防火墙与入侵检测技术实验报告1-6.doc

1、实验一 PIX 防火墙配置一、 实验目的通过该实验了解 PIX 防火墙的软硬件组成结构，掌握 PIX 防火墙的工作模式，熟悉 PIX防火墙的 6 条基本指令，掌握 PIX 防火墙的动态、静态地址映射技术，掌握 PIX 防火墙的管道配置，熟悉 PIX 防火墙在小型局域网中的应用。二、 实验任务 观察 PIX 防火墙的硬件结构，掌握硬件连线方法 查看 PIX 防火墙的软件信息，掌握软件的配置模式 了解 PIX 防火墙的 6 条基本指令，实现内网主机访问外网主机三、 实验设备PIX501 防火墙一台，CISCO 2950 交换机两台，控制线一根，网络连接线若干， PC 机若干四、 实验拓扑图及内容图

2、中 DMZ 区域没有配置，只是配置了内网 R1 和外网 R4，外网 R4：R4#conf tEnter configuration commands, one per line. End with CNTL/Z.R4(config)#int f0/0R4(config-if)#ip add 192.168.1.2 255.255.255.0R4(config-if)#no shutR4(config-if)#exit*Mar 1 00:02:56.059: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1

3、00:02:57.059: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR4(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.3R4(config)#内网 R1：R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#int f0/0R1(config-if)#ip add 10.1.1.2 255.255.255.0R1(conf

4、ig-if)#no shutR1(config-if)#*Mar 1 00:01:32.115: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:01:33.115: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR1(config-if)#exitR1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.3R1(config)#exitR1#*Mar

5、 1 00:53:05.287: %SYS-5-CONFIG_I: Configured from console by consoleR1#防火墙上的配置：pixfirewall# conf tpixfirewall(config)# hostname pixpix(config)#pix(config)#pix(config)# int e0pix(config-if)# ip add 10.1.1.3 255.255.255.0pix(config-if)# nameif insideINFO: Security level for “inside“ set to 100 by defa

6、ult.pix(config-if)# no shutpix(config-if)# exitpix(config)# int e1pix(config-if)# nameif outsideINFO: Security level for “outside“ set to 0 by default.pix(config-if)# ip add 192.168.1.3pix(config-if)# ip add 192.168.1.3 255.255.255.0pix(config-if)# no shutpix(config-if)# exitpix(config)# static (ins

7、ide,outside) 192.168.1.4 10.1.1.4 netmask 255.255.255.255pix(config)# access-list 100 permit icmp any anypix(config)# access-grpix(config)# access-group 100 in intpix(config)# access-group 100 in interface outsidepix(config)# exitpix#五、实验结果内网 ping 外网：外网 ping 内网：总结：pix 防火墙默认情况下，从高安全级别到低安全级别的流量是被允许的，从

8、低安全级别访问高安全级别的流量默认是被禁止的。要使流量可以从低安全级别访问高安全级别，需要使用访问列表。实验二 ASA 防火墙配置一、 实验目的通过该实验了解 ASA 防火墙的软硬件组成结构，掌握 ASA 防火墙的工作模式，熟悉ASA 防火墙的基本指令，掌握 ASA 防火墙的动态、静态地址映射技术，掌握 ASA 防火墙的访问控制列表配置，熟悉 ASA 防火墙在小型局域网中的应用。二、 实验任务 观察 ASA 防火墙的硬件结构，掌握硬件连线方法 查看 ASA 防火墙的软件信息，掌握软件的配置模式 了解 ASA 防火墙的基本指令，实现内网主机访问外网主机，外网访问 DMZ 区三、 实验设备ASA5

9、505 防火墙一台，CISCO 2950 交换机两台，控制线一根，网络连接线若干， PC 机若干四、 实验拓扑图及内容详细配置：内网 R6：R1enR1#R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#int f0/0R1(config-if)#ip add 10.1.1.2 255.255.255.0R1(config-if)#no shutR1(config-if)#*Mar 1 00:01:32.115: %LINK-3-UPDOWN: Interface FastEthern

10、et0/0, changed state to up*Mar 1 00:01:33.115: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR1(config-if)#exitR1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.3R1(config)#exitR1#DMZ 区 R3:R2enR2#conf tEnter configuration commands, one per line. End with CNTL/Z.R2(conf

11、ig)#int f0/0R2(config-if)#ip add 20.1.1.2 255.255.255.0R2(config-if)#no shutR2(config-if)#*Mar 1 00:01:28.895: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:01:29.895: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR2(config-if)#exitR2(c

12、onfig)#ip route 0.0.0.0 0.0.0.0 20.1.1.3R2(config)#exitR2#*Mar 1 00:03:11.227: %SYS-5-CONFIG_I: Configured from console by consoleR2#外网 R4：R4#conf tEnter configuration commands, one per line. End with CNTL/Z.R4(config)#int f0/0R4(config-if)#ip add 192.168.1.2 255.255.255.0R4(config-if)#no shutR4(con

