Cisco ASA 5505 防火墙常用配置案例.doc

interface Vlan2nameif outside -对端口命名外端口 security-level 0 -设置端口等级ip address X.X.X.X 24 -调试外网地址!interface Vlan3nameif inside -对端口命名内端口 security-level 100 -调试外网地址ip address -设置端口等级!interface Ethernet0/0switchport access vlan 2 -设置端口VLAN与VLAN2绑定!interface Ethernet0/1switchport access vlan 3 -设置端口VLAN与VLAN3绑定!interface Ethernet0/2shutdown!interface Ethernet0/3shutdown!interface Ethernet0/4shutdown!interface Ethernet0/5shutdown!interface Ethernet0/6shutdown!interface Ethernet0/7shutdown!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passivedns domain-lookup insidedns server-group DefaultDNSname-server 10name-server 15access-list 102 extended permit icmp any any -设置ACL列表（允许ICMP全部通过）access-list 102 extended permit ip any any -设置ACL列表（允许所有IP全部通过）pager lines 24mtu outside 1500 mtu inside 1500icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400global (outside) 1 interface -设置NAT地址映射到外网口nat (inside) 1 -NAT地址池（所有地址）access-group 102 in interface outside -设置ACL列表绑定到外端口route outside x.x.x.x 1 -设置到外网的默认路由timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout uauth 0:05:00 absoluteno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstarttelnet inside -设置TELNET所有地址进入telnet timeout 5ssh outside -设置SSH所有地址进入ssh timeout 30ssh version 2console timeout 0 !dhcpd address 00-99 inside -设置DHCP服务器地址池dhcpd dns 10 15 interface inside -设置DNS服务器到内网端口dhcpd enable inside -设置DHCP应用到内网端口!前几天去客户那调试CISCO-ASA-5505设备,第一次摸,跟PIX一样,呵呵.没有技术含量,都是最基本的.其他业务配置暂时没配,会及时更新的.Cisco ASA5505配置cisco, config, telnet, 防火墙, Cisco1.配置防火墙名ciscoasa enable ciscoasa# configure terminal ciscoasa(config)# hostname asa5505 2.配置telnetasa5505(config)#telnet inside /允许内部接口网段telnet防火墙 3.配置密码asa5505(config)# password cisco -远程密码 asa5505(config)# enable password cisco -特权模式密码 4.配置IP asa5505(config)# interface vlan 2 -进入vlan2 asa5505(config-if)# ip address 22 92 -vlan2配置IP asa5505(config)#show ip address vlan2 -验证配置 5.端口加入vlan asa5505(config)# interface e0/3 -进入接口e0/3 asa5505(config-if)# switchport access vlan 3 -接口e0/3加入vlan3 asa5505(config)# interface vlan 3 -进入vlan3 asa5505(config-if)# ip address 6 24 -vlan3配置IP asa5505(config-if)# nameif dmz -vlan3名 asa5505(config-if)# no shutdown -开启 asa5505(config-if)# show switch vlan -验证配置 6.最大传输单元MTUasa5505(config)#mtu inside 1500 -inside最大传输单元1500字节 asa5505(config)#mtu outside 1500 -outside最大传输单元1500字节 asa5505(config)#mtu dmz 1500 -dmz最大传输单元1500字节 7.配置arp表的超时时间asa5505(config)#arp timeout 14400 -arp表的超时时间14400秒 8.FTP模式asa5505(config)#ftp mode passive -FTP被动模式 9.配置域名asa5505(config)#domain-name C 10.启动日志asa5505(config)#logging enable -启动日志 asa5505(config)#logging asdm informational -启动asdm报告日志 asa5505(config)#Show logging -验证配置 11.启用http服务asa5505(config)#http server enable -启动HTTP server,便于ASDM连接。 asa5505(config)#http outside -对外启用ASDM连接 asa5505(config)#http inside -对内启用ASDM连接 12.控制列表access-list acl_out extended permit tcp any any eq www -允许tcp协议80端口入站 access-list acl_out extended permit tcp any any eq https -允许tcp协议443端口入站 access-list acl_out extended permit tcp any host 23 eq ftp /允许tcp协议21端口到23主机 access-list acl_out extended permit tcp any host 24 eq 3389 /允许tcp协议3389端口到24主机 access-list acl_out extended permit tcp any host 25 eq 1433 /允许tcp协议1433端口到25主机 access-list acl_out extended permit tcp any host 26 eq 8080 /允许tcp协议8080端口到26主机 asa5505(config)#show access-list -验证配置 13.设置路由asa5505(config)#route dmz 3 1 /静态路由到网段经过3网关跳数为1 asa5505(config)#route outside 93 1 /默认路由到所有网段经过93网关跳数为1 asa5505# show route -显示路由信息 14.静态NATasa5505(config)# static (inside,outside) 23 netmask 55 /外网23映射到内网 asa5505(config)#access-list acl_out extended permit icmp any any /控制列表名acl_out允许ICMP协议 asa5505(config)#access-group acl_out in interface outside /控制列表acl_out应用到outside接口 asa5505(config)#static (inside,dmz) 7 6 netmask 55 /dmz7映射到内网6 asa5505(config)#access-list acl_dmz extended permit icmp any any /控制列表名acl_dmz允许ICMP协议 asa5505(config)#access-group acl_dmz in interface dmz -控制列表acl_out应用到dmz接口 asa5505(config)#Show nat -验证配置 15.动态NATasa5505(config)#global(outside) 1 24-26 -定义全局地址池 asa5505(config)#nat(inside) 1 0-2 -内部转换地址池 asa5505(config)# show xlate -验证配置 16.基于端口NAT（PAT）asa5505(config)#global (outside) 2 interface -定义全局地址即outside地址：22 asa5505(config)#nat (inside) 2 -内部转换地址池 asa5505(config)# show xlate -验证配置 17.基于LAN故障倒换（failover）1).