форумы  помощь  поиск  регистрация  майллист  вход/выход  слежка

Вариант для распечатки		Пред. тема | След. тема
Форумы Маршрутизаторы CISCO и др. оборудование. (Public)
Изначальное сообщение		[ Отслеживать ]

"Portforward на Cisco 851 по PPPoE"

Сообщение от kvasik (ok) on 30-Сен-08, 13:44

Добрый день. Есть необходимость настроить пеброс портов, на внутренний ИП-адрес. Прописал: "ip nat inside source static tcp 192.168.0.15 4899 171.69.XXX.XXX 4899" но этого не достаточно подскажите что делаю не так. Еще другой вопрос, если прописывать portforward, нарпример для DC, и адрес удаленного хоста прописывать не надо, достаточно прописать строку вида: "ip nat inside source static tcp 192.168.0.15 4899 interface FastEthernet4 4899" ? И еще несколько вопросов накопилось, подскажите чайнику :) 1)почему в строке: "line vty 0 4" обычно указывают именно эти значения, на что они указывают. 2)При условии что на Cisco еще не настроен фаерволл, есть вероятность подбора пароля, как поставить ограничение на неправильное количество вводимых паролей, или по умолчанию уже имеется какая-то защита? 3) Встречал что в конфиге часто присутствует строка "no cdp run" (Cisco Discovery Protocol), если это не прописать, то управление по этому протоколу всегда открыто, даже если не задавать для него пароль? 4) Как задать имя логина, чтобы при подключении предлагалось его ввести? Буду благодарен за ответы. Думаю, они пудут полезны не только для меня :) ===== Current configuration : 1809 bytes                                               !                                                                               version 12.4                                                                     no service pad                                                                   service timestamps debug datetime msec                                           service timestamps log datetime msec                                             service password-encryption                                                     !                                                                               hostname Router                                                                     !                                                                               boot-start-marker                                                               boot-end-marker                                                                 !                                                                               !                                                                               no aaa new-model                                                                 !                                                                               resource policy                                                                 !                                                                               ip subnet-zero                                                                   no ip dhcp use vrf connected                                                     no ip dhcp conflict logging                                                     ip dhcp excluded-address 192.168.0.1 192.168.0.99                               ip dhcp excluded-address 192.168.0.200 192.168.0.255                             !                                                                               ip dhcp pool DHCPooL                                                                import all                                                                      network 192.168.0.0 255.255.255.0                                                default-router 192.168.0.1                                                      dns-server 192.168.0.1                                                          lease 365                                                                     !                                                                               !                                                                               ip cef                                                                           vpdn enable                                                                     !                                                                               !                                                                               ! !                                                                         interface FastEthernet0                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet1                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet2                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet3                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet4                                                         no ip address                                                                   no ip unreachables                                                             ip nat outside                                                                 ip virtual-reassembly                                                           speed auto                                                                     full-duplex                                                                     pppoe enable group global                                                       pppoe-client dial-pool-number 10                                               !                                                                               interface Vlan1                                                                 ip address 192.168.0.1 255.255.255.0                                           ip nat inside                                                                   ip virtual-reassembly                                                           !                                                                               interface Dialer1                                                               ip address negotiated                                                           ip access-group 110 in                                                         ip mtu 1492                                                                     ip nat outside                                                                 ip virtual-reassembly                                                           encapsulation ppp                                                               dialer pool 10                                                                 dialer-group 10                                                                 ppp chap hostname *****                                                     ppp chap password 7 *****                                             ppp ipcp dns request                                                           !                                                                               ip classless                                                                     ip route 0.0.0.0 0.0.0.0 Dialer1                                                 !                                                                               no ip http server                                                               no ip http secure-server                                                         ip nat inside source list 100 interface Dialer1 overload ip nat inside source static tcp 192.168.0.15 4899 171.69.XXX.XXX 4899                         ip dns server                                                                   !                                                                               access-list 100 permit ip 192.168.0.0 0.0.0.255 any                             dialer-list 10 protocol ip permit                                               !                                                                               control-plane                                                                   !                                                                               !                                                                               line con 0                                                                       password 7 *****                                               login                                                                           no modem enable                                                                 line aux 0                                                                       password 7 *****                                               login                                                                           line vty 0 4                                                                     password 7 *****                                               login                                                                           !                                                                               scheduler max-task-time 5000                                                     end =====

Высказать мнение | Ответить | Правка | Cообщить модератору

Сообщения по теме

[Сортировка по времени | RSS]

1. "Portforward на Cisco 851 по PPPoE"

Сообщение от CrAzOiD (ok) on 30-Сен-08, 14:07

>Добрый день. >Есть необходимость настроить пеброс портов, на внутренний ИП-адрес. >Прописал: "ip nat inside source static tcp 192.168.0.15 4899 171.69.XXX.XXX 4899" >но этого не достаточно подскажите что делаю не так. Достаточно. Разберитесь только со 101 ACL >Еще другой вопрос, если прописывать portforward, нарпример для DC, и адрес удаленного >хоста прописывать не надо, достаточно прописать строку вида: >"ip nat inside source static tcp 192.168.0.15 4899 interface FastEthernet4 4899" ? неа... если указан интерфейс, то просто берется IP с этого интерфеййса >И еще несколько вопросов накопилось, подскажите чайнику :) >1)почему в строке: "line vty 0 4" обычно указывают именно эти значения, >на что они указывают. По умолчанию есть 5 VTY говоря vty 0 4 указывают диапазон от 0 до 4. Можно настраивать по отдельности, но смысл в этом небольшой (но иногда есть) >2)При условии что на Cisco еще не настроен фаерволл, есть вероятность подбора >пароля, как поставить ограничение на неправильное количество вводимых паролей, или по >умолчанию уже имеется какая-то защита? у вас есть входящий 101 acl, хоят в конфиге я его не нешел Это значит что входящий трафик дропается Есть. Смотрите в сторону команды security, например security authentication failure rate 3 log security passwords min-length 6 >3) Встречал что в конфиге часто присутствует строка "no cdp run" (Cisco >Discovery Protocol), если это не прописать, то управление по этому протоколу >всегда открыто, даже если не задавать для него пароль? Это не управление. Чисто информационный протокол. >4) Как задать имя логина, чтобы при подключении предлагалось его ввести? username xxx priv 15 secret xxx ! line vty 0 4 login local ! line con 0 login local !

