Konfiguration so in Ordnung?

[Milla 10]

Hallo,

 

ich will meine PIX 501 nur für HTTP und shoutcast Stream (in diesem Fall auf Port 8002) von inside nach outside nutzen

 

sollte oder muss ich an meinem Config File noch was ändern oder ist das so in Ordnung und natürlich auch "sicher"

Gruss

 

 

: Saved

: Written by enable_15 at 08:33:19.459 UTC Thu Jun 3 2004

PIX Version 6.3(3)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxxx encrypted

passwd xxxxx encrypted

hostname JWFW

domain-name hks

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list from-outside-coming-in permit icmp any any time-exceeded

access-list from-outside-coming-in permit icmp any any unreachable

access-list from-outside-coming-in deny ip any any

access-list from-in-coming-in permit tcp any any eq 8002

access-list from-in-coming-in permit tcp any any eq www

access-list from-in-coming-in deny ip any any

pager lines 24

logging on

logging timestamp

logging trap warnings

logging history warnings

logging facility 23

logging host inside 192.168.1.20

mtu outside 1500

mtu inside 1500

ip address outside 10.48.33.5 255.255.240.0

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 192.168.1.20 255.255.255.255 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 10 interface

nat (inside) 10 0.0.0.0 0.0.0.0 0 0

access-group from-outside-coming-in in interface outside

access-group from-in-coming-in in interface inside

route outside 0.0.0.0 0.0.0.0 10.48.33.1 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225

1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

http 192.168.1.20 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.30-192.168.1.40 inside

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Cryptochecksum:203d19ad5d657d09b0dae7c41c4d0d0e

: end