下载文档原格式
asa 5505 常用配置2009-06-01 16:13asa 55051.配置防火墙名ciscoasa> enableciscoasa# configure terminalciscoasa(config)# hostname asa55052.配置telnetasa5505(config)#telnet 192.168.1.0 255.255.255.0 inside//允许内部接口192.168.1.0网段telnet防火墙3.配置密码asa5505(config)# password cisco//远程密码asa5505(config)# enable password cisco//特权模式密码4.配置IPasa5505(config)# interface vlan 2//进入vlan2asa5505(config-if)# ip address 218.xxx.37.222 255.255.255.192 //vlan2配置IPasa5505(config)#show ip address vlan2//验证配置5.端口加入vlanasa5505(config)# interface e0/3//进入接口e0/3asa5505(config-if)# switchport access vlan 3//接口e0/3加入vlan3asa5505(config)# interface vlan 3//进入vlan3asa5505(config-if)# ip address 10.10.10.36 255.255.255.224//vlan3配置IPasa5505(config-if)# nameif dmz//vlan3名asa5505(config-if)# no shutdown//开启asa5505(config-if)# show switch vlan//验证配置6.最大传输单元MTUasa5505(config)#mtu inside 1500//inside最大传输单元1500字节asa5505(config)#mtu outside 1500//outside最大传输单元1500字节asa5505(config)#mtu dmz 1500//dmz最大传输单元1500字节7.配置arp表的超时时间asa5505(config)#arp timeout 14400//arp表的超时时间14400秒8.FTP模式asa5505(config)#ftp mode passive//FTP被动模式9.配置域名asa5505(config)#domain-name 10.启动日志asa5505(config)#logging enable//启动日志asa5505(config)#logging asdm informational//启动asdm报告日志asa5505(config)#Show logging//验证配置11.启用http服务asa5505(config)#http serverenable//启动HTTP server,便于ASDM连接。
ASA防火墙配置笔记二〇〇六年十月二十七日序言：Cisco新的防火墙ASA系列已经面市了，将逐步取代PIX防火墙，网上关于ASA配置资料很少，现把我积累的ASA配置技术编写一个文档，供大家参考。
如有问题，可发邮件给我。
1. ....................................................................................... 常用技巧12. ....................................................................................... 故障倒换13. ....................................................... 配置telnet、ssh及http管理34. ........................................................................ v pn常用管理命令35. ............................................................................... 配置访问权限36. .................................................................. 配置sitetosite之VPN47. .............................................................. w ebvpn配置（ssl vpn）48. .............................................................................. 远程拨入VPN59. ........................................................................... 日志服务器配置610. .......................................................................... Snmp网管配置711. .................................................................................... ACS配置712. ................................................................................... AAA配置713. ..................................................................................... 升级IOS814. ..................................................................................... 疑难杂症81.常用技巧Sh ru ntp查看与ntp有关的Sh ru crypto 查看与vpn有关的Sh ru | inc crypto 只是关健字过滤而已2.