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

2. "Portforward на Cisco 851 по PPPoE"

Сообщение от GolDi (??) on 30-Сен-08, 14:08

>[оверквотинг удален] >line aux 0 > password 7 ***** > login >line vty 0 4 > password 7 ***** > login >! >scheduler max-task-time 5000 >end >===== Ответы на все ваши вопросы: http://emanual.ru/download/3579.html

Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

	3. "Portforward на Cisco 851 по PPPoE"
	Сообщение от kvasik (ok) on 10-Окт-08, 13:34
	>Ответы на все ваши вопросы: >http://emanual.ru/download/3579.html Спасибо. Сделал акцесс листы на 3 интерфейса (Dialer1, Vlan1, FastEthernet4) на весь входящий трафик,  но все-равно не получается форвардить порты на машины внутренней сети. Подскажите что не так в конфиге? :( ===== Building configuration...                                                                                                                                        Current configuration : 2865 bytes                                               !                                                                               version 12.4                                                                     no service pad                                                                   service timestamps debug datetime msec                                           service timestamps log datetime msec                                             service password-encryption                                                     !                                                                               hostname Router                                                                     !                                                                               boot-start-marker                                                               boot-end-marker                                                                 !                                                                               !                                                                               no aaa new-model                                                                 !                                                                               resource policy                                                                 !                                                                               ip subnet-zero                                                                   no ip dhcp use vrf connected                                                     no ip dhcp conflict logging                                                     ip dhcp excluded-address 192.168.0.1 192.168.0.99                                                         !                                                                               ip dhcp pool DPOOL                                                                import all                                                                      network 192.168.0.0 255.255.255.0                                                default-router 192.168.0.1                                                      dns-server 192.168.0.1                                                          lease 0 10                                                                   !                                                                               !                                                                               ip cef                                                                           vpdn enable                                                                     !                                                                               !                                                                               !                                                                               !                                                                               username name privilege 15 secret 5 *****               !                                                                               !                                                                               !                                                                               !                                                                               !                                                                               interface FastEthernet0                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet1                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet2                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet3                                                         spanning-tree portfast                                                         !                                                                               interface FastEthernet4                                                         description internet interface                                                 no ip address                                                                   ip access-group 101 in                                                         no ip unreachables                                                             ip nat outside                                                                 ip virtual-reassembly                                                           speed auto                                                                     full-duplex                                                                     pppoe enable group global                                                       pppoe-client dial-pool-number 10                                               !                                                                               interface Vlan1                                                                 ip address 192.168.0.1 255.255.255.0                                           ip access-group 103 in ip nat inside                                                               ip virtual-reassembly                                                           !                                                                               interface Dialer1                                                               ip address negotiated                                                           ip access-group 102 in                                                         ip mtu 1492                                                                     ip nat outside                                                                 ip virtual-reassembly                                                           encapsulation ppp                                                               dialer pool 10                                                                 dialer-group 10                                                                 ppp chap hostname *****                                                     ppp chap password 7 *****                                             ppp ipcp dns request                                                           !                                                                               ip classless                                                                     ip route 0.0.0.0 0.0.0.0 Dialer1                                                 !                                                                               no ip http server                                                               no ip http secure-server                                                         ip nat inside source list 100 interface Dialer1 overload                         ip nat inside source static tcp 192.168.0.200 80 XXX.XXX.XXX.XXX 80 extendable     ip nat inside source static tcp 192.168.0.201 4899 XXX.XXX.XXX.XXX 4899 extendable ip dns server                                                                   !                                                                                                                                                                                                                 access-list 100 permit ip 192.168.0.0 0.0.0.255 any                                                           access-list 101 permit icmp any any                                             access-list 101 permit tcp any any                                               access-list 101 permit ip any any                                               access-list 102 permit tcp any any                                               access-list 102 permit udp any any                                               access-list 102 permit ip any any   access-list 103 permit tcp any any                                               access-list 103 permit udp any any                                               access-list 103 permit ip any any                                               dialer-list 10 protocol ip permit                                               !                                                                               control-plane                                                                   !                                                                               !                                                                               line con 0                                                                       password 7 *****                                               login local                                                                     no modem enable                                                                 line aux 0                                                                       password 7 *****                                               login local                                                                     line vty 0 4                                                                     password 7 *****                                               login local                                                                     !                                                                               scheduler max-task-time 5000                                                     end =====
	Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

	4. "Portforward на Cisco 851 по PPPoE"
	Сообщение от kvasik (ok) on 13-Окт-08, 13:07
	Проблема решилась, необходимо было изменить строку, где надо было указать интерфейс дозвона: "ip nat inside source static tcp 192.168.0.3 4899 interface Dialer1 4899"
	Высказать мнение | Ответить | Правка | Наверх | Cообщить модератору

Архив | Удалить	Индекс форумов | Темы | Пред. тема | След. тема
Оцените тред (1=ужас, 5=супер)? [ 1 | 2 | 3 | 4 | 5 ] [Рекомендовать для помещения в FAQ]