网络工程 - Cisco ASA 和 3850 路由 - 吾爱随笔录

我的网络中有一台 cisco ASA 5515 和一台 Cisco 3850 交换机。我是一名系统管理员，我知道足以启动和运行交换机，但 asa 的事情让我有点困惑。这个硬件是由后来离开公司的人购买的，所以现在我的任务是设置它。

现在我们有一个 /29 说

9.10.11.24/29

我们的私有ip空间是

10.128.0.0/16

所以我们的 asa 通过管理网络在线

10.128.7.103

我们的 3850 也在线通过

10.128.7.101

我在将公共 ip 空间分配给 ASA 然后将 vlan 流量路由到它时遇到了一些问题。

现在我的 vlan 连接到 3850 就像

interface Vlan60
 ip address 10.128.60.1 255.255.255.0
!
interface Vlan70
 ip address 10.128.70.1 255.255.255.0
!

3850上的路由看起来像

ip route 0.0.0.0 0.0.0.0 10.128.7.1

10.128.7.1 是我们要搬离的旧数据中心。理想情况下，我希望通过 ASA 将所有流量路由出去。

所以就像

互联网 <--> ASA <--> 3850 <--> 内部局域网。

不知道我真正缺少什么来解决这个问题。

ASA 配置

asa# show run
: Saved
:
ASA Version 9.1(1)
!
hostname asa
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 70.42.246.25 255.255.255.248
!
interface GigabitEthernet0/1
 nameif inside
 security-level 0
 ip address 10.128.8.1 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/4
 description STATE Failover Interface
!
interface GigabitEthernet0/5
 description LAN Failover Interface
!
interface Management0/0
 management-only
 nameif management
 security-level 100
 ip address 10.128.7.103 255.255.255.0
!
boot system disk0:/asa911-smp-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
 domain-name sjc.recurly.net
access-list global_access extended permit icmp any any
pager lines 24
logging enable
logging monitor debugging
logging buffered debugging
logging trap debugging
logging asdm informational
logging host management 10.128.7.54
mtu management 1500
mtu outside 1500
mtu inside 1500
ip verify reverse-path interface outside
failover
failover lan unit primary
failover lan interface folink GigabitEthernet0/5
failover key *****
failover link statelink GigabitEthernet0/4
failover interface ip folink 172.27.48.1 255.255.255.0 standby 172.27.48.2
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
access-group global_access global
route outside 0.0.0.0 0.0.0.0 65.42.246.30 1
route management 10.113.0.0 255.255.0.0 10.128.7.1 1
route management 10.128.0.0 255.255.0.0 10.128.7.1 1
route management 10.242.0.0 255.255.0.0 10.128.7.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius-group protocol radius
 accounting-mode simultaneous
 merge-dacl before-avpair
aaa-server radius-group (management) host 10.128.7.81
 key *****
 authentication-port 1812
 accounting-port 1813
user-identity default-domain LOCAL
aaa authentication http console radius-group LOCAL
aaa authentication ssh console radius-group LOCAL
aaa authorization command LOCAL
http server enable
http 10.0.0.0 255.0.0.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 10.0.0.0 255.0.0.0 management
ssh timeout 5
ssh version 2
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.128.7.101 source management
username shon password Vp4yQWvnJ8bKI5Lz encrypted
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:1fd56c8cffa842a1390f7b3b366852a4
: end