故障倒换failoverfailover lan unit primaryfailover lan interface testint Ethernet0/3failover link testint Ethernet0/3failover mac address Ethernet0/1 0018.1900.5000 0018.1900.5001failover mac address Ethernet0/0 0018.1900.4000 0018.1900.4001failover mac address Ethernet0/2 0018.1900.6000 0018.1900.6001failover mac address Management0/0 0018.1900.7000 0018.1900.7001failover interface ip testint 10.3.3.1 255.255.255.0 standby 10.3.3.2注：最好配置虚拟MAC地址sh failover显示配置信息write standby写入到备用的防火墙中failover命令集如下：configure mode commands/options:interface Configure the IP address and mask to be used for failoverand/or stateful update informationinterface-policy Set the policy for failover due to interface failureskey Configure the failover shared secret or keylan Specify the unit as primary or secondary or configure theinterface and vlan to be used for failover communication link Configure the interface and vlan to be used as a link forstateful update informationmac Specify the virtual mac address for a physical interface polltime Configure failover poll intervalreplication Enable HTTP (port 80) connection replicationtimeout Specify the failover reconnect timeout value forasymmetrically routed sessionssh failover 命令集如下：history Show failover switching historyinterface Show failover command interface informationstate Show failover internal state informationstatistics Show failover command interface statistics information| Output modifiers<cr>3.配置telnet、ssh及http管理username jiang password Csmep3VzvPQPCbkx encrypted privilege 15aaa authentication enable console LOCALaaa authentication telnet console LOCALaaa authentication ssh console LOCALaaa authorization command LOCALhttp 192.168.40.0 255.255.255.0 managementssh 192.168.40.0 255.255.255.0 inside4.vpn常用管理命令sh vpn-sessiondb full l2l 显示site to site 之vpn通道情况sh ipsec stats 显示ipsec通道情况sh vpn-sessiondb summary 显示vpn汇总信息sh vpn-sessiondb detail l2l 显示ipsec详细信息sh vpn-sessiondb detail svc 查看ssl client信息sh vpn-sessiondb detail webvpn 查看webvpn信息sh vpn-sessiondb detail full l2l 相当于linux下的ipsec whack –status 如果没有建立连接，则表示ipsec通道还没有建立起来。
cisco防火墙配置的基本配置1、nameif设置接口名称，并指定安全级别，安全级别取值范围为1～100，数字越大安全级别越高。
使用命令：PIX525(config)#nameifethernet0outsidesecurity0PIX525(config)#nameifethernet1insidesecurity100PIX525(config)#nameifethernet2dmzsecurity502、interface配置以太口工作状态，常见状态有：auto、100full、shutdown。
auto：设置网卡工作在自适应状态。
100full：设置网卡工作在100Mbit/s，全双工状态。
shutdown：设置网卡接口关闭，否则为激活。
命令：PIX525(config)#interfaceethernet0autoPIX525(config)#interfaceethernet1100fullPIX525(config)#interfaceethernet1100fullshutdown3、ipaddress配置网络接口的IP地址4、global指定公网地址范围：定义地址池。
Global命令的配置语法：global(if_name)nat_idip_address-ip_address[netmarkglobal_mask]其中：(if_name)：表示外网接口名称，一般为outside。
nat_id：建立的地址池标识(nat要引用)。
ip_address-ip_address：表示一段ip地址范围。
[netmarkglobal_mask]：表示全局ip地址的网络掩码。
5、nat地址转换命令，将内网的私有ip转换为外网公网ip。
6、routeroute命令定义静态路由。
语法：route(if_name)00gateway_ip[metric]7、static配置静态IP地址翻译，使内部地址与外部地址一一对应。
C. 配置fixup协议fixup命令作用是启用，禁止，改变一个服务或协议通过pix防火墙，由fixup命令指定的端口是pix防火墙要侦听的服务。
见下面例子：例1．Pix525(config)#fixup protocol ftp 21启用ftp协议，并指定ftp的端口号为21例2．Pix525(config)#fixup protocol http 80Pix525(config)#fixup protocol http 1080 为http协议指定80和1080两个端口。
例3．Pix525(config)#no fixup protocol smtp 80禁用smtp协议。
D. 设置telnettelnet有一个版本的变化。
在pix OS 5.0（pix操作系统的版本号）之前，只能从内部网络上的主机通过telnet访问pix。
