189 8069 5689
实验网络结构图：
DNS Server--------(outside)ASA-Firewall(inside)-------LAN Client
|
DMZ-WEB-Server
---------------------------------------------------
IP地址分配
外网：210.10.10.0/30
内网：192.168.210.0/24
DMZ： 192.168.202.0/24
----------------------------------------------------
ASA基本配置：
配置主机名、域名和密码
配置接口
配置路由
配置远程管理接入
为出站流量配置网络地址转换
配置ACL
enable
conf t
hostname ASA5520
domain-name lpq.com
enable password ASA5520
passwd cisco
conf t
interface e0/0
nameif outside
security-level 0
ip address 210.10.10.2 255.255.255.0
no shutdown
exit
interface e0/1
nameif inside
security-level 100
ip address 192.168.201.1 255.255.255.0
no shutdown
exit
interface e0/2
nameif dmz
security-level 50
ip address 192.168.202.1 255.255.255.0
no shutdown
exit
route outside 0.0.0.0 0.0.0.0 210.10.10.1
end
show route
conf t
telnet 192.168.201.0 255.255.255.0 inside
telnet timeout 15
crypto key generate rsa modulus 1024
ssh 192.168.201.0 255.255.255.0 inside
ssh 0 0 outside
ssh timeout 30
ssh version 2
username ASA5520 password cisco
aaa authertication ssh console LOCAL
passwd aaa
http server enable 8008
http 192.168.201.0 255.255.255.0 inside
http 0 0 outside
http 0 0 inside
asdm p_w_picpath disk0:/asdm-615.bin
username admin password admin privilege 15
----------------------------------------------------------------
access-list 111 extended permit icmp any any
access-list 111 permit ip any any
access-group 111 in inter outside
access-group 111 in inter inside
access-group 111 in inter dmz
access-list testacl deny ip 192.168.201.33 255.255.255.255 any
access-list testacl permit ip any any
access-group testacl in inter inside
--------------------------------------------
nat-control
nat (inside) 1 0 0
global (outside) 1 interface
global (dmz) 1 192.168.202.100-192.168.202.110
static (dmz,outside) 210.10.10.10.2 192.168.202.2
access-list out_to_dmz permit tcp any host 210.10.10.2 eq 80
access-group out_to_dmz in interface outside
end
write memory
copy running-config startup-config
清除配置信息：
conf t
clear configure all
clear configure comman [level2 command]
end
===========================================
ASA的高级应用-URL过滤
conf t
access-list tcp_filter1 permit tcp 192.168.201.0 255.255.255.240 any eq www
class-map tcp_filter_class1
match access-list tcp_filter1
exit
regex url1 \.sina\.com
class-map type regex match-any url_class1
match regex url1
exit
class-map type inspect http http_url_class1
match not request header host regex class url_class1
exit
policy-map type inspect http http_url_policy1
class http_url_class1
drop-connection log
exit
exit
policy-map inside_http_url_policy
class tcp_filter_class1
inspect http http_url_policy1
exit
exit
service-policy inside_http_url_policy interface inside //完整配置时删除此行
----------------
access-list tcp_filter2 permit tcp any any eq www
class-map tcp_filter_class2
match access-list tcp_filter2
exit
regex url2 \.game\.com
class-map type regex match-any url_class2
match regex url2
exit
class-map type inspect http http_url_class2
match request header host regex class url_class2
exit
policy-map type inspect http http_url_policy2
class http_url_class2
drop-connection log
exit
exit
policy-map inside_http_url_policy
class tcp_filter_class2
inspect http http_url_policy2
exit
exit
service-policy inside_http_url_policy interface inside
---------------------------------------
另外有需要云服务器可以了解下创新互联scvps.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。