IOS防火墙+NAT+多个地址池+BT过滤+最大连接数限制+QoS的配置案例.doc

IOS防火墙+NAT+多个地址池+BT过滤+最大连接数限制+QoS的配置案例 下面是我做过1个案例，路由器是老cisco 2611，内存64M，flash=16M；我灌入了c2600-advsecurityk9-mz.123-14.T2.bin，虽然该版本是新2600xm的版本，在老2611下也运行正常。该版本具有如下特性：1：IOS防火墙2：可定义应用程序防火墙检查规则，即过滤经80端口掩护的即时消息和p2p应用3：支持NBAR4: 支持编号式ACL，即可删除和添加任意一个ACE语句，而不用编辑整个ACL。5：可按IP地址限制NAT记录数（连接数）6：支持比较完整的QoS，例如，通信管制等配置思路如下：1. 对大多数内网主机产生的且NBAR能识别的p2p执行丢弃2. 对特定主机产生的p2p允许通过3. 对特性允许p2p的主机限制连接数4. 从内到外，目的端口大于2000的报文限速（因为有可能包含未知蠕虫或未知p2p），上行速率限制5. 从外到内，对其源端口大于2000的报文限速，下行速率限制。6. 配置IOS防火墙，防止外部攻击7. 定义HTTP应用程序防火墙,防止非法利用端口80。如下是简要配置，希望对大家有所帮助，共同提高ip inspect hashtable-size 2048 /改善IOS防火墙的性能ip inspect name myfw cuseemeip inspect name myfw ftpip inspect name myfw h323ip inspect name myfw appfw h80ip inspect name myfw httpip inspect name myfw netshowip inspect name myfw rcmdip inspect name myfw realaudioip inspect name myfw smtpip inspect name myfw sqlnetip inspect name myfw streamworksip inspect name myfw tftpip inspect name myfw tcpip inspect name myfw udpip inspect name myfw vdoliveno ip dhcp use vrf connected!appfw policy-name h80 /定义应用程序HTTP防火墙策略application httpport-misuse default action reset alarm！class-map match-any p2p /定义已知p2p类description any p2pmatch protocol gnutellamatch protocol kazaa2match protocol fasttrackmatch protocol pcanywherematch protocol napstermatch protocol novadigmmatch protocol cuseemematch protocol bittorrentmatch protocol edonkeymatch protocol sap-pgmmatch protocol sap-appmatch protocol sap-msgmatch protocol winmx！class-map match-all out-bt match not access-group name acl-liu-1match class-map p2p！class-map match-all d3000match access-group name d3000！class-map match-all s3000match access-group name s3000！class-map match-all liumatch not access-group name acl-liumatch class-map p2p!policy-map limit-sclass s3000police cir 200000 bc 2000 be 2000conform-action transmitexceed-action dropviolate-action dropclass out-btdrop！policy-map limit-dclass d3000police cir 200000 bc 2000 be 2000conform-action transmitexceed-action dropviolate-action dropclass liudrop!interface Ethernet0/0ip address 内网地址ip access-group inside-2 inip accounting output-packetsip nbar protocol-discoveryip inspect myfw inip nat insideip virtual-reassemblyip tcp adjust-mss 1452full-duplexservice-policy input limit-d!interface Ethernet0/1ip address 公网地址1ip access-group out-in inip nbar protocol-discoveryip nat outsideip virtual-reassemblyfull-duplexservice-policy input limit-sservice-policy output limit-d!ip classlessip route 公网网关ip route 内部子网1 内部网关ip route 内部子网2 内部网关ip route 内部子网3 内部网关!no ip http serverno ip http secure-serverip nat translation timeout 300ip nat translation tcp-timeout 1800ip nat translation max-entries list acl-jx 400 /限制其连接数ip nat translation max-entries host 内部特性主机地址 200 /限制其连接数ip nat pool pool-1 公网地址1 公网地址1 prefix-length 26ip nat pool pool-0 公网地址2 公网地址2 prefix-length 26ip nat pool pool-2 公网地址3 公网地址3 prefix-length 26ip nat pool pool-3 公网地址4 公网地址4 prefix-length 26ip nat pool pool-4 公网地址5 公网地址5 prefix-length 26ip nat pool pool-5 公网地址6 公网地址6 prefix-length 26ip nat inside source route-map bt pool pool-0 overloadip nat inside source route-map hz pool pool-2 overloadip nat inside source route-map jx pool pool-3 overloadip nat inside source route-map kjc pool pool-1 overload!ip access-list extended acl-hzpermit ip 内部子网1 anyip access-list extended acl-jxpermit ip 内部子网2 anyip access-list extended acl-kjcpermit ip 内部子网3 anyip access-list extended acl-liupermit ip host 特性主机 anyip access-list extended acl-liu-1permit ip any host 公网地址1ip access-list extended d3000permit tcp any any gt 2000permit udp any any gt 2000ip access-list extended inside-2 /常规过滤和过滤已知蠕虫deny udp any any eq 135deny tcp any any eq 135deny udp any any eq netbios-nsdeny tcp any any eq 137deny udp any any eq netbios-dgmdeny tcp any any eq 138deny udp any any eq netbios-ssdeny tcp any any eq 139deny udp any any eq 445deny tcp any any eq 445deny tcp any any eq 593deny tcp any any eq 707deny udp any any eq 1434deny tcp any any eq 4444deny tcp any any eq 8888deny tcp any any eq 7778deny tcp any any eq 8594deny tcp any any eq 8563deny tcp any any eq 33333deny tcp any any eq 6667deny tcp any any eq 11173permit ip 内网地址段1 anypermit ip 内网地址段2 any！ip access-list extended out-indeny ip any anyip access-list extended s3000permit tcp any gt 2000 anypermit udp any gt 2000 any!route-map hz permit 10description hang-zhangmatch ip a