ASA防火墙配置

《ASA防火墙配置》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、ConfigurationsThisdocumentusestheseconfigurations:•EasyVPNServer(ASA5520)•EasyVPNRemoteHardwareClientEasyVPNServer(ASA5520)ASA5520-704#writeterminal:Saved:ASAVersion7.0(4)!hostnameASA5520-704enablepassword8Ry2YjIyt7RRXU24encryptednames!!---Configuretheoutsideandinsideinterfaces.interf

2、aceGigabitEthernet0/0nameifoutsidesecurity-level0ipaddress10.20.20.1255.255.255.0!interfaceGigabitEthernet0/1nameifinsidesecurity-level100ipaddress172.22.1.1255.255.255.0!interfaceGigabitEthernet0/2shutdownnonameifnosecurity-levelnoipaddress!interfaceGigabitEthernet0/3shutdownnonameif

3、nosecurity-levelnoipaddress!interfaceManagement0/0shutdownnonameifnosecurity-levelnoipaddress!passwd2KFQnbNIdI.2KYOUencryptedftpmodepassive!---Thisaccesslistisusedforanatzerocommandthatprevents!---trafficwhichmatchestheaccesslistfromundergoing!---networkaddresstranslation(NAT).access-

4、listno-natextendedpermitip172.22.1.0255.255.255.0172.16.1.0255.255.255.0!---Thisaccesslistisusedtodefinethetraffic!---thatshouldpassthroughthetunnel.!---Itisboundtothegrouppolicywhichdefines!---adynamiccryptomap.access-listezvpn1extendedpermitip172.22.1.0255.255.255.0172.16.1.0255.255

5、.255.0pagerlines24mtuoutside1500mtuinside1500nofailovericmppermitanyecho-replyoutsideicmppermitanyinsidenoasdmhistoryenablearptimeout14400!---SpecifytheNATconfiguration.!---NAT0preventsNATfortheACLdefinedinthisconfiguration.!---Thenat1commandspecifiesNATforallothertraffic.global(outsi

6、de)1interfacenat(inside)0access-listno-natnat(inside)10.0.0.00.0.0.0routeoutside0.0.0.00.0.0.010.20.20.21timeoutxlate3:00:00timeoutconn1:00:00half-closed0:10:00udp0:02:00icmp0:00:02timeoutsunrpc0:10:00h3230:05:00h2251:00:00mgcp0:05:00timeoutmgcp-pat0:05:00sip0:30:00sip_media0:02:00tim

7、eoutuauth0:05:00absolute!---ThisdefinesthegrouppolicyyouusewithEasyVPN.!---Specifythenetworks!---thatshouldpassthroughthetunnelandthatyouwantto!---usenetworkextensionmode.group-policymyGROUPinternalgroup-policymyGROUPattributessplit-tunnel-policytunnelspecifiedsplit-tunnel-network-lis

8、tvalu