网络工程 - Cisco ASA 5505 - 将 2 公共 IP 路由到不同的 VLAN - 吾爱随笔录

我正在尝试在我的网络上设置 Cisco ASA 5505 防火墙，并有一些重要的规定。我从我的 ISP 获得两个可用的静态 IP，其中一个我想用于“家庭流量”，另一个用于“工作流量”。目前有 3 个接口处于活动状态，一个是外部接口，一个是 10.1.0.0/24 子网，另一个是 10.0.0.0/24 子网。

然而，我目前设置它的方式似乎不起作用。“家庭网络”子网似乎工作正常，NAT 将 10.0.0.0/24 范围内的私有 IP 转换为第一个公共 IP。然后我在另一个接口上设置 NAT（用于工作），并对其进行配置，以便将工作子网转换为第二个公共 IP。这似乎根本行不通。

我是否正确地进行了此设置，还是完全错过了这一点？

: Saved
:
ASA Version 8.2(5) 
!
hostname io-firewall
enable password OqFyPF1LKWo.0KDG encrypted
passwd OqFyPF1LKWo.0KDG encrypted
names
name 24.156.39.1 primary-isp-gateway description Suddenlink ISP Gateway
!
interface Ethernet0/0
!
interface Ethernet0/1
 switchport access vlan 2
!
interface Ethernet0/2
 switchport access vlan 12
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
interface Vlan1
 nameif outside
 security-level 0
 ip address 24.156.39.89 255.255.255.0 
!
interface Vlan2
 nameif internal-home
 security-level 50
 ip address 10.0.0.1 255.255.255.0 
!
interface Vlan12
 no forward interface Vlan2
 nameif internal-work
 security-level 50
 ip address 10.1.0.1 255.255.255.0 
!
boot config disk0:/startup-config
ftp mode passive
clock timezone MST -7
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 8.8.8.8
 name-server 8.8.4.4
same-security-traffic permit intra-interface
access-list internal-work_nat_outbound extended permit ip 10.1.0.0 255.255.255.0 any 
access-list internal-home_nat_outbound extended permit ip 10.0.0.0 255.255.255.0 any 
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu internal-home 1500
mtu internal-work 1500
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 101 interface
global (outside) 102 24.156.39.90 netmask 255.255.255.0
nat (internal-home) 101 access-list internal-home_nat_outbound
nat (internal-work) 102 access-list internal-work_nat_outbound
route outside 0.0.0.0 0.0.0.0 primary-isp-gateway 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.0.0.0 255.255.255.0 internal-home
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
ssh version 2
console timeout 0
dhcpd address 10.0.0.2-10.0.0.5 internal-home
dhcpd dns 8.8.8.8 8.8.4.4 interface internal-home
dhcpd enable internal-home
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 40.85.153.82 source outside
ntp server 13.65.88.161 source outside prefer
ssl encryption aes128-sha1 aes256-sha1
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect icmp 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:006736c3cf70dab2a88371d0462dd20b
: end
no asdm history enable