主防火墙配置 asa5505(config)#failover mac addr outside 001a.2b3c.4d11 001a.2b3c.4w12-故障倒换虚拟MAC地址 asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w22-故障倒换虚拟MAC地址 asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w32-故障倒换虚拟MAC地址 asa5505(config)#failover -启动故障倒换 asa5505(config)#failover lan unit primary -设置主要防火墙 asa5505(config)#failover lan interface standby Vlan4 -故障倒换接口名standby asa5505(config)#failover interface ip standby 52 standby /配置主防火墙IP：,备用防火墙IP： asa5505# show failover -验证配置 2).备防火墙配置 asa5505(config)#failover mac addr outside 001a.2b3c.4d11 001a.2b3c.4w12-故障倒换虚拟MAC地址 asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w22-故障倒换虚拟MAC地址asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w32-故障倒换虚拟MAC地址asa5505(config)#failover -启动故障倒换 asa5505(config)#failover lan unit secondary -设置备用防火墙 asa5505(config)#failover lan interface standby Vlan4 -故障倒换接口名standby asa5505(config)#failover interface ip standby 52 standby /配置主防火墙IP：,备用防火墙IP： asa5505# show failover -验证配置 18.显示mac地址asa5505# show switch mac-address-table 19.保存配置asa5505# write memoryCisco ASA 5505防火墙地址映射问题解决前些天帮朋友配置一台Cisco ASA5505防火墙, 映射总是不成功. 在网上也看到很多朋友遇到了这种问题,都在寻问这个解决方法.有人已经将问题解决了,但没给出解决方案. 也许这并不是一个很复杂的难题,但我希望通过博客能帮助朋友们及时得到这个小问题的处理.基本情况: WAN: 95 Gateway: 00 LAN: 内网中有一台服务器,地址: 0 端口: 8089 故障描述: 内网可正常连接至服务器,外网无法连接. 端口映射出现问题.解决方法: 命令行错误, 已更正并解决. 问题重点: 采用 static (inside,outside) 95 0 tcp 8089 映射.目前配置如下: ASA Version 7.2(2)!hostname ciscoasaenable password 8Ry2YjIyt7RRXU24 encryptednames!interface Vlan1nameif insidesecurity-level 100ip address !interface Vlan2nameif outsidesecurity-level 0ip address 95 52!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passiveaccess-list 101 extended permit tcp any host 95 eq 8089access-list 101 extended permit icmp any anyaccess-list 101 extended permit tcp any anyaccess-list 101 extended permit udp any anypager lines 24logging asdm informationalmtu inside 1500mtu outside 1500icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400global (outside) 1 interfacestatic (inside,outside) 95 0 netmask 55 tcp 8089 0access-group 101 in interface outsideroute outside 00 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout uauth 0:05:00 absolutehttp server enableno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstarttelnet timeout 5ssh timeout 5console timeout 0dhcpd auto_config outside!class-map inspection_defaultmatch default-inspection-traffic!policy-map type inspect dns preset_dns_mapparameters message-length maximum 512policy-map global_policyclass inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp!service-policy global_policy globalprompt hostname contextCryptochecksum:30e219cbc04a4c919e7411de55e14a64: endciscoasa(config)#-在找寻解决方案过程中,有朋友做了重要提示, 采用: static (inside,outside) int 0 tcp 8089 做映射,但出现警告提示:WARNING: static redireting all traffics at outside interface;WARNING: all services terminating at outside interface are disabled.后来将命令改成: static (inside,outside) 95 0 tcp 8089 问题解决.ASA5505配置笔记 ASA5505配置笔记1.IP地址配置 #int vlan1 #nameif outside #security-level 0 #ip address . #end #int vlan 2 #nameif insiede #security-levlel 100 #ip address #end2.把端口指定到相应VLAN中#int Eth0/0#switchport access vlan 1end#int Eth0/1switchport access vlan 2end#exit3.配置Http.telnet和ssh管理#username xxx password xxxxxx encrypted privilege 15 #aaa authentication enable console LOCAL#aaa authentication telnet console LOCAL#aaa authentication http console LOCAL#aaa authentication ssh console LOCAL#aaa autoentication command LOCAL#http server enable#http inside#telnet inside#ssh inside#crypto key generate rsa(打开SSH服务)4.VPN配置 VPN配置可在ASDM模式下配置,具体配置略CISCO ASA 5510实际配置案例及详解去年卖个某大型企业的ASA5510防火墙，附实际的配置，并且都解释了得很清楚，非常值得参考的资料！2008-12-15 11:07ASA5510# SHOW RUN: Saved:ASA Version 7.0(6)!hostname ASA5510enable password 2KFQnbNIdI.2KYOU encryptednamesdns-guard!interface Ethernet0/0 此接口为外部网络接口nameif outside 设置为 OUTSIDE 外部接口模式security-level 0 外部接口模式安全级别为 最高 0ip address 34 添加外部IP地址 （一般为电信网通提供）!interface Ethernet0/1此接口为内部网络接口nameif inside设置为 INSIDE 内部接口模式security-level 100内部接口模式安全级别为 100ip address 添加内部IP地址 （一般为公司自行分配）!interface Ethernet0/2 没用到 SHUTDOWN 关闭shutdownno nameifno security-levelno ip address!interface Management0/0没用到 SHUTDOWN 关闭nameif managementsecurity-level 100ip address 没用，用网线连接管理的端口。management-only!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passivepager lines 24logging asdm in