13、fig-if)#*Mar 1 00:00:45.559: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:00:46.559: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR4(config-if)#exitR4(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.3R4(config)#exitR4#PIX 防火墙上的配置：pixfirew

14、all# conf tpixfirewall(config)# hostname pixpix(config)# int e0pix(config-if)# ip add 10.1.1.3 255.255.255.0pix(config-if)# nameif insideINFO: Security level for “inside“ set to 100 by default.pix(config-if)# no shutpix(config-if)# int e1pix(config-if)# nameif outsideINFO: Security level for “outsid

15、e“ set to 0 by default.pix(config-if)# ip add 192.168.1.3 255.255.255.0pix(config-if)# no shutpix(config-if)# int e2pix(config-if)# nameif dmzINFO: Security level for “dmz“ set to 0 by default.pix(config-if)# secpix(config-if)# security-level 50pix(config-if)# ip add 20.1.1.3 255.255.255.0pix(config

16、-if)# no shutpix(config-if)# nat (inside) 11 10.1.1.0 255.255.255.0pix(config)# nat (inside) 11 10.1.1.0 255.255.255.0Duplicate NAT entrypix(config)# global (outside) 11 20.1.1.74 netmask 255.255.255.255INFO: Global 20.1.1.74 will be Port Address Translatedpix(config)# access-list 100 permit icmp an

17、y anypix(config)# access-grpix(config)# access-group 100 in interface outsidepix(config)# static (dmz,outside) 192.168.1.5 20.1.1.5 netmask 255.255.255.255pix(config)# access-group 100 in interface dmzpix(config)#五、实验结果内网 PING 外网：外网 PING DMZ:外网 PING 内网：总结：比起上次试验，这次是多添加了一个 DMZ 区，在 DMZ 和 outside 之间配置

18、static 命令。实验三 防火墙日志服务的配置一、 实验目的通过该实验掌握 PIX/ASA 防火墙日志服务的配置，熟悉日志文件格式和内容。二、 实验任务 配置日志服务器 在 PIX/ASA 防火墙上配置日志服务 查看日志文件，熟悉文件格式及内容三、 实验设备ASA5505 防火墙一台或者 PIX501 防火墙一台，CISCO 2950 交换机两台，控制线一根，网络连接线若干，PC 机若干，日志服务软件一套四、 实验拓扑图及内容外网 R4 配置：R4(config)#no ip do loR4(config)#no ip do lookupR4(config)#line conR4(confi

19、g)#line console 0R4(config-line)#loggR4(config-line)#logging synR4(config-line)#logging synchronousR4(config-line)#exec-tR4(config-line)#exec-timeout 0 0R4(config-line)#exitR4(config)#line vty 0 4R4(config-line)#passwR4(config-line)#password cuitR4(config-line)#exitR4(config)#int f0/0R4(config-if)#i

20、p add 192.168.1.1 255.255.255.0R4(config-if)#no shutR4(config-if)#endR4#*Mar 1 00:02:46.251: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to upR4#*Mar 1 00:02:47.003: %SYS-5-CONFIG_I: Configured from console by console*Mar 1 00:02:47.251: %LINEPROTO-5-UPDOWN: Line protocol on Interface F

21、astEthernet0/0, changed state to upR4#DMZ 区 R3 配置：R3#conf tEnter configuration commands, one per line. End with CNTL/Z.R3(config)#no ip do loR3(config)#no ip do lookupR3(config)#line conR3(config)#line console 0R3(config-line)#loggR3(config-line)#logging synR3(config-line)#logging synchronousR3(conf

22、ig-line)#exec-tinR3(config-line)#exec-tin 0 0% Invalid input detected at marker.R3(config-line)#exec-tim 0 0R3(config-line)#exitR3(config)#line vty 0 4R3(config-line)#pass cuitR3(config-line)#exitR3(config)#int int f0/0% Invalid input detected at marker.R3(config)#int f0/0R3(config-if)#ip add 20.1.1

23、.1 255.255.255.0R3(config-if)#no shutR3(config-if)#exo*Mar 1 00:03:16.799: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:03:17.799: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to uR3(config-if)#exitR3(config)#ip route 192.168.1.0 255.255.2

24、55.0 20.1.1.2R3(config)#endR3#*Mar 1 00:04:02.099: %SYS-5-CONFIG_I: Configured from console by consoleR3#防火墙：pixfirewall# conf tpixfirewall(config)# hostname pixpix(config)#pix(config)# int e0pix(config-if)# ip add 10.15.71.6 255.255.255.0pix(config-if)# no shutpix(config-if)# nameif insideINFO: Sec