在pix OS 5.0及后续版本中，可以在所有的接口上启用telnet 到pix的访问。
当从外部接口要telnet到pix防火墙时，telnet数据流需要用ipsec提供保护，也就是说用户必须配置pix来建立一条到另外一台pix，路由器或vpn客户端的ipsec隧道。
另外就是在PIX上配置SSH，然后用SSH client从外部telnet到PIX防火墙，PIX支持SSH1和SSH2，不过SSH1是免费软件，SSH2是商业软件。
相比之下cisco路由器的telnet就作的不怎么样了。
telnet配置语法：telnet local_ip [netmask] local_ip 表示被授权通过telnet访问到pix的ip 地址。
如果不设此项，pix的配置方式只能由console进行。
说了这么多，下面给出一个配置实例供大家参考。
Welcome to the PIX firewallType help or '?' for a list of available commands.PIX525> enPassword:PIX525#sh config: Saved:PIX Version 6.0(1) ------ PIX当前的操作系统版本为6.0Nameif ethernet0 outside security0Nameif ethernet1 inside security100 ------ 显示目前pix只有2个接口Enable password 7Y051HhCcoiRTSQZ encryptedPassed 7Y051HhCcoiRTSQZ encrypted ------ pix防火墙密码在默认状态下已被加密，在配置文件中不会以明文显示，telnet 密码缺省为ciscoHostname PIX525 ------ 主机名称为PIX525Domain-name ------ 本地的一个域名服务器，通常用作为外部访问Fixup protocol ftp 21Fixup protocol http 80fixup protocol h323 1720fixup protocol rsh 514fixup protocol smtp 25fixup protocol sqlnet 1521fixup protocol sip 5060 ------ 当前启用的一些服务或协议，注意rsh服务是不能改变端口号names ------ 解析本地主机名到ip地址，在配置中可以用名字代替ip地址，当前没有设置，所以列表为空pager lines 24 ------ 每24行一分页interface ethernet0 autointerface ethernet1 auto ------ 设置两个网卡的类型为自适应mtu outside 1500mtu inside 1500 ------ 以太网标准的MTU长度为1500字节ip address outside 61.144.51.42 255.255.255.248ip address inside 192.168.0.1 255.255.255.0 ------ pix外网的ip地址61.144.51.42，内网的ip地址192.168.0.1ip audit info action alarmip audit attack action alarm ------ pix入侵检测的2个命令。
不支持故障切换global (outside) 1global (outside) 1global (outside) 1定义内部网络地址将要翻译成的全局地址或地址范围nat (inside) 0 access-list 101使得符合访问列表为101地址不通过翻译，对外部网络是可见的nat (inside) 1 0 0内部网络地址翻译成外部地址nat (dmz) 1 0 0DMZ区网络地址翻译成外部地址static (inside,outside) netmask 0 0static (inside,outside) netmask 0 0static (inside,outside) netmask 0 0设定固定主机与外网固定IP之间的一对一静态转换static (dmz,outside) netmask 0 0设定DMZ区固定主机与外网固定IP之间的一对一静态转换static (inside,dmz) netmask 0 0设定内网固定主机与DMZ IP之间的一对一静态转换static (dmz,outside) netmask 0 0设定DMZ区固定主机与外网固定IP之间的一对一静态转换access-group 120 in interface outsideaccess-group 120 in interface insideaccess-group 120 in interface dmz将访问列表应用于端口conduit permit tcp host anyconduit permit tcp host anyconduit permit tcp host anyconduit permit tcp host any设置管道：允许任何地址对全局地址进行TCP协议的访问conduit permit icmp any设置管道：允许任何地址对rip outside passive version 2rip inside passive version 2route outside设定默认路由到电信端route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1设定路由回指到内部的子网timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absoluteaaa-server TACACS+ protocol tacacs+aaa-server RADIUS protocol radiusaaa-server LOCAL protocol localno snmp-server locationno snmp-server contactsnmp-server community publicno snmp-server enable trapsfloodguard enablesysopt connection permit-ipsecsysopt connection permit-pptpservice resetinboundservice resetoutsidecrypto ipsec transform-set myset esp-des esp-md5-hmac。
如何配置思科IOS防火墙如何配置思科IOS防火墙思科依靠自身的技术和对网络经济模式的深刻理解，使他成为了网络应用的成功实践者之一，其制造的路由器也是全球顶尖的，那么你知道如何配置思科IOS防火墙吗?下面是店铺整理的一些关于如何配置思科IOS防火墙的相关资料，供你参考。
