教程：ASA配置(三个区域)
Cisco ASA配置
Cisco ASA配置思科防火墙ASA5520配置思科防火墙ASA5520配置：目的：1、内网可以上网2、内网可以访问DMZ区域的服务器3、外网可以通过公网IP访问DMZ区域的服务器要求：1、内网的网段192.168.10.02、DMZ的网段192.168.5.03、外网IP地址：200.200.200.82 200.200.200.83 网关255.255.255.248（这个地址一般是运营商提供）4、外网路由：200.200.200.815、DMZ区域的服务器IP地址：192.168.5.2步骤1：配置接口inside、outside和dmzinterface g0/0speed autoduplex autonameif insideSecurity-level 100ip address 192.168.10.1 255.255.255.0no shutexitinterface g0/1speed autoduplex autonameif outsideSecurity-level 0ip address 200.200.200.82 255.255.255.248no shutexitinterface g0/2speed autoduplex autonameif dmzSecurity-level 50ip address 192.168.5.1 255.255.255.0no shutexit步骤2、添加外网路由route outside 0 0 200.200.200.81步骤3、做nat转换，使得内网可以上网，同时内网可以访问dmz区域的服务器nat-controlnat (inside) 1 192.168.10.0 255.255.255.0global (outside) 1 interfaceglobal (dmz) 1 interface步骤4、做静态nat，将对外网IP的访问转换到dmz区域的服务器static (dmz,outside) 200.200.200.83 192.168.5.2 netmask 255.255.255.255 dns 注意：这里的外网IP不是outside的接口地址，是另外一个公网IP步骤5、配置ACL规则，允许外网访问DMZ服务器access-list out_dmz extended permit tcp any host 200.200.200.83 eq wwwaccess-group out_dmz in interface outside到此配置结束，正常情况下上面的要求都可以实现了，但是可能由于每个机房的环境不一样，结果会有一些错误。
CISCO ASA配置说明
static (dmz,outside) tcp interface 3389 192.168.2.2 3389 netmask 255.255.255.255
access-group outside_permit in interface outside
//把outside_permit控制列表运用在外部接口的入口方向。
route outside 0.0.0.0 0.0.0.0 202.98.131.126 1 //定义一个默认路由。
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
vpn-idle-timeout none //终止连接时间设为默认值
vpn-session-timeout none //会话超时采用默认值
vpn-tunnel-protocol IPSec //定义通道使用协议为IPSEC。
//定义一个命名为vpnclient的IP地址池,为remote用户分配IP地址
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
//端口映射 可以解决内部要公布的服务太多，而申请公网IP少问题。
static (dmz,outside) tcp interface 30001 192.168.2.2 30001 netmask 255.255.255.255
Asa配置大全
1、ASA基本配置静态路由：route outside 192.168.100.0 255.255.255.0 192.168.1.99配置允许telnet：telnet 192.168.10.0 255.255.255.0 inside配置telnet超时时间：telnet timeout 5配置本地认证telnet与console：aaa authentication telnet console LOCAL配置SSH生成密钥对：aaa authentication ssh console LOCALciscoasa(config)# crypto key generate rsaINFO: The name for the keys will be: <Default-RSA-Key>Keypair generation process begin. Please wait...ciscoasa(config)#配置允许SSH：ssh 192.168.10.0 255.255.255.0 inside配置允许ASDM管理：http server enablehttp 192.168.10.0 255.255.255.0 insideasdm image disk0:/asdm-602.binusername cisco password cisco privilege 15配置PAT：nat (inside) 1 192.168.10.0 255.255.255.0global (outside) 1 interface配置端口映射：access-list to_server extended permit tcp any host 192.168.1.99 eq wwwaccess-group to_server in interface outsidestatic (inside,outside) tcp interface www 192.168.10.98 www netmask 255.255.255.255配置ACL：access-list to_server extended permit tcp any host 192.168.1.99 eq wwwaccess-group to_server in interface outside配置允许ICMP穿越：policy-map global_policyclass inspection_defaultinspect icmp配置URL过滤：url-server (outside) vendor websense host 192.168.1.100 timeout 30 protocol TCP version 1 connections 5filter url http 192.168.10.0 255.255.255.0 0.0.0.0 0.0.0.0 allow日志管理：开启logging：logging enable开启console日志：logging console 7将日志发送到日志服务器：logging trap 7logging host inside 192.168.10.98配置IPS：ip audit name zxd info action alarmip audit name cisco attack action alarmip audit interface outside zxdip audit interface outside cisco2、VPN配置ASA IPSec L2L配置：access-list nonat extended permit ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0 nat (inside) 0 access-list nonatcrypto ipsec transform-set cisco esp-des esp-nonecrypto map cisco 10 match address nonatcrypto map cisco 10 set peer 192.168.1.96crypto map cisco 10 set transform-set ciscocrypto map cisco interface outsidecrypto isakmp enable outsidecrypto isakmp policy 1authentication pre-shareencryption deshash shagroup 