思科PIX防火墙VPN的配置实例

　　names

　　!--- This is traffic to PIX Central.

　　access-list 110 permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

　　!--- Do not do NAT on traffic to PIX Central.

　　access-list 100 permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

　　pager lines 24

　　logging on

　　mtu outside 1500

　　mtu inside 1500

　　ip address outside 172.18.124.154 255.255.255.0

　　ip address inside 10.2.2.1 255.255.255.0

　　ip audit info action alarm

　　ip audit attack action alarm

　　no failover

　　failover timeout 0:00:00

　　failover poll 15

　　no failover ip address outside

　　no failover ip address inside

　　pdm history enable

　　arp timeout 14400

　　!--- Do not do NAT on traffic to PIX Central.

　　nat (inside) 0 access-list 100

　　route outside 0.0.0.0 0.0.0.0 172.18.124.1 1

　　timeout xlate 3:00:00

　　timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

　　timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

　　timeout uauth 0:05:00 absolute

　　aaa-server TACACS+ protocol tacacs+

　　aaa-server RADIUS protocol radius

　　aaa-server LOCAL protocol local

　　no snmp-server location

　　no snmp-server contact

　　snmp-server community public

　　no snmp-server enable traps

　　floodguard enable

　　sysopt connection permit-ipsec

　　crypto ipsec transform-set myset esp-des esp-md5-hmac