Cisco 2621 NAT配置清单
nat2621#sh run
Building configuration...
Current configuration : 1954 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log datetime localtime
service password-encryption
!
hostname nat2621
!
enable secret 5 $1$6LK3$lZo0pt/F..KTTLB0B4UDX/
enable password 7 120D09130134041C2E7E767D62637543
!
ip subnet-zero
no ip source-route
!
!
no ip domain-lookup
!
no ip bootp server
!
!
!
interface FastEthernet0/0
ip address 61.175.192.22 255.255.255.240
ip access-group 120 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
no ip mroute-cache
speed auto
full-duplex
no cdp enable
!
interface FastEthernet0/1
ip address 192.168.1.254 255.255.255.0
ip access-group 110 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
no ip mroute-cache
duplex auto
speed auto
no cdp enable
!
ip nat pool internet 61.175.192.18 61.175.192.21 netmask 255.255.255.240
ip nat inside source list 1 pool internet overload
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
no ip http server
ip pim bidir-enable
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 110 deny icmp any any echo
access-list 110 deny tcp any any eq 4444
access-list 110 deny udp any any eq tftp
access-list 110 deny tcp any any eq 135
access-list 110 deny tcp any any eq 139
access-list 110 deny udp any any eq netbios-ss
access-list 110 deny udp any any eq 135
access-list 110 deny udp any any eq 445
access-list 110 deny tcp any any eq 445
access-list 110 deny tcp any any eq 593
access-list 110 deny udp any any eq 593
access-list 110 deny udp any any eq 1434
access-list 110 deny ip host 192.168.1.8 any
access-list 110 permit ip any any
access-list 120 permit tcp any any eq telnet
access-list 120 deny tcp any any range 1 1023
access-list 120 deny udp any any range 1 1023
access-list 120 permit ip any any
no cdp run
snmp-server community tlds_hxd5251670 RO
!
line con 0
line aux 0
line vty 0 4
password 7 0978622D2A3A141B180F0B7F797179656272
login
!
!
end
Nat2621安全配置：
使用访问控制列表和高强度的密码控制远程访问路由器
启用Service password-encryption
Router(Config)# Service password-encryption
禁止CDP(Cisco Discovery Protocol)
Router(Config)#no cdp run
Router(Config-if)# no cdp enable
禁止其他的TCP、UDP Small服务
Router(Config)# no service tcp-small-servers
Router(Config)# no service udp-samll-servers
禁止Finger服务
Router(Config)# no ip finger
Router(Config)# no service finger
禁止HTTP服务
Router(Config)# no ip http server
禁止BOOTp服务
Router(Config)# no ip bootp server
禁止从网络启动和自动从网络下载初始配置文件
Router(Config)# no boot network
Router(Config)# no service config
禁止IP Source Routing，防止路由欺骗
Router(Config)# no ip source-route
禁止ARP-Proxy服务
Router(Config-if)# no ip proxy-arp
禁止IP Directed Broadcast
Router(Config-if)# no ip directed-broadcast
禁止IP Classless(NAT上必须启用，否则部分网站上不了)
Router(Config)# no ip classless
禁止ICMP协议的IP Unreachables,Redirects,Mask Replies
Router(Config-if)# no ip unreachables
Router(Config-if)# no ip redirects
Router(Config-if)# no ip mask-reply
禁止SNMP协议服务
Router(Config)# no snmp-server enable traps
Router(Config)# no snmp-server system-shutdown
Router(Config)# no snmp-server
禁止WINS和DNS服务
Router(Config)# no ip domain-lookup
如果需要则需要配置：
Router(Config)# hostname Router
Router(Config)# ip name-server 202.101.172.35
配置时间戳为datetime方式，使用本地时间
Router(Config)# service timestamp log datetime localtime
Router(Config)# logging 192.168.1.188
Router(Config)# logging 61.175.192.27
路由器防止病毒的安全配置
1、 用于控制Nachi蠕虫的扫描
access-list 110 deny icmp any any echo
2、用于控制Blaster蠕虫的传播
access-list 110 deny tcp any any eq 4444
access-list 110 deny udp any any eq 69
3、用于控制Blaster蠕虫的扫描和攻击
access-list 110 deny tcp any any eq 135
access-list 110 deny udp any any eq 135
access-list 110 deny tcp any any eq 139
access-list 110 deny udp any any eq 139
access-list 110 deny tcp any any eq 445
access-list 110 deny udp any any eq 445
access-list 110 deny tcp any any eq 593
access-list 110 deny udp anyany eq 593
4、用于控制 Slammer 蠕虫的传播
access-list 110 deny udp any any eq 1434
5、用于防止受感染的系统被远程控制
access-list 110 deny tcp any any eq 5800
access-list 110 deny tcp any any eq 5900
6、用于控制受感染的系统与聊天服务器的通信
access-list 110 deny tcp any any eq 6667
7、用于控制IP Protocol为255 和0 的流量
access-list 110 deny 255 any any
access-list 110 deny 0 any any
access-list 110 permit ip any any
内网口in
路由器防止外网攻击内网的安全配置
access-list 120 permit tcp any any eq 23
access-list 120 deny tcp any any range 1 1023
access-list 120 deny udp any any range 1 1023
access-list 120 permit ip any any
外网口in