1tunnel-group 192.168.1.96 type ipsec-l2ltunnel-group 192.168.1.96 ipsec-attributespre-shared-key ciscoASA Remote VPN Server配置：ip local pool vpnpool 192.168.2.250-192.168.2.254group-policy vpntest internalgroup-policy vpntest attributesvpn-tunnel-protocol IPSecusername zhong password xiaodongtunnel-group vpntest type remote-accesstunnel-group vpntest general-attributesaddress-pool vpnpooldefault-group-policy vpntesttunnel-group vpntest ipsec-attributespre-shared-key ciscocrypto ipsec transform-set cisco esp-des esp-md5-hmac crypto dynamic-map vpntest 1 set transform-set cisco crypto dynamic-map vpntest 1 set reverse-route crypto map cisco 1 ipsec-isakmp dynamic vpntest crypto map cisco interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10authentication pre-shareencryption aeshash shagroup 2RADIUS认证用户：aaa-server vpntest protocol radiusaaa-server vpntest (outside) host 192.168.1.100key ciscotunnel-group vpntest general-attributes authentication-server-group (outside) vpntestASA SSL VPN配置ip local pool vpnpool 192.168.2.200-192.168.2.210 username zhong password xiaodongwebvpnenable outsidesvc image disk0:/sslclient-win-1.1.3.173.pkgsvc enabletunnel-group-list enablegroup-policy webvpn internalgroup-policy webvpn attributesvpn-tunnel-protocol svc webvpnwebvpnsvc ask enabletunnel-group webvpn type remote-accesstunnel-group webvpn general-attributesaddress-pool vpnpooldefault-group-policy webvpntunnel-group webvpn webvpn-attributesgroup-alias hnebony enableIOS SSL VPN配置aaa new-modelaaa authentication login vpnauthen localusername zhong password xiaodongip local pool vpnpool 192.168.20.200 192.168.20.254interface loopback 0ip address 192.168.20.1 255.255.255.0exitwebvpn install svc disk0:/webvpn/svc.pkgwebvpn gateway outip address 192.168.1.99inservicewebvpn context vpntestpolicy group vpntestfunctions svc-enabledsvc address-pool vpnpoolsvc split include 192.168.0.0 255.255.0.0exitdefault-group-policy vpntestaaa authentication list vpnauthengateway outinserviceIOS Easy VPN Server配置:aaa new-modelaaa authentication login vpnauthen localaaa authorization network vpnauthor localusername zhong password xiaodongip local pool vpnpool 192.168.20.200 192.168.20.254ip access-list extended splitpermit ip 192.168.0.0 0.0.255.255 192.168.20.0 0.0.0.255 crypto isakmp policy 1authentication pre-sharehash md5group 2crypto isakmp client configuration group vpntestkey ciscopool vpnpoolacl splitcrypto ipsec transform-set cisco esp-aes esp-sha-hmac crypto dynamic-map vpndymap 1set transform-set ciscoreverse-routecrypto map vpntest client authentication list vpnauthen crypto map vpntest client configuration address respond crypto map vpntest isakmp authorization list vpnauthor crypto map vpntest 10 ipsec-isakmp dynamic vpndymap inter f0/0crypto map vpntest使用ACS认证与授权：aaa authentication login vpnauthen group radiusaaa authorization network vpnauthor group radiusradius-server host 192.168.1.100 auth-port 1645 acct-port 1646 key ciscoRADIUS (IETF)选中6、64、65、69、81.建立用户：vpntest（vpn组路由器配置crypto isakmp client configuration group vpntest可以取消）然后建立用户IOS Easy VPN Client配置:crypto ipsec client ezvpn vpntestmode clientconnect autopeer 192.168.10.1group vpntest key ciscousername zhong password xiaodonginterface f0/0crypto ipsec client ezvpn vpntestinterface f1/0crypto ipsec client ezvpn vpntest inside R1#crypto ipsec client ezvpn xauthUsername: zhongPassword:3、802.1X认证aaa new-modelaaa authentication dot1x default group radius aaa authorization network default group radius radius-server host 192.168.1.100 key cisco dot1x system-auth-controlinterface f0/1dot1x port-control auto指定VLAN：4、RSTPAlternate port—Offers an alternate path toward the root switch to that provided by the current root port.Backup