为路由配置 Cisco ASA 5505

网络工程 思科 路由 思科 故障排除
2021-07-13 01:12:06

我首先要指出网络问题总是让我摸不着头脑。有一些关于路由的东西，特别是我还没有“哦，我明白了”的时刻，所以这很可能是一个非常基本的错误配置。

我正在尝试将 Cisco ASA 5505 设置为与一个接口上的公共 IP 地址连接，并将第二个接口连接到我们的内部网络。现在我们的内部网络在 192.168.1.0/24 上，我们从 ISP 获得的公共 IP 在 125.xxx 范围内。

我在 ASA 上设置了 3 个接口，

  • 里面 

    IP: 192.168.1.3
Mask: 255.255.255.0
Ports 1-6
Sec Level 100

  • 外部

    IP: 125.x.x.x
Mask: 255.0.0.0
Port 0
Sec Level 0

  • 管理

    IP: 10.0.0.1
Mask: 255.255.255.0
Port 7
Restricted to management
Restrict flow to Outside (had to do this for licensing reasons)

我在防火墙上有一个访问规则，允许从内部网络上的任何来源到任何不太安全的网络的 IP 流量（IPv4 和 6 都有一个）。

将面向互联网的路由器连接到端口 0，我将计算机连接到端口 1 192.168.1.20，255.255.255.0并使用 IP 、掩码和网关192.168.1.3。使用这台 PC 我可以 ping192.168.1.3但不能进一步 - 我无法 ping 公共 IP 地址或8.8.8.8.

如果我将同一台 PC 直接连接到路由器并直接为其分配公共 IP 地址，则我可以访问互联网没问题。我相信这里的问题是我需要添加一些静态路由来显示从内部<->外部的路径，但我只是没有很好地理解它们以知道如何构建它们。任何帮助或建议将不胜感激。

编辑：请参阅下面的运行配置，并进行一些修改。

: Saved
:
ASA Version 8.2(1) 
!
hostname AUS-FW-01
domain-name =============.com.au
enable password ============= encrypted
passwd ============= encrypted
names
name 10.61.76.0 CNC-network
name 10.61.73.0 LAN-network
name 192.168.1.0 LEGACY-network
name 10.61.75.0 RANDD-network
name 10.61.74.0 WIRELESS-network
name 10.61.73.5 InternalGateway
name 192.168.1.200 DCServer
name 192.168.1.214 MUVS-TP description Trueform Print Server
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.3 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 125.x.x.10 255.255.255.252 
!
interface Vlan12
 no forward interface Vlan2
 nameif Management
 security-level 0
 ip address 10.0.0.1 255.255.255.0 
 management-only
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
ftp mode passive
clock timezone EST 10
dns domain-lookup outside
dns server-group DefaultDNS
 name-server =============
 name-server =============
 domain-name =============.com.au
same-security-traffic permit intra-interface
access-list outside_access_in remark Email access
access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq smtp 
access-list outside_access_in remark ActiveSync Email Access
access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq https 
access-list outside_access_in remark Pronto Trueform Printing
access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq lpd 
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu Management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp DCServer smtp netmask 255.255.255.255 
static (inside,outside) tcp interface https DCServer https netmask 255.255.255.255 
static (inside,outside) tcp interface lpd MUVS-TP lpd netmask 255.255.255.255 
access-group outside_access_in in interface outside
route inside LAN-network 255.255.255.0 10.61.79.2 1
route inside LEGACY-network 255.255.255.0 InternalGateway 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.61.79.0 255.255.255.0 inside
http LAN-network 255.255.255.0 inside
http 10.0.0.0 255.255.255.0 Management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn username ============= password ============= store-local
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:=============
: end
asdm location LAN-network 255.255.255.0 inside
asdm location WIRELESS-network 255.255.255.0 inside
asdm location RANDD-network 255.255.255.0 inside
asdm location CNC-network 255.255.255.0 inside
asdm location LEGACY-network 255.255.255.0 inside
asdm location InternalGateway 255.255.255.255 inside
asdm location DCServer 255.255.255.255 inside
asdm location MUVS-TP 255.255.255.255 inside
no asdm history enable

PS：我不确定这是否更适合这里或SF。我对它移动没有问题。

1个回答

好的，在查看您的配置后，您缺少一个语句：

route outside 0.0.0.0 0.0.0.0 125.x.x.9

这告诉防火墙将所有 Internet 流量转发到位于 125.xx9 的 ISP 路由器

其它你可能感兴趣的问题
上一篇ARP 回复是否可以广播 下一篇缓解 IPv6 格式错误的数据包组播泛洪