网络工程 - Cisco ASA 5512X 不允许跨 VLAN 连接到互联网 - 吾爱随笔录

Cisco ASA 5512X 不允许跨 VLAN 连接到互联网

网络工程 VLAN 思科子网

2021-07-15 00:57:25

第一次做网络，我通常是一个软件人。我正在建立一个网络来共享和互联网连接到多个属性。目标是将每个属性分段到其自己的 VLAN 中。

我有一个 IP 为 192.168.1.254/24 的网关，我可以用它来访问互联网。第一个端口上连接了 Cisco ASA 5512X（IP 为 192.168.1.253/24）。它的 IP 来自 DHCP 保留。对于所有子网，此 ASA 充当 DHCP 服务器。ASA 上的下一个端口连接到 HP A5820X 交换机。已为所需的 VLAN 配置了端口。

该交换机有一个中继端口，带有托管几个 WLAN 的 Cisco Mobility Express WiFi AP。

我已正确分发 IP，但我的 VLAN 无法访问 Internet。我看到 ASA 被击中，以及诸如“构建出站 UDP 连接...”之类的消息，但这些子网上的客户端无法访问互联网。

网络的粗略图：

ASA Version 9.1(2) 
!
hostname firewall
domain-name revenance.us
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 9eeFjmhLBXqRF2up encrypted
names
!
interface GigabitEthernet0/0
 description Gateway Access
 nameif outside
 security-level 0
 ip address dhcp setroute 
 dhcprelay server 192.168.1.254
!
interface GigabitEthernet0/1
 description Inside Trunk Interface
 flowcontrol send on
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0 
!
interface GigabitEthernet0/1.1
 description Default VLAN1 (for HP Switch)
 vlan 1
 nameif Default-VLAN
 security-level 100
 ip address 10.0.1.1 255.255.255.0 
!
interface GigabitEthernet0/1.2
 description 9831 datacentre VLAN
 vlan 2
 nameif 9831-DC-VLAN
 security-level 10
 ip address 10.0.2.1 255.255.255.0 
!
interface GigabitEthernet0/1.18
 description 9818 LAN Segment
 shutdown
 vlan 18
 nameif 9818-VLAN
 security-level 100
 ip address 10.0.18.1 255.255.255.0 
!
interface GigabitEthernet0/1.31
 description 9831 LAN Segment
 vlan 31
 nameif 9831-VLAN
 security-level 100
 ip address 10.0.31.1 255.255.255.0 
!
interface GigabitEthernet0/1.34
 description 9834 LAN Segment
 vlan 34
 nameif 9834-VLAN
 security-level 100
 ip address 10.0.34.1 255.255.255.0 
!
interface GigabitEthernet0/1.35
 description 9835 LAN Segment
 shutdown
 vlan 35
 nameif 9835-VLAN
 security-level 100
 ip address 10.0.35.1 255.255.255.0 
!
interface GigabitEthernet0/1.75
 description 9875 LAN Segment
 shutdown
 vlan 75
 nameif 9875-VLAN
 security-level 100
 ip address 10.0.75.1 255.255.255.0 
!
banner exec Please be sure to save any changes with write.
banner login Connected to Cisco ASA - $(hostname)
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns server-group DefaultDNS
 domain-name revenance.us
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network A_
object network revenance.us
 fqdn v4 revenance.us
object network ISP_Gateway
 host 192.168.1.254
 description AT&T Gateway
object network Gateway-Network
 subnet 192.168.1.0 255.255.255.0
object-group network Inside-Networks
 network-object 10.0.0.0 255.255.255.0
 network-object 10.0.1.0 255.255.255.0
 network-object 10.0.18.0 255.255.255.0
 network-object 10.0.2.0 255.255.255.0
 network-object 10.0.31.0 255.255.255.0
 network-object 10.0.34.0 255.255.255.0
 network-object 10.0.35.0 255.255.255.0
 network-object 10.0.75.0 255.255.255.0
access-list outside_access_in remark Allow all to DC
access-list outside_access_in extended permit ip interface outside 10.0.2.0 255.255.255.0 
access-list inside_access_out extended permit ip any any 
access-list global_access extended permit ip any any 
access-list global_access extended permit ip object-group Inside-Networks object Gateway-Network 
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu 9831-DC-VLAN 1500
mtu 9818-VLAN 1500
mtu 9831-VLAN 1500
mtu 9834-VLAN 1500
mtu 9835-VLAN 1500
mtu 9875-VLAN 1500
mtu Default-VLAN 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
asdm history enable
arp timeout 14400
no arp permit-nonconnected
access-group outside_access_in in interface outside
access-group inside_access_out out interface inside
access-group global_access global
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
no user-identity enable
user-identity default-domain LOCAL
no user-identity action mac-address-mismatch remove-user-ip
http server enable
http 192.168.1.0 255.255.255.0 outside
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd domain revenance.us
dhcpd auto_config outside
!
dhcpd address 10.0.0.10-10.0.0.250 inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!
dhcpd auto_config outside interface 9831-DC-VLAN
!
dhcpd address 10.0.18.10-10.0.18.250 9818-VLAN
dhcpd auto_config outside interface 9818-VLAN
dhcpd enable 9818-VLAN
!
dhcpd address 10.0.31.10-10.0.31.250 9831-VLAN
dhcpd auto_config outside interface 9831-VLAN
dhcpd enable 9831-VLAN
!
dhcpd address 10.0.1.10-10.0.1.250 Default-VLAN
dhcpd auto_config outside interface Default-VLAN
dhcpd enable Default-VLAN
!
no threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username sinman password uXtx7p2Ftlk.2ajD encrypted
!
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
!
prompt hostname state context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly 28
  subscribe-to-alert-group configuration periodic monthly 28
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:2979836264ef9f78dba4a6f01c759115
: end