port—Acts as a backup for the path provided by a designated port toward the leaves of the spanning tree. A backup port can exist only when two ports are connected in a loopback by a point-to-point link or when a switch has two or more connections to a shared LAN segment.Edge ports—If you configure a port as an edge port on an RSTP switch by using the spanning-tree portfast interface configuration command, the edge port immediately transitions to the forwarding state. An edge port is the same as a Port Fast-enabled port, and you should enable it only on ports that connect to a single end station.Root ports—If the RSTP selects a new root port, it blocks the old root port and immediately transitions the new root port to the forwarding state.Point-to-point links—If you connect a port to another port through a point-to-point link and the local port becomes a designated port, it negotiates a rapid transition with the other port by using the proposal-agreement handshake to ensure a loop-free topology. As shown in Figure 18-4, Switch A is connected to Switch B through a point-to-point link, and all of the ports are in the blocking state. Assume that the priority of Switch A is a smaller numerical value than the priority of Switch B. Switch A sends a proposal message (a configuration BPDU with the proposal flag set) to Switch B, proposing itself as the designated switch. After receiving theproposal message, Switch B selects as its new root port the port from which the proposalmessage was received, forces all nonedge ports to the blocking state, and sends an agreement message (a BPDU with the agreement flag set) through its new root port. After receiving Switch B’s agreement message, Switch A also immediately transitions its designated port to the forwarding state. No loops in the network are formed because Switch B blocked all of its nonedge ports and because there is a point-to-point link between Switches A and B. When Switch C is connected to Switch B, a similar set of handshaking messages are exchanged.Switch C selects the port connected to Switch B as its root port, and both ends immediately transition to the forwarding state. With each iteration of this handshaking process, one more switch joins the active topology. As the network converges, this proposal-agreement handshaking progresses from the root toward the leaves of the spanning tree. The switch learns the link type from the port duplex mode: a full-duplex port is considered to have a point-to-point connection; a half-duplex port is considered to have a shared connection. You can override the default setting that is controlled by the duplex setting by using the spanning-tree link-type interface configuration command.5、时间访问列表time-range zxdabsolute start 08:30 24 August 2009 end 18:00 01 September 2009time-range ciscoperiodic daily 8:00 to 18:00access-list 110 permit ip any any time-range cisco6、QOSCAR：rate-limit input access-group 101 1000000 3000 4000 conform-action transmit exceed-action dropGTS：class-map match-all ciscomatch access-group 101!!policy-map ciscoclass ciscopolice cir 500000 bc 10000 pir 1000000 be 10000conform-action transmitexceed-action set-prec-transmit 2violate-action dropinterface f1/0service-policy output ciscoCBWFQ:class-map match-all cbwfqmatch access-group 101policy-map cbwfqclass cbwfqpriority percent 60interface f1/0service-policy output cbwfq7、NA T-T8、标准化产品特色：1定位准确，以就业为导向。
ASA配置
vpdn group dx ppp authentication pap //启用验证方式
vpdn username 051211077922 password 983980 //就是ISP给你的帐号和密码
interface GigabitEthernet0/2
route inside 192.168.0.0 255.255.0.0 192.168.4.1 1 *指向三层交换机路由接口的vlan静态路由
: end
lybenet#
vpdn group dx request dialout pppoe //为ADSL拨号创建虚拟专用拨号网络组(VPDN Group),ChengDu为组名,随便填你自己喜欢的
!
