hpux公網出口不通，是防火墻問題還是主機問題？pix+netscreen!!!!

guozhongyan

客戶的公網出口是兩臺防火墻串接，Pix525作為內網防火墻，netscreen作為外網防火墻，采用兩層地址映射的方式

pix后有兩臺主機，一臺為unix服務器，地址為134.64.2.10,之前僅在公網上開放了7001與9001端口，另一臺為pc server作為測試機地址為134.64.2.18此前沒有出公網，pix將兩臺主機分別mip為192.168.200.100與 192.168.200.104，netscreen再將這兩個192地址映射為公網地址；

出于業(yè)務需要，主機需要調用公網上的某臺服務器的smtp，即需要開放兩臺主機外出訪問25端口的權限，我對pix和netscreen做了如下配置：

pix的acl配置：

access-list 101 permit tcp any host 192.168.200.100 eq 7001
access-list 101 permit tcp any host 192.168.200.100 eq 9001
access-list 101 permit tcp any host 192.168.200.103 eq 7001
access-list 101 permit tcp any host 192.168.200.103 eq 9001
access-list 101 permit tcp any host 192.168.200.104 eq smtp
access-list 101 permit tcp any host 192.168.200.100 eq smtp
access-list 101 permit icmp any host 192.168.200.100 echo-reply
access-list 101 permit icmp any host 192.168.200.104 echo-reply
access-group 101 in interface outside

netscreen上做了如下policy配置：
set policy id 14 from "Untrust" to "Global"  "Any" "MIP(x.x.x.35)" "7001" Permit
set policy id 0 name "go-out" from "Trust" to "Untrust"  "192.168.100.0/24" "192.168.100.0/24" "7001" Permit
set policy id 13 from "Untrust" to "Global"  "Any" "MIP(x.x.x.35)" "9001" Permit
set policy id 1 from "Trust" to "Untrust"  "192.168.100.0/24" "192.168.100.0/24" "9001" Permit
set policy id 2 from "Untrust" to "Trust"  "Any" "Any" "MAIL" Permit
set policy id 3 from "Trust" to "Untrust"  "Any" "Any" "MAIL" Permit
set policy id 4 from "Untrust" to "Global"  "Any" "MIP(x.x.x.35)" "MAIL" Permit
set policy id 5 from "Untrust" to "Global"  "Any" "MIP(x.x.x.3" "MAIL" Permit

x.x.x.35是134.64.2.10的公網地址
x.x.x.38是134.64.2.18的公網地址

經過配置以后做測試，測試機可以順利聯(lián)通遠端25端口，但是正式機卻怎么也聯(lián)不上公網地址
1、是否與unix本地沒有打開25端口有關？連接遠程25端口需要本地主機自身也同時打開25端口嗎？
2、是否與主機雙網卡多地址綁定有關？我已經在主機里面添加了目標主機route add net 210.x.x.0 gateway 134.64.2.1（內網pix地址）的靜態(tài)路由了，還是不通.

guozhongyan

把netscreen的配置改為
set policy id 2 from "Untrust" to "Trust"  "Any" "Any" "any" Permit
set policy id 3 from "Trust" to "Untrust"  "Any" "Any" "any" Permit

測試機能ping出到公網，而業(yè)務機還是不行！

lhyis

是不是防火墻也需要把25端口開開,為了收到連到遠端主機的信息,需要開放25端口通信協(xié)議
set service "25duankou" protocal tcp dst-port 25-25
set policy from untrust to global any mip "25duankou" permit
你試一下,不行的話,考慮pix的設置是否缺少哪些配置.

sunyone

trace一下不行么，猜啥呀