3个回答

您的访问列表完全错误。outside_access_in只允许外部接口的地址——永远不会成为入站流量的来源——通过，进入内部网络；无论如何它都不会工作，因为流量不会从较低的安全级别流向较高的安全级别。全局访问只允许内部网络与网关网络对话。在您完全理解全局访问规则的作用之前，不要使用它。使用packet-tracer命令查看您的配置的效果——acl、nat 等。

然后是NAT的问题。外部 AT&T（Uverse？）网关对这些内部网络一无所知。由于它们是 10.x，因此不能-- 10/8 在 uverse 网络中无效/保留。无论如何，您都不想暴露内部网络。（我不记得在有限的 GUI 中有任何东西可以添加路由。）

此外，在中继的基本接口上配置 ip 也很奇怪。那个流量属于哪个vlan？（无论外部交换机为本地 vlan 设置了什么 - 如果有的话。）

通过NAT 规则为每个 VLAN 接口启用 PAT允许连接到 Internet。

就像我说的，我的 ASA 生锈了，我没有一个可以玩的盒子，但这里有一个 NAT 配置草案可以尝试。是很好得到的东西没有ISP干预工作，即使是次优的。

object network default-vlan
  subnet 10.0.1.0 255.255.255.0
  nat (Default-VLAN, outside) dynamic interface
object network 9831-vlan
  subnet 10.0.2.0 255.255.255.0
  nat (9831-DC-VLAN, outside) dynamic interface

(repeat for each internal vlan once tested successfully)

Useful troubleshooting command: show xlate

（删除了一些不正确的配置...thx Ricky Beam）

这是一些 Cisco 配置示例，但遗憾的是，它们遗漏了我们需要的最简单的情况。啊。 https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/firewall/asa-98-firewall-config/nat-reference.html#ID-2091-00000007

其它你可能感兴趣的问题

上一篇Arista VXLan 与 QinQ 下一篇在 TCP/IP 中，“LAN”是第 2 层还是第 3 层概念？