loading
Cisco ASA 防火墙配置手册
基本配置过程
----------Conan Zhongjm
拓扑图
1、配置主机名 hostname asa5520
2、配置密码
Enable password asa5520 Passwd cisco
3、配置接口 Conf t
Interface ethernet 0/0 Nameif outside Security-level 0
Ip address 210.10.10.2 255.255.255.0 No shutdown Exit
Interface ethernet 0/1 Nameif inside
Security-level 100
Ip address 192.168.201.1 255.255.255.0 No shutdown Exit
Interface ethernet 0/2 Nameif dmz
Security-level 50
Ip address 192.168.202.1 255.255.255.0 No shutdown Exit
4、配置路由
Route outside 0.0.0.0 0.0.0.0 210.10.10.1 End
Show route
5、配置网络地址转换 Nat-controal
Nat (inside) 1 0 0
Global (outside) 1 interface
Global (dmz) 1 192.168.202.100-192.168.202.110
///////////////////////////////////////////////////////////////////// 配置完以上就可以实现基本的防火墙上网功能
/////////////////////////////////////////////////////////////////////
6、配置远程登录 （1）telnet 登录 Conf t
telnet 192.168.201.0 255.255.255.0 inside telnet timeout 15
（2）ssh登录
Crypto key generate rsa modulus 1024 Ssh 192.168.201.0 255.255.255.0 inside Ssh 0 0 outside Ssh timeout 30 Ssh version 2
（3）asdm登录
http server enable 8000
http 192.168.201.0 255.255.255.0 inside http 0 0 outside http 0 0 inside
asdm image disk0:/asdm-615.bin
username conan password 123456789 privilege 15
7、配置端口映射 （1）创建映射
Static (dmz,outside) 210.10.10.2 192.168.202.2
（2）因为防火墙默认把禁止外网访问DMZ区，所以要创建访问控制列表 Access-list out_to_dmz permit tcp any host 210.10.10.2 eq 80 Access-group out_to_dmz in interface outside