☰

Cisco PIX 防火墙版本 6.3(5)

tag-icon • tag-icon ssh firewall cisco cisco-pix
Cisco PIX 防火墙版本 6.3(5)

我无法通过 ssh 连接到任何服务器。除了公司防火墙，我已经用尽了所有可能的方法。这是一台旧的 cisco pix 防火墙。

[模型]

Cisco PIX 501

我正在尝试弄清楚

1）如何暂时禁用它以证明它确实是问题所在。

2）如何让端口 22 通过（ssh），因为我的 ssh 请求从未到达目标服务器。

我用它尝试了一些方法，但我不是硬件专家。所以任何帮助都将非常有用。

部分配置

fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names         
object-group service ssh tcp 
  port-object range ssh ssh 
access-list acl_in permit udp any any eq domain 
access-list acl_in permit icmp any any 
access-list acl_in permit tcp any any eq www 
access-list acl_in permit tcp any any eq pop3 
access-list acl_in permit tcp any any eq smtp 
access-list acl_in permit tcp any any eq https 
access-list acl_in permit tcp any any eq 3389 
access-list acl_in permit tcp any any eq ftp 
access-list acl_in permit tcp any any eq ftp-data 
access-list acl_in permit ip xxx 255.255.255.0 xxx 255.255.255.0 
access-list acl_in permit tcp any any eq 8080 
access-list acl_in permit udp any any eq ntp 
access-list acl_in permit tcp any any eq 123 
access-list acl_in permit tcp any any range 6881 6999 
access-list acl_in permit tcp any any eq 9090 
access-list acl_in permit tcp any any eq 9100 
access-list acl_in permit tcp any any eq 2083 
access-list acl_in permit tcp any any eq 6100 
access-list acl_in permit udp any any eq 6100 
access-list acl_in permit udp any any eq 9675 
access-list acl_in permit tcp any any eq 9675 
access-list acl_in permit tcp any any eq 1935 
access-list acl_in permit tcp any any eq 563 
access-list acl_in permit tcp any any eq 56065 
access-list acl_in permit tcp any any eq 8100 
access-list acl_in permit tcp any any eq 5001 
access-list acl_in permit tcp any eq ssh any log 
access-list acl_out permit icmp any any 
access-list acl_out permit tcp any host xxx eq https 
access-list acl_out permit tcp any host xxx eq smtp 
access-list acl_out permit tcp any host xxx eq pop3 
access-list acl_out permit tcp any any eq www 
access-list acl_out permit tcp any any range 6881 6999 
access-list acl_out permit tcp any any eq 9090 
access-list acl_out permit tcp any host xxx eq 10000 
access-list acl_out permit tcp any any eq ssh

...

ssh xx.xx.xxx.xxx 255.255.255.255 outside
ssh xx.xxx.xxx.xxx 255.255.255.255 outside
ssh timeout 60

答案1

为了允许 SSH 出站，需要在配置中添加一条明确规则。您在配置中显示的访问列表有点奇怪...

您可能需要添加：

access-list acl_out permit tcp any any eq ssh

请尝试并报告。

编辑，您尝试了哪些故障排除步骤？您是否尝试连接到已知可访问的服务器？上下文的完整配置将很有帮助。

相关内容