我们正在转向更安全的系统，第一步是添加此安全设备。目前有两个小型准家用级 Cisco 路由器（rv260W 和 rv130）。在我们购买更合适的路由设备之前，该设备将接管他们的所有职责。
我已尽我所能在 ASA 中复制了两台路由器的设置，将 VLAN 设置为相同的安全级别，并尽力在它们之间添加路由。数据包跟踪按预期工作，但两个 VLAN 之间的实际 ping 和 http 请求超时。通过将两台测试机器上的主 DNS 设置为它们各自的网关，我取得了一些成功，但感觉这很糟糕，我宁愿做对。
是否发生串扰其实并不重要，除了位于 VOIP 网络上的 PBX，我们需要能够看到它。
当前配置（为安全起见删除了某些部分）：
ASA Version 9.8(2)
!
hostname x
enable password x
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address x 255.255.255.252
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.0.254 255.255.254.0
!
interface GigabitEthernet1/3
nameif VOIP
security-level 100
ip address 172.16.0.99 255.255.255.0
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network inside
subnet 192.168.0.0 255.255.254.0
object network phones
subnet 172.16.0.0 255.255.255.0
object network obj_any_voip
subnet 0.0.0.0 0.0.0.0
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list internal extended permit ip any any
access-list internal extended permit icmp any any
access-list external extended permit ip any any
access-list external extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu VOIP 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
nat (inside,outside) dynamic interface
object network obj_any_voip
nat (VOIP,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group internal in interface outside
access-group external in interface inside
access-group internal in interface VOIP
access-group global_access global
route outside 0.0.0.0 0.0.0.0 xx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.0.0 255.255.254.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.249 inside
dhcpd dns 192.168.0.254 interface inside
dhcpd lease 86400 interface inside
dhcpd domain BII interface inside
dhcpd enable inside
!
dhcpd address 172.16.0.120-172.16.0.219 VOIP
dhcpd dns 172.16.0.99 interface VOIP
dhcpd lease 86400 interface VOIP
dhcpd domain voip interface VOIP
dhcpd enable VOIP
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum: xxx
我对 Cisco 的东西（第一次 IT 工作）真的很陌生，所以欢迎提出任何建议。
ciscoasa(config)# ping tcp 172.16.0.54 1
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 172.16.0.54 port 1
from 172.16.0.99, timeout is 2 seconds:
RRRRR
Success rate is 0 percent (0/5)
ciscoasa(config)# ping tcp 192.168.0.21 7
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 192.168.0.21 port 7
from 192.168.0.254, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)