|
Cisco IOS防火墙的安全规则和配置方案(23)
第四步：把检查规则定义到一个接口上。
interface BRI0/0
ip address negotiated
ip access-group 101 in
ip nat outside
ip inspect CBAC out
做完以上配置后，实际运行中路由器显示的log如下：
04:20:27: %FW-6-SESS_AUDIT_TRAIL: http session initiator (172.16.18.1:1426) sent 656 bytes -- responder (202.108.36.156:80) sent 30740 bytes
04:20:39: %SEC-6-IPACCESSLOGP: list 101 denied tcp 202.104.128.164(2933) -> 202.104.47.135(80), 1 packet
04:20:48: %SEC-6-IPACCESSLOGP: list 101 denied tcp 64.4.13.87(1863) -> 202.104.47.135(1026), 1 packet
04:22:52: %SEC-6-IPACCESSLOGP: list 101 denied tcp 202.104.128.164(2933) -> 202.104.47.135(80), 1 packet
|
