asa防火墙vlan子接口互相通讯配置实例

《asa防火墙vlan子接口互相通讯配置实例》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、ASA防火墙vlan子接口互相通讯配置实例作者:金振宇日期:2008-5-1319:47:5实例需求：CiscoASA5520防火墙用于内部多个vlan之间互相通讯。拓扑图：          配置实例：[asa防火墙配置]:Saved:ASAVersion7.0(7)!hostname*****enablepasswordGSk/3FjsRAiPoooiencryptednamesdns-guard!interfaceGigabitEthernet0/0 shutdown nameifoutside security-level0 n

2、oipaddress!interfaceGigabitEthernet0/1 nonameif nosecurity-level noipaddress!interfaceGigabitEthernet0/1.1             // 启用子接口连接vlan10，安全及别99，分配地址 vlan10 nameifTest1 security-level99 ipaddress10.8.128.254255.255.255.0!            interfaceGigabitEthernet0/1.2           

3、 // 启用子接口连接vlan20，安全及别98，分配地址 vlan20 nameifTest2 security-level98 ipaddress10.8.129.254255.255.255.0!interfaceGigabitEthernet0/1.3            // 启用子接口连接vlan30，安全及别97，分配地址 vlan30 nameifTest3 security-level97 ipaddress10.8.130.254255.255.255.0!interfaceGigabitEthernet0/2 s

4、hutdown nonameif nosecurity-level noipaddress!interfaceGigabitEthernet0/3 descriptionLANFailoverInterface!interfaceManagement0/0 nameifmanagement security-level100 ipaddress192.168.1.1255.255.255.0 management-only!passwd2KFQnbNIdI.2KYOUencryptedftpmodepassiveaccess-lista

5、cl_Test1extendedpermiticmpanyany    // 设置访问列表，允许全通过，为了测试方便access-listacl_Test1extendedpermitipanyanyaccess-listacl_Test2extendedpermiticmpanyanyaccess-listacl_Test2extendedpermitipanyanyaccess-listacl_Test3extendedpermiticmpanyanyaccess-listacl_Test3extendedpermitipanyan

6、yaccess-listnonatextendedpermitipanyany               //这个acl是用在bypassnat所用  *pagerlines24loggingasdminformationalmtumanagement1500mtuoutside1500mtuTest11500mtuTest21500mtuTest31500failoverfailoverlanunitprimaryfailoverlaninterfacefailoverGigabitEthernet0/3failoverkey***

7、**failoverinterfaceipfailover192.168.254.1255.255.255.0standby192.168.254.2noasdmhistoryenablearptimeout14400nat(Test1)0access-listnonat             //把互通的子接口启用bypassnat，让子接口各vlan数据互通 *nat(Test2)0access-listnonatnat(Test3)0access-listnonataccess-groupacl_Test1ininterface

8、Test1   //把相应的访问列表设置在对应的接口上 *access-groupacl_Test2ininterfaceTest2access-groupacl_Test3ininterfaceTest3