25、urity level for “inside“ set to 100 by default.pix(config-if)# int e1pix(config-if)# nameif outsideINFO: Security level for “outside“ set to 0 by default.pix(config-if)# ip add 192.168.1.2 255.255.255.0pix(config-if)# no shutpix(config-if)# int e2pix(config-if)# nameif dmzINFO: Security level for “d

26、mz“ set to 0 by default.pix(config-if)# secpix(config-if)# security-level 50pix(config-if)# ip add 20.1.1.2 255.255.255.0pix(config-if)# no shutpix(config-if)# exitpix(config)# nat (inside) 11 10.15.71.0 255.255.255.0pix(config)# global (outside) 11 192.168.1.74 netmask 255.255.255.0INFO: Global 192

27、.168.1.74 will be Port Address Translatedpix(config)# static (dmz,outside) 192.168.1.7 20.1.1.1 netmask 255.255.255.255pix(config)# access-list icmp permit icmp any anypix(config)# access-group icmp in interface outsidepix(config)# loggin onpix(config)# loggin host inside 10.15.71.5pix(config)# logg

28、in trap depix(config)# loggin trap debuggingpix(config)# loggin trap inpix(config)# loggin trap informational五、 实验总结1 测试连通性2 本地 PING dmz 区：3打开日子服务器：总结：可以通过日志服务器查看用户的相关操作。实验四 ASA 防火墙 AAA 服务的配置一、 实验目的通过该实验掌握 ASA 防火墙 AAA 服务的配置，熟悉 AAA 服务器的认证、授权、审计配置。二、 实验任务 配置 AAA 服务器 在 ASA 防火墙上配置配置 AAA 服务 查看 AAA 配置，验证配

29、置是否正确三、 实验设备ASA5505 防火墙一台，CISCO 2950 交换机两台，控制线一根，网络连接线若干， PC 机若干，AAA 服务软件一套四、 实验拓扑图及内容pix(config)# int e0pix(config-if)# nameif insideINFO: Security level for “inside“ set to 100 by default.pix(config-if)# ip add 10.1.1.1 255.255.255.0pix(config-if)# no shutpix(config-if)# int e1pix(config-if)# name

30、if outsideINFO: Security level for “outside“ set to 0 by default.pix(config-if)# ip add 30.1.1.1 255.255.255.0pix(config-if)# no shutpix(config-if)# int e2pix(config-if)# nameif dmzINFO: Security level for “dmz“ set to 0 by default.pix(config-if)# secpix(config-if)# security-level 50pix(config-if)#

31、ip add 20.1.1.1 255.255.255.0pix(config-if)# no shutpix(config-if)# exitpix(config)# access-list 101 expix(config)# access-list 101 extended permit tcp any any eq telnetpix(config)# access-group 101 in int outsidepix(config)# access-group 101 in int dmzpix(config)# aaa-server 123 protocol radiuspix(

32、config-aaa-server-group)# aaa-server 123 (dmz) host 20.1.1.2pix(config-aaa-server-host)# key 123pix(config-aaa-server-host)# aaa authpix(config-aaa-server-host)# aaa authentipix(config-aaa-server-host)# aaa authentication match 101 outside 123pix(config)# aaa authentication match 101 outside 123Rang

33、e already exists.实验五 ASA 防火墙 IPSec 与 VPN 的配置一、 实验目的通过该实验掌握 ASA 防火墙 IPSec 与 VPN 的配置。二、 实验任务 配置 ASA 防火墙 IPSec 配置 ASA 防火墙 VPN 验证实验结果三、 实验设备ASA5505 防火墙两台，CISCO 2950 交换机两台，控制线一根，网络连接线若干， PC 机若干，Sniffer 软件一套四、 实验拓扑图及内容VPN 的基本配置 执行下列步骤：1. 确定一个预先共享的密钥（保密密码）2. 为 SA 协商过程配置 IKE。3. 配置 IPSec。内网 R2 上的配置是：interfac

34、e FastEthernet0/0ip address 10.1.1.1 255.255.255.0duplex autospeed auto!no ip http serverno ip http secure-serverip route 0.0.0.0 0.0.0.0 10.1.1.2防火墙 FW1 上的配置是：fw1# sh run: Saved:PIX Version 7.2(1)!hostname fw1enable password 8Ry2YjIyt7RRXU24 encryptednames!interface Ethernet0nameif outsidesecurity-

35、level 0ip address 192.168.2.1 255.255.255.0!interface Ethernet1nameif insidesecurity-level 100ip address 10.1.1.2 255.255.255.0!interface Ethernet2shutdownno nameifno security-levelno ip address!interface Ethernet3shutdownno nameifno security-levelno ip address!interface Ethernet4shutdownno nameifno

