ASAicmp檢測(cè)和內(nèi)網(wǎng)NAT轉(zhuǎn)化

拓?fù)浣Y(jié)構(gòu) ：

創(chuàng)新互聯(lián)的團(tuán)隊(duì)成員不追求數(shù)量、追求質(zhì)量。我們經(jīng)驗(yàn)豐富并且專業(yè)，我們之間合作時(shí)就好像一個(gè)人，協(xié)同一致毫無(wú)保留。創(chuàng)新互聯(lián)建站珍視想法，同時(shí)也看重過(guò)程轉(zhuǎn)化帶來(lái)的沖擊力和影響力，在我們眼中，任何細(xì)節(jié)都不容小覷。一直致力于為企業(yè)提供從申請(qǐng)域名、網(wǎng)站策劃、網(wǎng)站設(shè)計(jì)、成都商城網(wǎng)站開(kāi)發(fā)、網(wǎng)站推廣、網(wǎng)站優(yōu)化到為企業(yè)提供個(gè)性化軟件開(kāi)發(fā)等基于互聯(lián)網(wǎng)的全面整合營(yíng)銷服務(wù)。

In（R1） ---- （inside）ASA 5520（outside） --- Out（R2）

ASA配置：

ASA Version 8.4(2)

hostname ciscoasa

enable password rQETR98wpSI1Lpr9 encrypted

passwd rQETR98wpSI1Lpr9 encrypted

names

interface GigabitEthernet0

nameif inside

security-level 100

ip address 192.168.1.4 255.255.255.0

interface GigabitEthernet1

nameif dmz

security-level 50

no ip address

interface GigabitEthernet2

nameif outside

security-level 0

ip address 10.254.1.1 255.255.255.0

ftp mode passive

object network test

host 192.168.1.5

pager lines 24

logging enable

logging asdm informational

logging debug-trace

mtu inside 1500

mtu dmz 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

object network test

nat (inside,outside) dynamic 10.254.1.10 ----動(dòng)態(tài)NAT

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ca trustpoint _SmartCallHome_ServerCA

crl configure

telnet 192.168.1.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

web***

anyconnect-essentials

username netemu password QTbvAEdn30mERkZb encrypted privilege 15

class-map inspection_default

match default-inspection-traffic

policy-map type inspect DNS preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h423 h325

inspect h423 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect icmp

inspect icmp error

service-policy global_policy global

prompt hostname context

call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

crashinfo save disable

Cryptochecksum:bfa7c38d2288de6d8cb12bd5c4be8eb6

: end

NAT轉(zhuǎn)化擊中計(jì)數(shù)器：

ciscoasa# show nat detail 去往Outside地址段的地址轉(zhuǎn)換

Auto NAT Policies (Section 2)

1 (inside) to (outside) source dynamic test 10.254.1.10

translate_hits = 126, untranslate_hits = 90

Source - Origin: 192.168.1.5/32, Translated: 10.254.1.10/32

在實(shí)驗(yàn)過(guò)程中發(fā)現(xiàn)inspection引擎下的配置刪除掉了需手動(dòng)加上

并加上以下配置：

policy-map global_policy
class inspection_default
inspect icmp

網(wǎng)上有詳細(xì)解釋！

Inside 路由器配置：

In#show running-config

Building configuration...

Current configuration : 959 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

ip domain name lab.local

ip auth-proxy max-nodata-conns 3

ip admission max-nodata-conns 3

interface FastEthernet0/0

ip address 192.168.1.5 255.255.255.0

duplex auto

speed auto

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 192.168.1.4

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

line vty 0 4

end

Outside 路由器配置：

Out#show runn

Building configuration...

Current configuration : 1006 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname Out

no ip domain lookup

ip domain name lab.local

ip auth-proxy max-nodata-conns 3

ip admission max-nodata-conns 3

username admin password 0 cisco

interface FastEthernet0/0

ip address 10.254.1.5 255.255.255.0

duplex auto

speed auto

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 10.254.1.1 ----- 默認(rèn)路由指向Inside端網(wǎng)絡(luò)

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

line vty 0 4

password cisco

end

我們需要了解ASA對(duì)于inbound和outbound的定義：

高安全級(jí)別 ----> 低安全級(jí)別 outbound

低安全級(jí)別 ----> 高安全級(jí)別 inbound

默認(rèn)情況：出站流量是允許的（特例請(qǐng)見(jiàn)下文）

進(jìn)流量是禁止的

也就是從高到低方向是允許的，也可以返回的。但不可以直接從低到高。

ACL可以禁止或允許這兩個(gè)方向的流量

摘自 ASA840 配置手冊(cè) 講的是inspection引擎對(duì)于一些特定協(xié)議流量的檢測(cè)機(jī)制

ACL返回流量規(guī)則：

For TCP and UDP connections for both routed and transparent mode, you do not need an access rule to allow returning traffic because the ASA allows all returning traffic for established, bidirectionalconnections. For connectionless protocols such as ICMP, however, the ASA establishes unidirectionalsessions,

For connectionless protocols such as ICMP, however, the ASA establishes unidirectional sessions, so you either need access rules to allow ICMP in both directions (by applying access lists to the source and destination interfaces), or you need to enable the ICMP inspection engine.The ICMP inspection enginetreats ICMP sessions as bidirectional connections. To control ping, specifyecho-reply(0) (ASA to host)orecho(8) (host to ASA).

思科官方文檔解釋還是蠻給力的需要我們好好膜拜！

本文題目：ASAicmp檢測(cè)和內(nèi)網(wǎng)NAT轉(zhuǎn)化
文章轉(zhuǎn)載：http://aaarwkj.com/article8/igsgop.html

成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián)，為您提供網(wǎng)站制作、電子商務(wù)、用戶體驗(yàn)、網(wǎng)站內(nèi)鏈、品牌網(wǎng)站建設(shè)、外貿(mào)建站

聲明：本網(wǎng)站發(fā)布的內(nèi)容（圖片、視頻和文字）以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主，如果涉及侵權(quán)請(qǐng)盡快告知，我們將會(huì)在第一時(shí)間刪除。文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng)，如需處理請(qǐng)聯(lián)系客服。電話：028-86922220；郵箱：631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載，或轉(zhuǎn)載時(shí)需注明來(lái)源：創(chuàng)新互聯(lián)

猜你還喜歡下面的內(nèi)容

欧美一级特黄大片做受成人-亚洲成人一区二区电影-激情熟女一区二区三区-日韩专区欧美专区国产专区

ASAicmp檢測(cè)和內(nèi)網(wǎng)NAT轉(zhuǎn)化