.32.95 any eq ftp
access-list out-in extended permit tcp host 134.32.32.95 any eq 5510
access-list out-in extended permit tcp host 134.32.32.95 any eq 5511
access-list out-in extended permit tcp host 134.32.32.95 any eq 5512
access-list out-in extended permit tcp host 134.32.32.95 any eq 5513
access-list out-in extended permit tcp host 134.32.32.95 any eq 5514
access-list out-in extended permit tcp host 134.32.32.95 any eq 5515
access-list out-in extended permit tcp host 134.32.32.95 any eq 5516
access-list out-in extended permit tcp host 134.32.32.95 any eq 5517
access-list out-in extended permit tcp host 134.32.32.95 any eq 5518
access-list out-in extended permit tcp host 134.32.32.95 any eq 5519
access-list out-in extended permit tcp host 134.32.32.95 any eq 5520
access-list out-in extended permit tcp host 134.32.32.93 any range 5510 5519
access-list out-in extended permit tcp host 134.32.32.94 any range 5510 5519

hjp0021

但是如果將策略改為兩個(gè)ip地址間所有端口都放開，則所有端口就都正常了。

從這點(diǎn)來說應(yīng)該就是ACL的問題。

開房了對(duì)端的port，本端的開放了嗎？
如果要寫的話ACL應(yīng)該寫兩個(gè)吧，兩端端口各一個(gè)。

yhy7786

具體現(xiàn)象是這樣的，cisco防火墻內(nèi)外分別做客戶端和服務(wù)端，使用固定ip和固定端口連接，內(nèi)網(wǎng)為134.32.32.95，端口5510到5519；外網(wǎng)為134.33.201.90，端口為10003。當(dāng)防火墻針對(duì)134.32.32.95只放開5510到5519端口時(shí)，5510端口可以與134.33.201網(wǎng)段的設(shè)備建立正常連接，5512、5513等端口無法與134.33.201.90的10003端口建立連接。134.33.201.90的10003端口作為服務(wù)端，已經(jīng)有其它設(shè)備正常連接了。如果將策略改為針對(duì)134.32.32.95放開全部端口，則可以與134.33.201.90的10003端口建立正常連接。配置如下：
access-list out-in extended permit tcp host 134.32.32.93 any eq ftp
access-list out-in extended permit tcp host 134.32.32.94 any eq ftp
access-list out-in extended permit tcp host 134.32.32.95 any eq ftp
access-list out-in extended permit tcp host 134.32.32.93 any range 5550 5559
access-list out-in extended permit tcp host 134.32.32.94 any range 5550 5559
access-list out-in extended permit tcp host 134.32.32.95 any eq 5550
access-list out-in extended permit tcp host 134.32.32.95 any eq 5551
access-list out-in extended permit tcp host 134.32.32.95 any eq 5552
access-list out-in extended permit tcp host 134.32.32.95 any eq 5553
access-list out-in extended permit tcp host 134.32.32.95 any eq 5554
access-list out-in extended permit tcp host 134.32.32.95 any eq 5555
access-list out-in extended permit tcp host 134.32.32.95 any eq 5556
access-list out-in extended permit tcp host 134.32.32.95 any eq 5557
access-list out-in extended permit tcp host 134.32.32.95 any eq 5558
access-list out-in extended permit tcp host 134.32.32.95 any eq 5559
access-list out-in extended permit tcp host 134.32.32.95 any eq 5510
access-list out-in extended permit tcp host 134.32.32.95 any eq 5511
access-list out-in extended permit tcp host 134.32.32.95 any eq 5512
access-list out-in extended permit tcp host 134.32.32.95 any eq 5513
access-list out-in extended permit tcp host 134.32.32.95 any eq 5514
access-list out-in extended permit tcp host 134.32.32.95 any eq 5515
access-list out-in extended permit tcp host 134.32.32.95 any eq 5516
access-list out-in extended permit tcp host 134.32.32.95 any eq 5517
access-list out-in extended permit tcp host 134.32.32.95 any eq 5518
access-list out-in extended permit tcp host 134.32.32.95 any eq 5519
access-list out-in extended permit tcp host 134.32.32.95 any eq 5520
access-list out-in extended permit tcp host 134.32.32.95 any eq 50010
access-list out-in extended permit tcp host 134.32.32.95 any eq 50011
access-list out-in extended permit tcp host 134.32.32.95 any eq 50012
access-list out-in extended permit tcp host 134.32.32.95 any eq 50013
access-list out-in extended permit tcp host 134.32.32.95 any eq 50014
access-list out-in extended permit tcp host 134.32.32.95 any eq 50015
access-list out-in extended permit tcp host 134.32.32.95 any eq 50016
access-list out-in extended permit tcp host 134.32.32.95 any eq 50017
access-list out-in extended permit tcp host 134.32.32.95 any eq 50018
access-list out-in extended permit tcp host 134.32.32.95 any eq 50019
access-list out-in extended permit tcp host 134.32.32.95 any eq 50020
access-list out-in extended permit tcp host 134.32.32.96 any eq 1099
access-list out-in extended permit tcp host 134.32.32.96 any eq 1199
access-list out-in extended permit tcp host 134.32.32.96 any eq telnet
access-list out-in extended permit tcp host 134.32.32.96 any eq ftp
access-list out-in extended permit tcp host 134.32.32.96 any eq 8080
access-list out-in extended permit tcp host 134.32.32.93 any range 5510 5519
access-list out-in extended permit tcp host 134.32.32.94 any range 5510 5519

cnadl

原帖由 yhy7786 于 2008-9-25 16:16 發(fā)表
具體現(xiàn)象是這樣的，cisco防火墻內(nèi)外分別做客戶端和服務(wù)端，使用固定ip和固定端口連接，內(nèi)網(wǎng)為134.32.32.95，端口5510到5519；外網(wǎng)為134.33.201.90，端口為10003。當(dāng)防火墻針對(duì)134.32.32.95只放開5510到5519端口 ...

sh run | i access-group

sh access-list

hjp0021

那這一例來說，我的ACL思路是這樣的，如果134.32.32.95是源地址的話，那么目的就是134.33.201.90，并允許訪問目的端口10003。
反之134.33.201.90是源的話，目的就是134.32.32.95，允許訪問目的端口5510－5519。
最后將它用在正確的端口，正確的in（或OUT）方向。

個(gè)人覺得您的ACL寫得有些亂。

ssffzz1

你帖全部配置看看。

0ZXCVBNM0

我贊成5樓的意見

client（134.32.32.95）---（inside）cisco（outside）---server（134.33.201.90）

根據(jù)樓主的表述，你的需求是內(nèi)網(wǎng)client利用5510到5519端口去訪問外網(wǎng)server的10003端口
要求源ip的特定端口訪問目的ip的特定端口

那么按照這樣的思路，訪問列表應(yīng)該是

access-list 101 permit tcp host 134.32.32.95 range 5510 5519 host 134.33.201.90 eq 10003

我不明白你這樣的訪問列表是什么意思
access-list out-in extended permit tcp host 134.32.32.95 any eq 5510
這么寫的話，豈不是成了允許主機(jī)134.32.32.95訪問任何地址的tcp5510端口？
似乎不大對(duì)啊

另外：我對(duì)extended這個(gè)參數(shù)不是很理解，我在防火墻上打不了這個(gè)參數(shù)，但是按照字面意思，應(yīng)該也沒什么關(guān)系

yuanyuan025

學(xué)習(xí)啦