思科ASA5505防火墙配置成功实例.doc

《思科ASA5505防火墙配置成功实例.doc》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、配置要求：1、   分别划分inside（内网）、outside（外网）、dmz（安全区）三个区域。2、   内网可访问外网及dmz内服务器（web），外网可访问dmz内服务器（web）。3、   Dmz服务器分别开放80、21、3389端口。说明：由于防火墙许可限制“noforwardinterfaceVlan1”dmz内服务器无法访问外网。具体配置如下：希望对需要的朋友有所帮助ASAVersion7.2(4)!hostnameasa5505enablepasswordtDElRpQcbH/qLvnnencryptedpasswd2KFQnbNIdI.2KYOUencrypte

2、dnames!interfaceVlan1nameifoutsidesecurity-level0ipaddress外网IP外网掩码!interfaceVlan2nameifinsidesecurity-level100ipaddress192.168.1.1255.255.255.0!interfaceVlan3noforwardinterfaceVlan1nameifdmzsecurity-level50ipaddress172.16.1.1255.255.255.0!interfaceEthernet0/0descriptionoutside!interfaceEthern

3、et0/1descriptioninsideswitchportaccessvlan2!interfaceEthernet0/2descriptiondmzswitchportaccessvlan3!interfaceEthernet0/3descriptioninsideswitchportaccessvlan2!interfaceEthernet0/4shutdown!interfaceEthernet0/5shutdown!interfaceEthernet0/6shutdown!interfaceEthernet0/7shutdown!ftpmodepassiveobje

4、ct-groupserviceoutside-to-dmztcpport-objecteqwwwport-objecteqftpport-objecteq3389access-listaaaextendedpermittcpanyhost外网IPobject-groupoutside-to-dmzaccess-listbbbextendedpermittcphost172.16.1.2192.168.1.0255.255.255.0object-groupoutside-to-dmzpagerlines24mtuoutside1500mtuinside1500mtudmz1500

5、icmpunreachablerate-limit1burst-size1asdmimagedisk0:/asdm-524.binnoasdmhistoryenablearptimeout14400global(outside)1interfaceglobal(dmz)1172.16.1.10-172.16.1.254netmask255.255.255.0nat(inside)1192.168.1.0255.255.255.0nat(dmz)1172.16.1.0255.255.255.0alias(inside)221.203.36.86172.16.1.2255.255.2

6、55.255static(dmz,outside)tcpinterfacewww172.16.1.2wwwnetmask255.255.255.255dnsstatic(dmz,outside)tcpinterfaceftp172.16.1.2ftpnetmask255.255.255.255dnsstatic(dmz,outside)tcpinterface3389172.16.1.23389netmask255.255.255.255dnsstatic(inside,dmz)172.16.1.2192.168.1.0netmask255.255.255.255dnsacces

7、s-groupaaaininterfaceoutsideaccess-groupbbbininterfacedmzrouteoutside0.0.0.00.0.0.0外网网关1timeoutxlate3:00:00timeoutconn1:00:00half-closed0:10:00udp0:02:00icmp0:00:02timeoutsunrpc0:10:00h3230:05:00h2251:00:00mgcp0:05:00mgcp-pat0:05:00timeoutsip