36、 security-levelno ip address!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passiveaccess-list 101 extended permit icmp any anypager lines 24mtu outside 1500mtu inside 1500no failoverno asdm history enablearp timeout 14400global (outside) 11 192.168.2.74 netmask 255.255.255.255route outside 0.0.0.0 0.0.0

37、.0 192.168.2.4 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout uauth 0:05:00 absoluteno snmp-ser

38、ver locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstartcrypto ipsec transform-set fw2 esp-des esp-nonecrypto map pix 12 match address 101crypto map pix 12 set peer 192.168.2.4crypto map pix 12 set transform-set fw2crypto map pix interface outsidecrypt

39、o isakmp identity addresscrypto isakmp enable outsidecrypto isakmp policy 12authentication pre-shareencryption 3deshash shagroup 2lifetime 86400crypto isakmp policy 65535authentication pre-shareencryption 3deshash shagroup 2lifetime 86400tunnel-group 192.168.2.4 type ipsec-l2ltunnel-group 192.168.2.

40、4 ipsec-attributespre-shared-key *telnet timeout 5ssh timeout 5console timeout 0!prompt hostname contextCryptochecksum:00000000000000000000000000000000: endfw1#内网 R3 上的配置是：interface FastEthernet0/0ip address 20.1.1.1 255.255.255.0duplex autospeed auto!no ip http serverno ip http secure-serverip rout

41、e 0.0.0.0 0.0.0.0 20.1.1.2防火墙 FW2 上的配置：fw2# sh run: Saved:PIX Version 7.2(1)!hostname fw2enable password 8Ry2YjIyt7RRXU24 encryptednames!interface Ethernet0nameif outsidesecurity-level 0ip address 192.168.2.4 255.255.255.0!interface Ethernet1nameif insidesecurity-level 100ip address 20.1.1.2 255.255

42、.255.0!interface Ethernet2shutdownno nameifno security-levelno ip address!interface Ethernet3shutdownno nameifno security-levelno ip address!interface Ethernet4shutdownno nameifno security-levelno ip address!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passiveaccess-list 101 extended permit icmp any an

43、ypager lines 24mtu outside 1500mtu inside 1500no failoverno asdm history enablearp timeout 14400global (outside) 11 192.168.2.84 netmask 255.255.255.255route outside 0.0.0.0 0.0.0.0 192.168.2.1 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10

44、:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout uauth 0:05:00 absoluteno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstartcrypto ipsec tran

45、sform-set fw1 esp-des esp-nonecrypto map pix 12 match address 101crypto map pix 12 set peer 192.168.2.1crypto map pix 12 set transform-set fw1crypto map pix interface outsidecrypto isakmp identity addresscrypto isakmp enable outsidecrypto isakmp policy 12authentication pre-shareencryption 3deshash s

46、hagroup 2lifetime 86400tunnel-group 192.168.2.1 type ipsec-l2ltunnel-group 192.168.2.1 ipsec-attributespre-shared-key *telnet timeout 5ssh timeout 5console timeout 0!prompt hostname contextCryptochecksum:857539fcbacc4cb22811ddfb1c68679c: endfw2#五、 实验总结虚拟专用网被定义为通过一个公用网络建立一个临时的、安全的连接，是一条穿过混乱的公用网络的安全、稳

47、定的隧道。使用这条隧道可以对数据进行几倍加密达到安全使用互联网的目的。实验六 ASA 虚拟防火墙的配置一、 实验目的通过该实验掌握 ASA 虚拟防火墙的配置。二、 实验任务 配置 ASA 虚拟防火墙 验证实验结果三、 实验设备ASA5505 防火墙两台，CISCO 2950 交换机两台，控制线一根，网络连接线若干， PC 机若干，Sniffer 软件一套四、 实验拓扑图及内容R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#int f0/0R1(config-if)#ip add 19

48、2.168.1.1 255.255.255.0R1(config-if)#no shutR1(config-if)#exitR1(config)#R2enR2#conf tEnter configuration commands, one per line. End with CNTL/Z.R2(config)#int f0/0R2(config-if)#ip add 192.168.3.1 255.255.255.0R2(config-if)#no shutR2(config-if)#exitR2(config)#*Mar 1 00:00:38.971: %LINK-3-UPDOWN: In

49、terface FastEthernet0/0, changed state to up*Mar 1 00:00:39.971: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up*Mar 1 00:04:33.155: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:04:34.155: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR3enR3#conf tEnter configuration commands, one per line. End with CNTL/Z.R3(config)#int f0/0R3(config-if)#ip add 192.168.2.1 255.255.255.0R3(config-if)#no shutR3(config-if)#endR3#*Mar 1 00:00:46.747: %LINK-3-UPDOWN: Interface FastE