ASA 不使用来自 ISP dhcp 的 IP 进行路由

网络工程 路由 思科
2021-07-06 08:25:45

我认为这是一个类似的案例像这一个。唯一的问题是这里我有一个来自 ISP 的动态 IP，它是从 dhcp 更新的。

asa 可以 ping 外部，但是 vlan1 上的内部主机无法 ping 互联网 IP 地址（例如 google）。

这是我的配置：

ASA Version 9.2(3)4
!
hostname myname
enable password aaa encrypted
passwd aaaa encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.2 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
boot system disk0:/asa923-4-k8.bin
ftp mode passive
clock timezone CET 1
clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00
object network obj_any
 subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-741.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.1.26,CN=sergioasa
 keypair ASDM_LAUNCHER
 crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
 certificate ca ***cert stuff***
  quit
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0
 certificate ***cert stuff***
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config outside
!
dhcprelay server 192.168.1.1 outside
dhcprelay enable inside
dhcprelay setroute inside
dhcprelay timeout 60
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_Launcher_Access_TrustPoint_0
username sergio password aaaa encrypted
!
!
prompt hostname context
call-home reporting anonymous
Cryptochecksum:chesumnumbers

我认为可能缺少一条路由......但是如何添加一条路由，将所有外部流量发送到 vlan2 而不是一个精确的 IP 地址？

添加后：

object network obj_any
 nat (inside,outside) dynamic interface

我跑：

packet-tracer input inside tcp 192.168.1.100 323 8.8.8.8 80 detailed

我得到了：

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         via 192.168.0.1, outside

Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
object network obj_any
 nat (inside,outside) dynamic interface
Additional Information:
Dynamic translate 192.168.1.100/323 to 192.168.0.12/323
 Forward Flow based lookup yields rule:
 in  id=0xcd238b10, priority=6, domain=nat, deny=false
        hits=1, user_data=0xcd02f3c0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=outside

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcc34e8e8, priority=0, domain=nat-per-session, deny=false
        hits=810, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcc9bf968, priority=0, domain=inspect-ip-options, deny=true
        hits=1341, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0xcc34e8e8, priority=0, domain=nat-per-session, deny=false
        hits=812, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0xcc9d68d0, priority=0, domain=inspect-ip-options, deny=true
        hits=1075, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=outside, output_ifc=any

Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1249, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

在 ISR（dhcp 服务器）上，我有以下路由表：

Gateway of last resort is not set

     10.0.0.0/24 is subnetted, 1 subnets
C       10.11.0.0 is directly connected, Loopback0
C    192.168.1.0/24 is directly connected, BVI1

在 ASA 上，路由表是：

Gateway of last resort is 192.168.0.1 to network 0.0.0.0

S*    0.0.0.0 0.0.0.0 [1/0] via 192.168.0.1, outside
C        192.168.0.0 255.255.255.0 is directly connected, outside
L        192.168.0.12 255.255.255.255 is directly connected, outside
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.2 255.255.255.255 is directly connected, inside
2个回答

如果 ASA 可以 ping 互联网，那么防火墙上的路由就可以了。

尽管我确实注意到我看不到 NAT 语句来确定从内部地址到外部地址的流量

在您的对象下应用 NAT。

对象网络 obj_any
nat (inside,outside) 动态接口

如果这不能解决您的问题，请


在 tcp 192.168.1.100 323 8.8.8.8 80 中详细发布以下命令packet-tracer input的输出

要修复 ICMP 试试这个

       class-map inspection_default
        match default-inspection-traffic
       policy-map global_policy
        class inspection_default
         inspect icmp
       service-policy global_policy global
其它你可能感兴趣的问题
上一篇不同子网 MASKS 之间的通信，其 IP 地址适用于 下一篇如何广泛测试以太网交换机