ASA8.4版本静态映射和PAT简单配置实验

墨蓝 2022-01-10 20:21 264阅读 0赞

拓扑如图。

ASA1 配置如下：[![wKioL1Q7y7mh30kmAAD9zlOpt0E894.jpg][]][wKioL1Q7y7mh30kmAAD9zlOpt0E894.jpg]

ASA1(config)\# sh run  
: Saved  
:  
ASA Version 8.4(2)  
!  
hostname ASA1  
enable password 8Ry2YjIyt7RRXU24 encrypted  
passwd 2KFQnbNIdI.2KYOU encrypted  
names  
!  
interface GigabitEthernet0  
nameif outside  
security-level 0  
ip address 100.1.1.2 255.255.255.0  
!  
interface GigabitEthernet1  
nameif inside  
security-level 100  
ip address 10.1.1.1 255.255.255.0  
!  
interface GigabitEthernet2  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface GigabitEthernet3  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface GigabitEthernet4  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface GigabitEthernet5  
shutdown  
no nameif  
no security-level  
no ip address  
!  
ftp mode passive  
object network inside-all-outside  
subnet 192.168.1.0 255.255.255.0  
object network Internet-Mail  
host 100.1.1.3  
object network Mail  
host 192.168.2.1  
access-list ACL\_IN extended permit ip any 192.168.1.0 255.255.255.0 要放行真实地址流量。  
access-list ACL\_IN extended permit ip any host 192.168.2.1  
pager lines 24  
mtu inside 1500  
mtu outside 1500  
icmp unreachable rate-limit 1 burst-size 1  
icmp permit any echo inside  
icmp permit any echo-reply inside  
icmp permit any echo-reply outside  
icmp permit any echo outside  
no asdm history enable  
arp timeout 14400  
nat (inside,outside) source dynamic inside-all-outside interface  
nat (inside,outside) source static Mail Internet-Mail  
access-group ACL\_IN in interface outside per-user-override  
route outside 0.0.0.0 0.0.0.0 100.1.1.1 1  
route inside 192.168.1.0 255.255.255.0 10.1.1.2 1  
route inside 192.168.2.1 255.255.255.255 10.1.1.2 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip\_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
timeout floating-conn 0:00:00  
dynamic-access-policy-record DfltAccessPolicy  
user-identity default-domain LOCAL  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart  
telnet timeout 5  
ssh timeout 5  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  
!  
!  
prompt hostname context  
call-home reporting anonymous prompt 2  
call-home  
profile CiscoTAC-1  
no active  
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService  
destination address email callhome@cisco.com  
destination transport-method http  
subscribe-to-alert-group diagnostic  
subscribe-to-alert-group environment  
subscribe-to-alert-group inventory periodic monthly  
subscribe-to-alert-group configuration periodic monthly  
subscribe-to-alert-group telemetry periodic daily  
crashinfo save disable  
Cryptochecksum:f7bcd91e681f64bf48949389f73a7bad  
: end  
ASA1(config)\#

R1配置：

R1\#sh run  
Building configuration...

Current configuration : 901 bytes  
!  
version 12.3  
service timestamps debug datetime msec  
service timestamps log datetime msec  
no service password-encryption  
!  
hostname R1  
!  
boot-start-marker  
boot-end-marker  
!  
!  
no aaa new-model  
ip subnet-zero  
no ip icmp rate-limit unreachable  
!  
!  
ip tcp synwait-time 5  
!  
!  
no ip domain lookup  
ip ssh break-string  
ip audit notify log  
ip audit po max-events 100  
no ftp-server write-enable  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
no crypto isakmp enable  
!  
!  
!  
!  
!  
interface FastEthernet0/0  
ip address 100.1.1.1 255.255.255.0  
duplex auto  
speed auto  
!  
interface FastEthernet0/1  
ip address 200.1.1.1 255.255.255.0  
duplex auto  
speed auto  
!  
ip classless  
!  
no ip http server  
no ip http secure-server  
!  
!  
!  
!  
!  
!  
control-plane  
!  
!  
!  
!  
!  
!  
!  
!  
!  
line con 0  
exec-timeout 0 0  
privilege level 15  
logging synchronous  
line aux 0  
exec-timeout 0 0  
privilege level 15  
logging synchronous  
line vty 0 4  
login  
!  
!  
end

R2配置

R2\#sh run  
Building configuration...

