结构图如下:
　PIX 520
　Two Interface Multiple Server Configuration
　nameif ethernet0 outside security0
　nameif ethernet0 inside security100
　interface ethernet0 auto
　interface ethernet1 auto
　ip address inside 10.1.1.1 255.0.0.0
　ip address outside 204.31.17.10 255.255.255.0
　logging on
　logging host 10.1.1.11
　logging trap 7
　logging facility 20
　no logging console
　arp timeout 600
　nat (inside) 1 10.0.0.0 255.0.0.0
　nat (inside) 2 192.168.3.0 255.255.255.0
　global (outside) 1 204.31.1.25-204.31.17.27
　global (outside) 1 204.31.1.24
　global (outside) 2 192.159.1.1-192.159.1.254
　conduit permit icmp any any
　outbound 10 deny 192.168.3.3 255.255.255.255 1720
　outbound 10 deny 0 0 80
　outbound 10 permit 192.168.3.3 255.255.255.255 80
　outbound 10 deny 192.168.3.3 255.255.255.255 java
　outbound 10 permit 10.1.1.11 255.255.255.255 80
　apply (inside) 10 outgoing_src
　no rip outside passive
　no rip outside default
　rip inside passive
　rip inside default
　route outside 0 0 204.31.17.1.1
　tacacs-server host 10.1.1.12 lq2w3e
　aaa authentication any inside 192.168.3.0 255.255.255.0 0 0 tacacs+
　aaa authentication any inside 192.168.3.0 255.255.255.0 0 0
　static (inside,outside) 204.31.19.0 192.168.3.0 netmask 255.255.255.0
　conduit permit tcp 204.31.19.0 255.255.255.0 eg h323 any
　static (inside,outside) 204.31.17.29 10.1.1.11
　conduit permit tcp host 204.31.17.29 eq 80 any
　conduit permit udp host 204.31.17.29 eq rpc host 204.31.17.17
　conduit permit udp host 204.31.17.29 eq 2049 host 204.31.17.17
　static (inside.outside) 204.31.1.30 10.1.1.3 netmask 255.255.255.255 10 10
　conduit permit tcp host 204.31.1.30 eq smtp any
　conduit permit tcp host 204.31.1.30 eq 113 any
　snmp-server host 192.168.3.2
　snmp-server location building 42
　snmp-server contact polly hedra
　snmp-server community ohwhatakeyisthee
　telnet 10.1.1.11 255.255.255.255
　telnet 192.168.3.0 255.255.255.0