思科防火墙ASA配置NAT（cisco防火墙配置）

思科防火墙ASA配置NAT（cisco防火墙配置）

实验拓扑图

网络规划如下

一、基础配置

1、IUO1的配置

IOU1(config)#interface e 0/0IOU1(config-if)#du fuIOU1(config-if)#ip add 200.1.1.2 255.255.255.0IOU1(config-if)#no shutdown IOU1(config-if)#exIOU1(config)#interface loopback 0IOU1(config-if)#ip add 218.85.152.99 255.255.255.0IOU1(config-if)#exIOU1(config)#username bdqn privilege 15 password 123IOU1(config)#line vty 0 4IOU1(config-line)#login local IOU1(config-line)#transport input telnet IOU1(config-line)#

2、IUO2的配置

IOU2(config)#interface e 0/0IOU2(config-if)#du fuIOU2(config-if)#ip address 172.16.1.1 255.255.255.0IOU2(config-if)#no shutdown IOU2(config-if)#exIOU2(config)#interface loopback 0IOU2(config-if)#ip add 172.16.88.11 255.255.255.0IOU2(config-if)#no shutdown IOU2(config-if)#exIOU2(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254

3、IUO3的配置

IOU3(config)#interface e 0/0IOU3(config-if)#ip add 192.168.0.11 255.255.255.0IOU3(config-if)#du fuIOU3(config-if)#no shutdown IOU3(config-if)#exIOU3(config)#interface loopback 0IOU3(config-if)#ip address 192.168.1.11 255.255.255.0IOU3(config-if)#no shutdown IOU3(config-if)#exIOU3(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254

4、防火墙配置

ciscoasa(config)# interface g 0ciscoasa(config-if)# nameif outsideciscoasa(config-if)# ip add 200.1.1.1 255.255.255.0ciscoasa(config-if)# no shuciscoasa(config-if)# exciscoasa(config)# interface g 1ciscoasa(config-if)# nameif insideciscoasa(config-if)# ip add 172.16.1.254 255.255.255.0ciscoasa(config-if)# no shuciscoasa(config-if)# exciscoasa(config)# interface g 2ciscoasa(config-if)# nameif dmzciscoasa(config-if)# security-level 50 ciscoasa(config-if)# ip add 192.168.0.254 255.255.255.0ciscoasa(config-if)# no shuciscoasa(config-if)# exciscoasa(config)# route outside 0 0 200.1.1.2ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11

二、配置动态NAT实现telnet外网

1、定义动态NAT的地址池

ciscoasa(config)# object network out-poolciscoasa(config-network-object)# range 200.1.1.10 200.1.1.20ciscoasa(config-network-object)# exit

2、指定内网网段

ciscoasa(config)# object network inside-1 ciscoasa(config-network-object)# subnet 172.16.1.0 255.255.255.0ciscoasa(config-network-object)# exitciscoasa(config)# object network inside-2 ciscoasa(config-network-object)# subnet 172.16.88.0 255.255.255.0ciscoasa(config-network-object)# exitciscoasa(config)# object network dmz-1 ciscoasa(config-network-object)# subnet 192.168.0.0 255.255.255.0ciscoasa(config-network-object)# exit ciscoasa(config)# object network dmz-2 ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0ciscoasa(config-network-object)# exit

3、创建内网地址组

ciscoasa(config)# object-group network in-lanciscoasa(config-network-object-group)# network-object object inside-1 ciscoasa(config-network-object-group)# network-object object inside-2ciscoasa(config-network-object-group)# exitciscoasa(config)# object-group network dmz-lanciscoasa(config-network-object-group)# network-object object dmz-1 ciscoasa(config-network-object-group)# network-object object dmz-2ciscoasa(config-network-object-group)# exit

4、ASA配置nat

ciscoasa(config)# nat (inside,outside) source dynamic in-lan out-poolciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan out-pool

telnet测试

三、PAT，多内网架构，多个网段，多个zone，直接使用外网接口

ciscoasa(config)# nat (inside,outside) source dynamic in-lan interface ciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan interface

四、PAT，多内网架构使用一个指定外网IP

ciscoasa(config)# object network out-pat3ciscoasa(config-network-object)# host 200.1.1.3ciscoasa(config-network-object)# exitciscoasa(config)# nat (inside,outside) source dynamic in-ld pat-pool out-pat3ciscoasa(config)# object network out-pool4ciscoasa(config-network-object)# host 200.1.1.4ciscoasa(config-network-object)# exitciscoasa(config)# nat (inside,outside) source dynamic in-xd pat-pool out-pool4

五、先动态NAT。最后用指定IP做PAT

ASA(config)# object network out-poolASA(config-network-object)# range 200.1.1.10 200.1.1.20ASA(config-network-object)# exitASA(config)# object network out-pat3ASA(config-network-object)# host 200.1.1.3ASA(config-network-object)# exitASA(config)# object-group network out-natASA(config-network-object-group)# network-object object out-pat3ASA(config-network-object-group)# network-object object out-poolASA(config-network-object-group)# exitASA(config)# nat (inside,outside) source dynamic in-lan out-nat

六、静态NAT（一对一）

ASA(config)# object network webASA(config-network-object)# host 200.1.1.21ASA(config-network-object)# exitASA(config)# object network dmz-webASA(config-network-object)# host 192.168.1.11ASA(config-network-object)# exitASA(config)# access-list web extended permit tcp any host 192.168.1.11ASA(config)# access-group web in interface outside ASA(config)# nat (dmz,outside) source static dmz-web web

七、端口一对一

ASA(config)# object network teldmzASA(config-network-object)# host 200.1.1.22ASA(config-network-object)# exitASA(config)# object network dmz-webASA(config-network-object)# host 192.168.1.11ASA(config-network-object)# exitASA(config)# object service telnetASA(config-service-object)# service tcp source eq telnet ASA(config-service-object)# exitASA(config)# nat (dmz,outside) source static dmz-web teldmz service telnet telnet

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。