Current configuration : 1184 bytes  
!  
version 12.3  
service timestamps debug datetime msec  
service timestamps log datetime msec  
no service password-encryption  
!  
hostname R2  
!  
boot-start-marker  
boot-end-marker  
!  
!  
username admin privilege 15 secret 5 $1$F/CN$2jRZOMetVkXKqQqMoWXab.  
no aaa new-model  
ip subnet-zero  
no ip icmp rate-limit unreachable  
!  
!  
ip tcp synwait-time 5  
!  
!  
no ip domain lookup  
ip ssh break-string  
ip audit notify log  
ip audit po max-events 100  
no ftp-server write-enable  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
no crypto isakmp enable  
!  
!  
!  
!  
!  
interface Loopback0  
ip address 192.168.1.1 255.255.255.0  
!  
interface Loopback1  
ip address 192.168.2.1 255.255.255.255  
!  
interface FastEthernet0/0  
ip address 10.1.1.2 255.255.255.0  
duplex auto  
speed auto  
!  
interface FastEthernet0/1  
no ip address  
shutdown  
duplex auto  
speed auto  
!  
ip classless  
ip route 0.0.0.0 0.0.0.0 10.1.1.1  
!  
no ip http server  
no ip http secure-server  
!  
!  
!  
!  
!  
!  
control-plane  
!  
!  
!  
!  
!  
!  
!  
!  
!  
line con 0  
exec-timeout 0 0  
privilege level 15  
logging synchronous  
line aux 0  
exec-timeout 0 0  
privilege level 15  
logging synchronous  
line vty 0 4  
password 12345  
login local  
line vty 5 15  
password 12345  
login local  
!  
!  
end

R2\#

R3配置

R3\#sh run  
Building configuration...

Current configuration : 1101 bytes  
!  
version 12.3  
service timestamps debug datetime msec  
service timestamps log datetime msec  
no service password-encryption  
!  
hostname R3  
!  
boot-start-marker  
boot-end-marker  
!  
!  
username admin privilege 15 secret 5 $1$KU3j$.zpWsbfttmL8NCGFMZLLC1  
no aaa new-model  
ip subnet-zero  
no ip icmp rate-limit unreachable  
!  
!  
ip tcp synwait-time 5  
!  
!  
no ip domain lookup  
ip ssh break-string  
ip audit notify log  
ip audit po max-events 100  
no ftp-server write-enable  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
!  
no crypto isakmp enable  
!  
!  
!  
!  
!  
interface Loopback0  
no ip address  
!  
interface FastEthernet0/0  
no ip address  
shutdown  
duplex auto  
speed auto  
!  
interface FastEthernet0/1  
ip address 200.1.1.2 255.255.255.0  
duplex auto  
speed auto  
!  
ip classless  
ip route 0.0.0.0 0.0.0.0 200.1.1.1  
!  
no ip http server  
no ip http secure-server  
!  
!  
!  
!  
!  
!  
control-plane  
!  
!  
!  
!  
!  
!  
!  
!  
!  
line con 0  
exec-timeout 0 0  
privilege level 15  
logging synchronous  
line aux 0  
exec-timeout 0 0  
privilege level 15  
logging synchronous  
line vty 0 4  
password 12345  
login local  
line vty 5 15  
password 12345  
login local  
!  
!  
end

R3\#

转载于:https://blog.51cto.com/oppoa10000k/1563068

[wKioL1Q7y7mh30kmAAD9zlOpt0E894.jpg]: /images/20220110/6829e1339ff9477d8f821a93df098ed0.png