nat-control * 定义T的第一步，启动NAT
global (outside) 1 interface *定义PAT的第三步，复用外部端口做PAT
nat (inside) 1 0.0.0.0 0.0.0.0 * 定义PAT的第二步，局域网用户都可以使用PAT
！
route outside 0.0.0.0 0.0.0.0 123.100.1.1 1 * 指向互联网的默认路由
ip address 192.168.100.1 255.255.255.0
!
interface Ethernet0/2 *定义ASA的DMZ接口 （用来连接服务器）
nameif dmz
security-level 50
ip address 192.168.1.3 255.255.255.0
ssh 0.0.0.0 0.0.0.0 dxoutside
AS配置及部署文档
AS配置&部署说明AS的功能是在机顶盒升级时，接受Qsmonloader的http请求，返回供其下载qsmon的路径以及qcs的url信息。
本文档为运行在tomcat中的AS的配置及部署文档。
安装Tomcat1.AS运行在tomcat6.0及以上的版本中，将tomcat.tar.gz解压在/usr/local/isa目录下2.端口号配置：在$TOMCAT_HOME/conf/ server.xml中配置，如下：<Connector port="8080" protocol="HTTP/1.1"connectionTimeout="20000" redirectPort="8443" />将8080端口修改为指派给AS的端口（江苏现网为3838）注意：该端口需要加入服务器的防火墙配置中<!-- Define an AJP 1.3 Connector on port 8009 --><Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> 将8009端口修改为8449，以避免和jboss冲突3.数据库配置在$TOMCAT_HOME/conf/context.xml 中配置数据库，根据各现网的实际情况配置，如下：<Resource name="jdbc/DBPool" type="javax.sql.DataSource" driverClassName=" oracle.jdbc.driver.OracleDriver" url="jdbc:oracle:thin:@192.168.1.86:1521:orcl" username="iptv" password="iptv" maxIdle="10" maxWait="100" maxActive="30 "/>4.asUrl配置在$TOMCAT_HOME/conf/context.xml 中配置,如下：<Environment name="asUrl" value="http://58.223.77.40:3838/AS" type="java.l ang.String" override="false"/>5.添加类库将log4j-1.2.16.jar,ojdbc14-10.2.0.3.jar 拷贝到$TOMCAT_HOME/lib目录下以上步骤只在初次安装时需要。
配置ASA
防火墙技术实验报告实验名称：防火墙技术实验内容一、拓扑图：二、实验步骤：1.分别在ASA1和ASA2上配置ip地址和命名。
ASA1：ciscoasa(config)# host ASA1ASA1(config)# int e0/0ASA1(config-if)# ip add 192.168.1.3 255.255.255.0 ASA1(config-if)# no shASA1(config-if)# nameif insideASA1(config-if)# int e0/1ASA1(config-if)# ip add 120.3.2.21 255.255.255.252 ASA1(config-if)# no shASA1(config-if)# nameif outsideASA1(config-if)# exitASA2：ASA2(config)# int e0/0ASA2(config-if)# ip add 192.168.1.3 255.255.255.0 ASA2(config-if)# no shASA2(config-if)# nameif insideASA2(config-if)# exitASA2(config)# int e0/1ASA2(config-if)# ip address 120.3.2.22 255.255.255.252ASA2(config-if)# no shASA2(config-if)# nameif outsideASA2(config-if)# exit2.分别在ASA1和ASA2上配置NAT和映射,还有ACL。
