zone base firewall
FW#show running-config
Building configuration...
Current configuration : 3682 bytes
!
! Last configuration change at 13:35:30 UTC Mon Nov 26 2012
upgrade fpd auto
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname FW
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
ip source-route
ip cef
!
ip domain name lab.local
ip name-server 192.168.10.2
no ipv6 cef
!
multilink bundle-name authenticated
parameter-map type inspect global
!
crypto pki token default removal timeout 0
!
object-group network In01
192.168.1.0 255.255.255.0
!
object-group network In02
192.168.2.0 255.255.255.0
!
!
redundancy
!
class-map type inspect match-all In01-to-In02-ICMP
match access-group name In01-to-In02
match protocol icmp
class-map type inspect match-all In02-to-In01-icmp
match access-group name In02-to-In01
match protocol icmp
class-map type inspect match-all In02-to-In01-telnet
match protocol telnet
match access-group name In02-to-In01
class-map type inspect match-any In01-to-Out-Serv
match protocol icmp
match protocol http
match protocol dns
!
!
policy-map type inspect In01-to-In02
class type inspect In01-to-In02-ICMP
inspect
police rate 8000 burst 1000
class class-default
drop
policy-map type inspect In02-to-In01
class type inspect In02-to-In01-telnet
inspect
class type inspect In02-to-In01-icmp
inspect
class class-default
drop
policy-map type inspect In01-to-Out
class type inspect In01-to-Out-Serv
inspect
class class-default
drop
zone security InSide01
zone security InSide02
zone security DMZ
zone security OutSide
zone-pair security In01-to-Out source InSide01 destination OutSide
service-policy type inspect In01-to-Out
zone-pair security IN01-to-In02 source InSide01 destination InSide02
service-policy type inspect In01-to-In02
zone-pair security In02-to-In01 source InSide02 destination InSide01
service-policy type inspect In02-to-In01
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface FastEthernet1/0
no ip address
duplex auto
speed auto
!
interface FastEthernet1/0.10
encapsulation dot1Q 10
ip address 192.168.1.1 255.255.255.0
ip nat enable
zone-member security InSide01
!
interface FastEthernet1/0.20
encapsulation dot1Q 20
ip address 192.168.2.1 255.255.255.0
ip nat enable
zone-member security InSide02
!
interface FastEthernet1/1
ip address 192.168.10.100 255.255.255.0
ip nat enable
zone-member security OutSide
duplex auto
speed auto
!
interface FastEthernet2/0
ip address 172.16.10.1 255.255.255.0
zone-member security DMZ
duplex auto
speed auto
!
interface FastEthernet2/1
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat source list Inside01-net interface FastEthernet1/1 overload
ip nat source list Inside02-net interface FastEthernet1/1 overload
ip route 0.0.0.0 0.0.0.0 192.168.10.2
!
ip access-list standard Inside01-net
permit 192.168.1.0 0.0.0.255
ip access-list standard Inside02-net
permit 192.168.2.0 0.0.0.255
!
ip access-list extended In01-to-In02
permit ip object-group In01 object-group In02
ip access-list extended In01-to-Out-all
permit ip any any
permit icmp any any
ip access-list extended In02-to-In01
permit ip object-group In02 object-group In01
permit icmp object-group In02 object-group In01
!
logging esm config
!
!
!
!
!
!
control-plane
!
!
!
mgcp profile default
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
transport input all
!
end
本文出自 “wfish34” 博客，谢绝转载！