Cisco 2621上NAT配置清单

Cisco 2621上NAT配置清单
nat2621#sh run

Building configuration...

 

Current configuration : 1954 bytes

!

version 12.2

service timestamps debug uptime

service timestamps log datetime localtime

service password-encryption

!        

hostname nat2621

!

enable secret 5 $1$6LK3$lZo0pt/F..KTTLB0B4UDX/

enable password 7 120D09130134041C2E7E767D62637543

!

ip subnet-zero

no ip source-route

!

!

no ip domain-lookup

!

no ip bootp server

!

!

!

interface FastEthernet0/0

 ip address 61.175.192.22 255.255.255.240

 ip access-group 120 in

 no ip redirects

 no ip unreachables

 no ip proxy-arp

 ip nat outside

 no ip mroute-cache

 speed auto

 full-duplex

 no cdp enable

!

interface FastEthernet0/1

 ip address 192.168.1.254 255.255.255.0

 ip access-group 110 in

 no ip redirects

 no ip unreachables

 no ip proxy-arp

 ip nat inside

 no ip mroute-cache

 duplex auto

 speed auto

 no cdp enable

!

ip nat pool internet 61.175.192.18 61.175.192.21 netmask 255.255.255.240

ip nat inside source list 1 pool internet overload

ip classless

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

no ip http server

ip pim bidir-enable

!

!

access-list 1 permit 192.168.1.0 0.0.0.255

access-list 110 deny   icmp any any echo

access-list 110 deny   tcp any any eq 4444

access-list 110 deny   udp any any eq tftp

access-list 110 deny   tcp any any eq 135

access-list 110 deny   tcp any any eq 139

access-list 110 deny   udp any any eq netbios-ss

access-list 110 deny   udp any any eq 135

access-list 110 deny   udp any any eq 445

access-list 110 deny   tcp any any eq 445

access-list 110 deny   tcp any any eq 593

access-list 110 deny   udp any any eq 593

access-list 110 deny   udp any any eq 1434

access-list 110 deny   ip host 192.168.1.8 any

access-list 110 permit ip any any

access-list 120 permit tcp any any eq telnet

access-list 120 deny   tcp any any range 1 1023

access-list 120 deny   udp any any range 1 1023

access-list 120 permit ip any any

no cdp run

snmp-server community tlds_hxd5251670 RO

!

line con 0

line aux 0

line vty 0 4

 password 7 0978622D2A3A141B180F0B7F797179656272

 login

!

!

end

 

Nat2621安全配置：

 

使用访问控制列表和高强度的密码控制远程访问路由器

 

启用Service password-encryption

Router(Config)# Service password-encryption

 

禁止CDP(Cisco Discovery Protocol)
Router(Config)#no cdp run
Router(Config-if)# no cdp enable

 

禁止其他的TCP、UDP Small服务
Router(Config)# no service tcp-small-servers
Router(Config)# no service udp-samll-servers

 

禁止Finger服务
Router(Config)# no ip finger
Router(Config)# no service finger

 

禁止HTTP服务

Router(Config)# no ip http server

 

禁止BOOTp服务
Router(Config)# no ip bootp server

 

禁止从网络启动和自动从网络下载初始配置文件
Router(Config)# no boot network
Router(Config)# no service config

 

禁止IP Source Routing，防止路由欺骗
Router(Config)# no ip source-route

 

禁止ARP-Proxy服务
Router(Config-if)# no ip proxy-arp

 

禁止IP Directed Broadcast
Router(Config-if)# no ip directed-broadcast

 

禁止IP Classless(NAT上必须启用，否则部分网站上不了)
Router(Config)# no ip classless

 

禁止ICMP协议的IP Unreachables,Redirects,Mask Replies
Router(Config-if)# no ip unreachables
Router(Config-if)# no ip redirects
Router(Config-if)# no ip mask-reply

 

禁止SNMP协议服务

Router(Config)# no snmp-server enable traps
Router(Config)# no snmp-server system-shutdown
Router(Config)# no snmp-server

 

禁止WINS和DNS服务

Router(Config)# no ip domain-lookup

如果需要则需要配置：
Router(Config)# hostname Router
Router(Config)# ip name-server 202.101.172.35

 

配置时间戳为datetime方式，使用本地时间

Router(Config)# service timestamp log datetime localtime

Router(Config)# logging 192.168.1.188

Router(Config)# logging 61.175.192.27

 

路由器防止病毒的安全配置
1、 用于控制Nachi蠕虫的扫描
access-list 110 deny icmp any any echo

2、用于控制Blaster蠕虫的传播
access-list 110 deny tcp any any eq 4444
access-list 110 deny udp any any eq 69

3、用于控制Blaster蠕虫的扫描和攻击
access-list 110 deny tcp any any eq 135
access-list 110 deny udp any any eq 135
access-list 110 deny tcp any any eq 139
access-list 110 deny udp any any eq 139
access-list 110 deny tcp any any eq 445
access-list 110 deny udp any any eq 445
access-list 110 deny tcp any any eq 593
access-list 110 deny udp anyany eq 593

4、用于控制 Slammer 蠕虫的传播
access-list 110 deny udp any any eq 1434

5、用于防止受感染的系统被远程控制

access-list 110 deny tcp any any eq 5800

access-list 110 deny tcp any any eq 5900

6、用于控制受感染的系统与聊天服务器的通信

access-list 110 deny tcp any any eq 6667

7、用于控制IP Protocol为255 和0 的流量

access-list 110 deny 255 any any
access-list 110 deny 0 any any

access-list 110 permit ip any any

 

内网口in

 

路由器防止外网攻击内网的安全配置

 

access-list 120 permit tcp any any eq 23

access-list 120 deny tcp any any range 1 1023

access-list 120 deny udp any any range 1 1023

access-list 120 permit ip any any

外网口in