ASA1:ASA1(config)# nat (inside) 1 0.0.0.0 0.0.0.0ASA1(config)# global (outside) 1 interfaceASA1(config)# route outside 0.0.0.0 0.0.0.0 120.3.2.22ASA1(config)# route inside 192.168.0.0 255.255.0.0 192.168.1.3ASA1(config)# access-list 101 extended permit icmp any anyASA1(config)# access-list 101 extended permit ip any anyASA1(config)# access-group 101 in interface outsideASA2:ASA2(config)# nat (inside) 1 0.0.0.0 0.0.0.0ASA2(config)# global (outside) 1 interfaceASA2(config)# route inside 192.168.0.0 255.255.0.0 192.168.1.1ASA2(config)# route outside 0.0.0.0 0.0.0.0 120.3.2.21ASA2(config)# access-list 101 extended permit icmp any anyASA2(config)# access-list 101 extended permit ip any anyASA2(config)# access-group 101 in interface outsideASA2(config)# static (inside,outside) tcp 120.3.2.22 www 192.168.140.254 www 3.在SW1和SW2上配置ip地址后配置默认路由。
ASA-NAT配置指南
ASA配置指南,~、文档属性 文档历史； 序号 版本号修订日期 修订人 修订内容 1.郑鑫 文档初定 2. ·3.4.<）（, 属性 内容标题 思科ASA 防火墙配置指南文档传播范围发布日期目录一、文档说明 (5)二、基础配置 (6)(一)查看系统信息 (6)(二)版本区别简介 (6)《(三)接口配置与安全级别简介 (7)(四)NTP 配置 (8)(五)SNMP配置 (9)(六)telnet配置 (9)(七)SSH配置 (9)(八)配置管理 (10)(九)常用设备排错命令 (10)三、NAT静态方向写法 (12)(一)传统静态NAT配置方向写法 (12)(二)新静态NAT配置方向写法 (15)四、NAT配置举例 (16)"(一)Dynamic NAT (16)(二)Static NAT (27)(三)Identity NAT (34)(四)NAT免除 (40)(五)Twice NAT（策略NAT） (40)(六)NAT执行顺序 (52)五、状态化应用监控 (53)(一)状态化监控策略配置 (53)(二)路由、NAT、ACL、策略执行顺序 (57)六、failover (65)(一)配置failover (65)%(二)配置A/A (76)一、文档说明<本文档主要介绍思科ASA防火墙在版本之前与版本之后配置区别和常用的一些管理和运维命令，如：系统管理、防火墙策略、NAT、日志配置等。
思科ASA防火墙目前新出厂的设备都在以后，但有很多老的设备都在以前，所以本文档通过使用ASA 与这两个版本来介绍。
请读者打开文档中的显示批注功能，文档中有部分批注内容。
）二、基础配置(一)查看系统信息hostnat (inside,outside) staticobject networkhostnat (outside,inside) staticaccess-list inbound extended permit ip host host access-group inbound in interface outside@新命令的outbound和inbound流量动作是一样的：（inside,outside）针对outbound流量是源的转换，针对inbound流量是目的的转换（outside,inside）针对outbound流量是转换目的，针对inbound的是转换源。
asa配置步骤
思科防火墙已经从PIX发展到ASA了，IOS也已经从早期的6.0发展到7.2。
但总体的配置思路并没有多少变化。
只是更加人性化，更加容易配置和管理了。
下面是我工作以来的配置总结，有些东西是6.3版本的，但不影响在7.*版本的配置。
一：6个基本命令： nameif、 interface、 ip address 、nat、 global、 route。
二：基本配置步骤：step1: 命名接口名字nameif ethernet0 outside security0nameif ethernet1 inside security100nameif ethernet2 dmz security50**7版本的配置是先进入接口再命名。
step2：配置接口速率interface ethernet0 10full autointerface ethernet1 10full autointerface ethernet2 10fullstep3：配置接口地址ip address outside 218.106.185.82ip address inside 192.168.100.1 255.255.255.0ip address dmz 192.168.200.1 255.255.255.0step4：地址转换(必须)* 安全高的区域访问安全低的区域(即内部到外部)需NAT和global;nat(inside) 1 192.168.1.1 255.255.255.0global(outside) 1 222.240.254.193 255.255.255.248*** nat (inside) 0 192.168.1.1 255.255.255.255 表示192.168.1.1这个地址不需要转换。
直接转发出去。
* 如果内部有服务器需要映射到公网地址(外网访问内网)则需要static和conduit或者acl.static (inside, outside) 222.240.254.194 192.168.1.240static (inside, outside) 222.240.254.194 192.168.1.240 10000 10后面的10000为限制连接数，10为限制的半开连接数。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