配置思科IOS防火墙的方法：拓扑图配置思科IOS防火墙步骤第一步：在R1 、 R2 、 R3上的预配置r1(config)#int e0/0r1(config-if)#ip add 172.16.1.1 255.255.255.0r1(config-if)#no shr1(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.2配置静态路由r1(config)#^Zr2(config)#int e0/0r2(config-if)#ip add 172.16.1.2 255.255.255.0r2(config-if)#no shr2(config-if)#int e2/0r2(config-if)#ip add 192.168.1.2 255.255.255.0r2(config-if)#no shr3(config)#int e2/0r3(config-if)#ip add 192.168.1.3 255.255.255.0r3(config-if)#no shr3(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.2 配置静态路由r3(config)#^Zr3(config)#li vty 0 4r3(config-line)#passr3(config-line)#password ciscor3(config-line)#exit第二步：在R2上配置zhangr2#conf tEnter configuration commands, one per line. End with CNTL/Z.r2(config)#ip inspect name zhang tcp 检查TCPr2(config)#ip inspect name zhang udp 检查udpr2(config)#ip inspect udp idle-time 60 检查udp 的时间是60S r2(config)#ip inspect name zhang icmp timeout 5 超时时间是5Sr2(config)#ip inspect name zhang http alert off 控制HTTPr2(config)#r2(config)#int e0/0r2(config-if)#ip inspect zhang in 在e0/0接口检查流量是否满足以上所定义过的任何一条r2(config-if)#exitr2(config)#acce 100 deny ip any any log 做ACL拒绝IP的任何包通过r2(config)#int e2/0r2(config-if)#ip acce 100 in 将ACL要用到e2/0的进接口上第三步：从R1上TELNET R3r1#telnet 192.168.1.3Trying 192.168.1.3 ... OpenUser Access VerificationPassword:r3>从R3上TELNET R1r3#telnet 172.16.1.1Trying 172.16.1.1 ...% Destination unreachable; gateway or host down第四步：从R1上ping R2直连接口r1#ping 172.16.1.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 28/54/92 ms从R2上ping R1直连接口r2#ping 172.16.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 16/67/124 ms从R2ping R3直连接口r2#ping*Mar 1 00:15:20.615: %SYS-5-CONFIG_I: Configured from console by consoler2#ping 192.168.1.3Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:*Mar 1 00:15:28.055: %SEC-6-IPACCESSLOGDP: list 100 denied icmp 192.168.1.3 -> 192.168.1.2 (0/0), 1 packet..... //说明icmp包可以到达，但是没有回包Success rate is 0 percent (0/5)从R3ing R2连接口r3#ping 192.168.1.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:U.U.U //说明icmp包不可以到达目的地Success rate is 0 percent (0/5)r1#ping 192.168.1.3Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 76/124/156 msr2#debug ip inspect icmpINSPECT ICMP Inspection debugging is onr2#*Mar 1 00:35:09.187: CBAC: ICMP Echo pkt 172.16.1.1 => 192.168.1.3*Mar 1 00:35:09.187: CBAC: ICMP Echo pkt 172.16.1.1 => 192.168.1.3*Mar 1 00:35:09.191: CBAC: ICMP Echo pkt 172.16.1.1 => 192.168.1.3*Mar 1 00:35:09.263: CBAC: ICMP Echo Reply pkt 192.168.1.3 => 172.16.1.1*Mar 1 00:35:09.375: CBAC: ICMP Echo pkt 172.16.1.1 => 192.168.1.3*Mar 1 00:35:09.423: CBAC: ICMP Echo Reply pkt 192.168.1.3 => 172.16.1.1*Mar 1 00:35:09.467: CBAC: ICMP Echo pkt 172.16.1.1 =>192.168.1.3*Mar 1 00:35:09.531: CBAC: ICMP Echo Reply pkt 192.168.1.3 => 172.16.1.1*Mar 1 00:35:09.563: CBAC: ICMP Echo pkt 172.16.1.1 => 192.168.1.3r2#*Mar 1 00:35:09.623: CBAC: ICMP Echo Reply pkt 192.168.1.3 => 172.16.1.1*Mar 1 00:35:09.671: CBAC: ICMP Echo pkt 172.16.1.1 => 192.168.1.3*Mar 1 00:35:09.735: CBAC: ICMP Echo Reply pkt 192.168.1.3 => 172.16.1.1。
增加一台服务器具体要求。
新增一台服务器地址：10.165.127.15/255.255.255.128。
