ASA配置NAT（asa归因方案）

ASA配置NAT（asa归因方案）

实验拓扑

IUO1的配置

IOU1(config)#interface e 0/0

IOU1(config-if)#du fu

IOU1(config-if)#ip add 10.1.10.1 255.255.255.0

IOU1(config-if)#no shutdown

IOU1(config-if)#ex

IOU1(config)#interface loopback 0

IOU1(config-if)#ip add 218.85.152.99 255.255.255.0

IOU1(config-if)#ex

IOU1(config)#username bdqn privilege 15 password 123

IOU1(config)#line vty 0 4

IOU1(config-line)#login local

IOU1(config-line)#transport input telnet

IOU1(config-line)#

IUO2的配置

IOU2(config)#interface e 0/0

IOU2(config-if)#du fu

IOU2(config-if)#ip address 172.16.1.2 255.255.255.0

IOU2(config-if)#no shutdown

IOU2(config-if)#ex

IOU2(config)#interface loopback 0

IOU2(config-if)#ip add 172.16.88.11 255.255.255.0

IOU2(config-if)#no shutdown

IOU2(config-if)#ex

IOU2(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254

IUO3的配置

IOU3(config)#interface e 0/0

IOU3(config-if)#ip add 192.168.0.3 255.255.255.0

IOU3(config-if)#du fu

IOU3(config-if)#no shutdown

IOU3(config-if)#ex

IOU3(config)#interface loopback 0

IOU3(config-if)#ip address 192.168.1.3 255.255.255.0

IOU3(config-if)#no shutdown

IOU3(config-if)#ex

IOU3(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254

防火墙配置

ciscoasa(config)# interface g 0

ciscoasa(config-if)# nameif outside

ciscoasa(config-if)# ip add 10.1.10.254 255.255.255.0

ciscoasa(config-if)# no shu

ciscoasa(config-if)# ex

ciscoasa(config)# interface g 1

ciscoasa(config-if)# nameif inside

ciscoasa(config-if)# ip add 172.16.1.254 255.255.255.0

ciscoasa(config-if)# no shu

ciscoasa(config-if)# ex

ciscoasa(config)# interface g 2

ciscoasa(config-if)# nameif dmz

ciscoasa(config-if)# security-level 50

ciscoasa(config-if)# ip add 192.168.0.254 255.255.255.0

ciscoasa(config-if)# no shu

ciscoasa(config-if)# ex

ciscoasa(config)# route outside 0 0 10.1.10.1

ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.2

ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.3

配置动态NAT实现telnet外网

定义动态NAT的地址池

ciscoasa(config)# object network out-pool

ciscoasa(config-network-object)# range 10.1.10.10 10.1.10.20

ciscoasa(config-network-object)# exit

指定内网网段

ciscoasa(config)# object network inside-1

ciscoasa(config-network-object)# subnet 172.16.1.0 255.255.255.0

ciscoasa(config-network-object)# exit

ciscoasa(config)# object network inside-2

ciscoasa(config-network-object)# subnet 172.16.88.0 255.255.255.0

ciscoasa(config-network-object)# exit

ciscoasa(config)# object network dmz-1

ciscoasa(config-network-object)# subnet 192.168.0.0 255.255.255.0

ciscoasa(config-network-object)# exit

ciscoasa(config)# object network dmz-2

ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0

ciscoasa(config-network-object)# exit

创建内网地址组

ciscoasa(config)# object-group network in-lan

ciscoasa(config-network-object-group)# network-object object inside-1

ciscoasa(config-network-object-group)# network-object object inside-2

ciscoasa(config-network-object-group)# exit

ciscoasa(config)# object-group network dmz-lan

ciscoasa(config-network-object-group)# network-object object dmz-1

ciscoasa(config-network-object-group)# network-object object dmz-2

ciscoasa(config-network-object-group)# exit

ASA配置nat

ciscoasa(config)# nat (inside,outside) source dynamic in-lan out-pool

ciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan out-pool

telnet测试

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。