防火墙ASA配置NAT实验案例（asa防火墙nat映射）

防火墙ASA配置NAT实验案例（asa防火墙nat映射）

实验拓扑

实验步骤

1.配置路由器和防火墙的IP地址

IOU1

IOU1(config)#interface ethernet 0/0IOU1(config-if)#ip address 200.1.1.2 255.255.255.0IOU1(config-if)#no shutdown IOU1(config-if)#duplex full IOU1(config-if)#exIOU1(config)#interface loopback 0IOU1(config-if)#ip address 218.85.152.99 255.255.255.255IOU1(config-if)#ex

IOU2

IOU2(config)#interface ethernet 0/0IOU2(config-if)#ip address 192.168.0.11 255.255.255.0IOU2(config-if)#no shutdown IOU2(config-if)#duplex full IOU2(config-if)#exitIOU2(config)#interface loopback 0IOU2(config-if)#ip address 192.168.1.11 255.255.255.255 IOU2(config-if)#ex

IOU3

IOU3(config)#interface ethernet 0/0IOU3(config-if)#ip address 172.16.1.1 255.255.255.0IOU3(config-if)#no shutdown IOU3(config-if)#duplex full IOU3(config-if)#exIOU3(config)#interface loopback 0IOU3(config-if)#ip address 172.16.88.11 255.255.255.255IOU3(config-if)#ex

ASA-1

ciscoasa(config)# interface gigabitEthernet 0ciscoasa(config-if)# ip address 20.1.1.1 255.255.255.0ciscoasa(config-if)# no shutdown ciscoasa(config-if)# exciscoasa(config)# interface gigabitEthernet 1ciscoasa(config-if)# ip address 192.168.0.254 255.255.255.0ciscoasa(config-if)# no shutdown ciscoasa(config-if)# exciscoasa(config)# interface gigabitEthernet 2ciscoasa(config-if)# ip address 172.16.1.254 255.255.255.0ciscoasa(config-if)# no shutdownciscoasa(config-if)# ex

使用show ip interface brief命令来查看接口信息确认接口是否配置正确

IOU1

IOU2

IOU3

然后使用show interface ip brief命令来查看防火墙的接口信息来查看是否配置正确

ASA-1

之后分配防火墙与路由器之间的接口任务

ASA-1

ciscoasa(config)# interface gigabitEthernet 0ciscoasa(config-if)# nameif outsideINFO: Security level for "outside" set to 0 by default.ciscoasa(config)# interface gigabitEthernet 1ciscoasa(config-if)# nameif dmzINFO: Security level for "dmz" set to 0 by default.ciscoasa(config-if)# security-level 50ciscoasa(config)# interface gigabitEthernet 2ciscoasa(config-if)# nameif insideINFO: Security level for "inside" set to 100 by default.ciscoasa(config-if)# exit

2.配置路由

IOU2

IOU2(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254

IOU3

IOU3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254

ASA-1

ciscoasa(config)# route outside 0 0 200.1.1.2ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11 ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1

3.配置动态NAT

IOU1配置远程连接

IOU1(config)#username cisco privilege 15 password ciscoIOU1(config)#line vty 0 4IOU1(config-line)#login local IOU1(config-line)#transport input telnet IOU1(config-line)#exit

动态NAT

ASA(config)# object network out-poolASA(config-network-object)# range 200.1.1.10 200.1.1.20ASA(config-network-object)# exitASA(config)# object network in-ldASA(config-network-object)# subnet 172.16.88.0 255.255.255.0ASA(config-network-object)# exitASA(config)# object network in-xd ASA(config-network-object)# subnet 172.16.1.0 255.255.255.0 ASA(config-network-object)# exitASA(config)# object network dmz-1 ASA(config-network-object)# subnet 192.168.0.0 255.255.255.0ASA(config-network-object)# exitASA(config)# object network dmz-2 ASA(config-network-object)# subnet 192.168.1.0 255.255.255.0ASA(config-network-object)# exitASA(config)# object-group network in-lanASA(config-network-object-group)# network-object object in-ldASA(config-network-object-group)# network-object object in-xdASA(config-network-object-group)# exitASA(config)# object-group network dmz-lanASA(config-network-object-group)# network-object object dmz-1 ASA(config-network-object-group)# network-object object dmz-2ASA(config-network-object-group)# exitASA(config)# nat (inside,outside) source dynamic in-lan out-poolASA(config)# nat (dmz,outside) source dynamic dmz-lan out-pool

PAT，多内网架构，多个网段，多个zone，直接使用外网接口ASA(config)# nat (inside,outside) source dynamic in-lan interface ASA(config)# nat (dmz,outside) source dynamic dmz-lan interface

PAT，多内网架构使用一个指定外网IPASA(config)# object network out-pat3ASA(config-network-object)# host 200.1.1.3ASA(config-network-object)# exitASA(config)# nat (inside,outside) source dynamic in-ld pat-pool out-pat3ASA(config)# object network out-pool4ASA(config-network-object)# host 200.1.1.4ASA(config-network-object)# exitASA(config)# nat (inside,outside) source dynamic in-xd pat-pool out-pool4

先动态NAT。最后用指定IP做PATASA(config)# object network out-poolASA(config-network-object)# range 200.1.1.10 200.1.1.20ASA(config-network-object)# exitASA(config)# object network out-pat3ASA(config-network-object)# host 200.1.1.3ASA(config-network-object)# exitASA(config)# object-group network out-natASA(config-network-object-group)# network-object object out-pat3ASA(config-network-object-group)# network-object object out-poolASA(config-network-object-group)# exitASA(config)# nat (inside,outside) source dynamic in-lan out-nat

静态NAT（一对一）ASA(config)# object network webASA(config-network-object)# host 200.1.1.21ASA(config-network-object)# exitASA(config)# object network dmz-webASA(config-network-object)# host 192.168.1.11ASA(config-network-object)# exitASA(config)# access-list web extended permit tcp any host 192.168.1.11ASA(config)# access-group web in interface outside ASA(config)# nat (dmz,outside) source static dmz-web web

端口一对一ASA(config)# object network teldmzASA(config-network-object)# host 200.1.1.22ASA(config-network-object)# exitASA(config)# object network dmz-webASA(config-network-object)# host 192.168.1.11ASA(config-network-object)# exitASA(config)# object service telnetASA(config-service-object)# service tcp source eq telnet ASA(config-service-object)# exitASA(config)# nat (dmz,outside) source static dmz-web teldmz service telnet telnet

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。