在pix或asa如何防止内网用户乱改ip配置案例

防止内网用户乱该ip地址，用户 只能用给定的ip，如果改ip地址，则无法访问网络资源。
例如：做了下述配置后(arp inside 10.64.64.29 000f.b0d8.a504)，mac地 址为000f.b0d8.a504的pc只 能使用ip10.64.64.29来访问网络资源，如果该ip则无法访问。
pix515e# sh run
: Saved
:
PIX Version 7.2(1  )
!
hostname pix515e
domain-name cisco
enable password N7FecZuSHJlVZC2P encrypted
做名字解析
****************************************************
names
name 10.64.64.113 chengxiaojie
name 10.64.64.13 dhcp
name 10.64.64.71 liuyongjun
name 10.64.64.72 liuyongjun-ibm
name 10.64.64.39 lixiaoliang
name 10.64.64.103 lixuesong
name 10.64.64.17 lulianying
name 10.64.64.92 qizuomeng
name 10.64.64.69 wangzhili
name 10.64.64.105 xingzhonghe
name 10.64.64.45 tanjun
name 10.64.64.108 zhangyi
name 10.64.64.178 hujian
name 10.64.64.93 ibm220
name 10.64.64.62 jiling
name 10.64.64.111 yangliu
name 10.64.64.112 wangsishen
name 10.64.64.158 wangyuguo
name 10.64.64.52 lishihai
name 10.64.64.78 office-teacher
name 10.64.64.48 yangjin
name 10.64.64.104 wutao
name 10.64.64.63 zangdong
name 10.64.64.80 xiaoguangyue
name 10.64.64.14 ibm235
name 10.64.64.222 lixuesong-dell
name 10.64.64.75 maxiaopeng
name 10.64.64.215 lintao
name 10.64.64.199 machi
name 10.64.64.216 liuxuesong
name 10.64.64.246 jiachangjing
name 10.64.64.61 chufw
****************************************************
!
interface Ethernet0
nameif outside
security-level 0
ip address X.X.76.26 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 10.64.64.2 255.255.240.0
!
interface Ethernet2
nameif dmz
security-level 80
ip address 192.168.0.1 255.255.255.0
!
passwd N7FecZuSHJlVZC2P encrypted
!
time-range worktime
periodic daily 8:00 to 17:00
!
ftp mode passive
clock timezone CST 8
dns domain-lookup outside
dns server-group DefaultDNS
name-server 219.150.32.132
domain-name cisco
做object-group以便在acl里被调用（注：object-group是 个好东东，可以大大简化acl的配置）
****************************************************
object-group network www
network-object host xingzhonghe
network-object host chengxiaojie
network-object host dhcp
network-object host liuxuesong
network-object host wangzhili
network-object host liuyongjun
network-object host liuyongjun-ibm
network-object host lulianying
network-object host chufw
network-object host jiachangjing
network-object host maxiaopeng
network-object host 10.64.64.255
object-group network guest
network-object 10.64.66.112 255.255.255.240
object-group network caiwu
network-object 10.64.66.0 255.255.255.224
object-group service netmeeting tcp
port-object range 1503 1503
port-object range h323 h323
object-group network worktime
network-object host wutao
network-object host zhangyi
network-object host yangliu
network-object host wangsishen
network-object host wangyuguo
network-object host 10.64.64.169
network-object host 10.64.64.18
network-object host machi
network-object host lintao
network-object host liuxuesong
network-object host lixuesong-dell
network-object host 10.64.64.247
network-object host 10.64.64.29
network-object host 10.64.64.30
network-object host yangjin
network-object host lishihai
network-object host 10.64.64.55
network-object host jiling
network-object host office-teacher
****************************************************