印象网络--工作室
群号：300309792
实验名称： 配置ASA（三个区域） 实验人：lun0yellow
（ylxl） 实验目的： Inside、outside、dmz：R1、R2和R3用来模拟PC：
实验拓扑：
实验环境： GNS3
实验器材： GNS3
实验步骤：
//配置路由器和ASA的接口、路由、实现网络互通：
ciscoasa(config)# int e0/1
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ciscoasa(config-if)# ip add 10.1.1.254 255.255.255.0
ciscoasa(config-if)# no sh
ciscoasa(config-if)# int e0/0
ciscoasa(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ciscoasa(config-if)# ip add 172.16.1.254 255.255.255.0
ciscoasa(config-if)# no sh
ciscoasa(config-if)# int e0/2
ciscoasa(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by default.
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# ip add 192.168.1.254 255.255.255.0
ciscoasa(config-if)# no sh
ciscoasa(config-if)# exit
ciscoasa(config)# route outside 172.16.2.0 255.255.255.0 172.16.1.1
//在R1、R2、R3、R4上配置：
R1(config)#int f0/0
R1(config-if)#ip add 10.1.1.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#exit
R1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.254
R1(config)#do wr
R2(config)#int f0/0
R2(config-if)#ip add 172.16.1.1 255.255.255.0
R2(config-if)#no sh
R2(config-if)#int f0/1
R2(config-if)#int f0/1
R2(config-if)#ip add 172.16.2.2 255.255.255.0
R2(config-if)#no sh
R2(config-if)#exit
R2(config)#ip route 10.1.1.0 255.255.255.0 172.16.1.254
R2(config)#ip route 192.168.1.0 255.255.255.0 172.16.1.254 R2(config)#do wr
R3(config)#int f0/0
R3(config-if)#ip add 172.16.2.1 255.255.255.0
R3(config-if)#no sh
R3(config-if)#exit
R3(config)#ip route 0.0.0.0 0.0.0.0 172.16.2.2
R3(config)#do wr
R4(config)#int f0/0
R4(config-if)#ip add 192.168.1.1 255.255.255.0
R4(config-if)#no sh
R4(config-if)#exit
R4(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.254
R4(config)#do wr
//配置R1/R2/R3/R4的vty密码。
R1(config)#line vty 0 4
R1(config-line)#password r1
R1(config-line)#login
R2(config)#line vty 0 4
R2(config-line)#password r2
R2(config-line)#login
R3(config)#line vty 0 4
R3(config-line)#password r3
R3(config-line)#login
R4(config)#line vty 0 4
R4(config-line)#password r4
R4(config-line)#login
实验验证：
1)测试：
在R1上可以telnet到R3和R4
在R4上可以telnet到R3不能telnet到R1
在R3上不能telnet到R1和R4
2)使用命令show conn detail 查看conn表：
使用ip route 查看ASA的路由表
3)配置ACL禁止在R4上telnet到R3
ciscoasa(config)# access-list 111 deny tcp host 192.168.1.1 host 172.16.2.1 eq 23
ciscoasa(config)# access-group 111 in int dmz
命令参考：
名词解释：
其他资料：。