需要nat 转换成公网地址16.152.91.223 映射出去，并对外开通这台服务器的80端口。
在对外pix525上面增加如下：access-list acl_out permit tcp any host 16.52.91.223 eq www //开放外网对新服务器80端口static (inside,outside) 16.152.91.223 10.165.127.15 netmask 255.255.255.255 0 0 ////外高桥新服务器地址转换16.152.91.223可是为什么转换后，不能访问16.52.91.223的网页，但确可以ping通16.52.91.223，但是访问10.165.127.15的主页是正常的？？具体配置如下：pix-525> enablePassword: *****pix-525# sh run: Saved:PIX Version 6.3(5)interface ethernet0 100fullinterface ethernet1 100fullnameif ethernet0 outside security0nameif ethernet1 inside security100enable password FVHQD7n.FuCW78fS level 7 encryptedenable password 2KFQnbNIdI.2KYOU encryptedpasswd 2KFQnbNIdI.2KYOU encryptedhostname wgqpix-525fixup protocol dns maximum-length 512fixup protocol ftp 21fixup protocol h323 h225 1720fixup protocol h323 ras 1718-1719fixup protocol http 80fixup protocol rsh 514fixup protocol rtsp 554fixup protocol sip 5060fixup protocol sip udp 5060fixup protocol skinny 2000fixup protocol smtp 25fixup protocol sqlnet 1521fixup protocol tftp 69namesaccess-list acl_out permit tcp any host 16.152.91.221 eq wwwaccess-list acl_out permit icmp any anyaccess-list acl_out permit tcp any host 16.152.91.220 eq httpsaccess-list acl_out permit tcp any host 16.152.91.223 eq wwwaccess-list outbound permit icmp any anyaccess-list outbound permit ip any anypager lines 24mtu outside 1500mtu inside 1500ip address outside 16.152.91.222 255.255.255.128ip address inside 10.165.127.254 255.255.255.252ip audit info action alarmip audit attack action alarmno failoverfailover timeout 0:00:00failover poll 15no failover ip address outsideno failover ip address insideno pdm history enablearp timeout 14400static (inside,outside) 16.152.91.221 10.165.127.11 netmask 255.255.255.255 0 0 static (inside,outside) 16.152.91.220 10.165.127.23 netmask 255.255.255.255 0 0 static (inside,outside) 16.152.91.223 10.165.127.15 netmask 255.255.255.255 0 0 access-group acl_out in interface outsideaccess-group outbound in interface insideroute outside 0.0.0.0 0.0.0.0 16.152.91.129 1route inside 10.165.0.0 255.255.0.0 10.165.127.253 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00timeout sip-disconnect 0:02:00 sip-invite 0:03:00timeout uauth 0:05:00 absoluteaaa-server TACACS+ protocol tacacs+aaa-server TACACS+ max-failed-attempts 3aaa-server TACACS+ deadtime 10aaa-server RADIUS protocol radiusaaa-server RADIUS max-failed-attempts 3aaa-server RADIUS deadtime 10aaa-server LOCAL protocol localhttp server enableno snmp-server locationno snmp-server contactsnmp-server community publicno snmp-server enable trapsfloodguard enabletelnet 10.165.6.225 255.255.255.255 insidetelnet 10.165.127.12 255.255.255.255 insidetelnet 10.165.127.250 255.255.255.255 insidetelnet 10.165.6.15 255.255.255.255 insidetelnet 10.165.6.16 255.255.255.255 insidetelnet timeout 5ssh timeout 5console timeout 0username admin password iuQeTKNaNbruxBKd encrypted privilege 2terminal width 80Cryptochecksum:b2e1195d144f48f01fe66606cd31d0f2: endwgqpix-525#最佳答案( 回答者: xintao800 )PIX防火墙提供4种管理访问模式：²非特权模式。
增加一台服务器具体要求。
新增一台服务器地址：10.165.127.15/255.255.255.128。