access-list  outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended permit tcp any any object-group  netmeeting
调用上述的object-group到acl
****************************************************
access-list inside_access_in extended deny ip any 192.168.0.0  255.255.255.0
access-list inside_access_in extended permit ip object-group caiwu  192.168.0.0 255.255.255.0
access-list inside_access_in extended permit ip object-group www any
access-list inside_access_in extended permit ip object-group guest any  inactive
access-list inside_access_in extended deny tcp any any eq 1863
access-list inside_access_in extended permit ip host lixiaoliang host  211.147.77.98
access-list inside_access_in extended permit ip host qizuomeng host  211.147.77.98
access-list inside_access_in extended permit ip object-group worktime  any time-range worktime
access-list inside_access_in extended permit ip host ibm235 any  time-range worktime inactive
****************************************************
access-list remote_splitTunnelAcl standard permit 10.64.64.0  255.255.240.0
access-list inside_nat0_outbound extended permit ip 10.64.64.0  255.255.240.0 1.1.1.0  255.255.255.0
access-list outside_cryptomap extended permit ip any 1.1.1.0  255.255.255.0
access-list caiwu_splitTunnelAcl standard permit 192.168.0.0  255.255.255.0
access-list outside_cryptomap_1 extended permit ip any 1.1.1.0  255.255.255.0
access-list dmz_nat0_outbound extended permit ip 192.168.0.0  255.255.255.0 1.1.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool remote 1.1.1.1-1.1.1.254 mask 255.255.255.0
ip local pool caiwu 2.2.2.1-2.2.2.254 mask 255.255.255.0
no failover
asdm p_w_picpath flash:/asdm.bin
no asdm history enable
把ip和mac绑定
****************************************************
arp inside 10.64.64.29 000f.b0d8.a504  
arp inside 10.64.64.247 000b.2f04.7dd8  
arp inside 10.64.64.169 0016.17f2.2eb3  
arp inside lintao 000a.e6b2.c4c6
arp inside liuxuesong 00e0.4c58.b7cd  
arp inside lishihai 000a.e69b.f4dc  
arp inside ibm235 0009.6ba5.49c5  
arp inside maxiaopeng 000c.764d.6aa8  
arp inside xiaoguangyue 0011.09b4.6f25
arp inside zangdong 00e0.4cc1.2a14  
arp inside wutao 0013.d47d.0c36  
arp inside office-teacher 0090.9626.7da7
arp inside yangjin 00e0.4d01.6b1b
arp inside wangyuguo 00e0.4c21.471d  
arp inside wangsishen 0015.c50f.92a5
arp inside yangliu 0015.f299.7f6c
arp inside jiling 00e0.4cc1.2a34  
arp inside hujian 0011.252f.8613  
arp inside ibm220 0002.556d.0037
arp inside jiachangjing 00e0.4d01.6b30
arp inside tanjun 0013.7222.5fe5
arp inside wangzhili 000d.6004.c197
arp inside lixiaoliang 0014.782f.b989  
arp inside liuyongjun-ibm 0010.c6de.2686
arp inside lulianying 0016.3563.db1b
arp inside liuyongjun 0000.e25a.8580  
arp inside lixuesong 0017.3152.8e78
arp inside chengxiaojie 0016.3564.8a6b
arp inside xingzhonghe 00e0.4c60.a8da  
arp inside dhcp 0014.5e2b.77b5
arp inside zhangyi 0013.7222.4819
arp inside lixuesong-dell 0018.8ba2.d1c5
arp inside machi 000a.e6b5.0600  
arp inside 10.64.64.18 0015.c510.12d4
****************************************************
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.64.64.0 255.255.240.0
nat (dmz) 0 access-list dmz_nat0_outbound
static (inside,outside) tcp interface 1503 chufw 1503 netmask  255.255.255.255
static (inside,outside) tcp interface h323 chufw h323 netmask  255.255.255.255
access-group outside_access_in in interface outside
应用acl到inside端口
****************************************************
access-group inside_access_in in interface inside
****************************************************
route outside 0.0.0.0 0.0.0.0 X.X.76.25 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat  0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect  0:02:00
timeout uauth 0:05:00 absolute
group-policy caiwu internal
group-policy caiwu attributes
dns-server value 219.150.32.132
***-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value caiwu_splitTunnelAcl
group-policy remote internal
group-policy remote attributes
dns-server value 219.150.32.132
***-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value remote_splitTunnelAcl
username chufw password hs6C0g7Y0Zza/dVN encrypted privilege  15
username chufw attributes
***-group-policy remote
***-framed-ip-address 1.1.1.111 255.255.255.0
http server enable
http chufw 255.255.255.255 inside
http 219.148.242.228 255.255.255.255 outside
http 219.148.242.227 255.255.255.255 outside
http 1.1.1.111 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal  20
tunnel-group remote type ipsec-ra
tunnel-group remote general-attributes
address-pool remote
default-group-policy remote
tunnel-group remote ipsec-attributes
pre-shared-key *
tunnel-group caiwu type ipsec-ra
tunnel-group caiwu general-attributes
address-pool remote
default-group-policy caiwu
tunnel-group caiwu ipsec-attributes
pre-shared-key *
telnet chufw 255.255.255.255 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
ntp server 207.46.130.100 source outside
tftp-server inside chufw pix
prompt hostname context
Cryptochecksum:c02e836587f08fa6ce4699df28408774
: end
pix515e#       

51cto.com/a/luyoujiaohuan/index.html
http://www.net527.comlinux系统思科论坛Cisco