需要nat 转换成公网地址16.152.91.223 映射出去，并对外开通这台服务器的80端口。
在对外pix525上面增加如下：access-list acl_out permit tcp any host 16.52.91.223 eq www //开放外网对新服务器80端口static (inside,outside) 16.152.91.223 10.165.127.15 netmask 255.255.255.255 0 0 ////外高桥新服务器地址转换16.152.91.223可是为什么转换后，不能访问16.52.91.223的网页，但确可以ping通16.52.91.223，但是访问10.165.127.15的主页是正常的？？具体配置如下：pix-525> enablePassword: *****pix-525# sh run: Saved:PIX Version 6.3(5)interface ethernet0 100fullinterface ethernet1 100fullnameif ethernet0 outside security0nameif ethernet1 inside security100enable password FVHQD7n.FuCW78fS level 7 encryptedenable password 2KFQnbNIdI.2KYOU encryptedpasswd 2KFQnbNIdI.2KYOU encryptedhostname wgqpix-525fixup protocol dns maximum-length 512fixup protocol ftp 21fixup protocol h323 h225 1720fixup protocol h323 ras 1718-1719fixup protocol http 80fixup protocol rsh 514fixup protocol rtsp 554fixup protocol sip 5060fixup protocol sip udp 5060fixup protocol skinny 2000fixup protocol smtp 25fixup protocol sqlnet 1521fixup protocol tftp 69namesaccess-list acl_out permit tcp any host 16.152.91.221 eq wwwaccess-list acl_out permit icmp any anyaccess-list acl_out permit tcp any host 16.152.91.220 eq httpsaccess-list acl_out permit tcp any host 16.152.91.223 eq wwwaccess-list outbound permit icmp any anyaccess-list outbound permit ip any anypager lines 24mtu outside 1500mtu inside 1500ip address outside 16.152.91.222 255.255.255.128ip address inside 10.165.127.254 255.255.255.252ip audit info action alarmip audit attack action alarmno failoverfailover timeout 0:00:00failover poll 15no failover ip address outsideno failover ip address insideno pdm history enablearp timeout 14400static (inside,outside) 16.152.91.221 10.165.127.11 netmask 255.255.255.255 0 0 static (inside,outside) 16.152.91.220 10.165.127.23 netmask 255.255.255.255 0 0 static (inside,outside) 16.152.91.223 10.165.127.15 netmask 255.255.255.255 0 0 access-group acl_out in interface outsideaccess-group outbound in interface insideroute outside 0.0.0.0 0.0.0.0 16.152.91.129 1route inside 10.165.0.0 255.255.0.0 10.165.127.253 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00timeout sip-disconnect 0:02:00 sip-invite 0:03:00timeout uauth 0:05:00 absoluteaaa-server TACACS+ protocol tacacs+aaa-server TACACS+ max-failed-attempts 3aaa-server TACACS+ deadtime 10aaa-server RADIUS protocol radiusaaa-server RADIUS max-failed-attempts 3aaa-server RADIUS deadtime 10aaa-server LOCAL protocol localhttp server enableno snmp-server locationno snmp-server contactsnmp-server community publicno snmp-server enable trapsfloodguard enabletelnet 10.165.6.225 255.255.255.255 insidetelnet 10.165.127.12 255.255.255.255 insidetelnet 10.165.127.250 255.255.255.255 insidetelnet 10.165.6.15 255.255.255.255 insidetelnet 10.165.6.16 255.255.255.255 insidetelnet timeout 5ssh timeout 5console timeout 0username admin password iuQeTKNaNbruxBKd encrypted privilege 2terminal width 80Cryptochecksum:b2e1195d144f48f01fe66606cd31d0f2: endwgqpix-525#最佳答案( 回答者: xintao800 )PIX防火墙提供4种管理访问模式：²非特权模式。
