网络工程 - ASA5506 ISP 可能存在 NAT 问题 - 吾爱随笔录

背景：我正在为我参加的当地教会建立一个网络。设置将是：

当前 ATT DSL --> 摩托罗拉 3801HGV 设置为透明（桥接）模式 --> ASA5506 的外部接口（从 DSL 调制解调器配置为 DHCP）--> 5506 的内部接口（172.16.0.2 IP）--> Cisco 上的路由接口3750 (Gi1/0/3)。

3750 有 3 个专用网络。所有网络都可以毫无问题地相互通信。所有网络都可以ping通172.16.0.2 IP（ASA5506内部接口）。这三个专用网络是：

10.1.1.0/24
10.1.2.0/24
10.1.3.0/24

注意：我在执行路由的 3750 上运行单区域 OSPF。我也在那里配置了默认信息来源。

我目前在我的 ASA 上配置了 NAT，这样当流量离开外部接口时，它会通过 PAT 连接到外部 ISP IP (108.xxx)。我运行了 packet-tracer 来确认 - 并且 packet tracer 说它被允许出去 - 并将它显示为 PAT-ed 到 108.xxx IP。

问题：我的 10.xxx 网络都无法访问 Internet。如果我使用静态分配的 192.168.1.x IP（这是 5031nv 给出的 DHCP 池范围）直接插入 ATT 5031NV - 我可以毫无问题地上网。

我发现我也无法从 Cisco ASA ping 默认 (ISP) 网关。请参阅下面的更新 (11/5/2015) 配置。我根据该线程的评论进行了一些更改。

Cisco 3750 上的相关配置：

SRPC-CORE-OFFICE#sho run | s router ospf
 router ospf 1
   passive-interface default
   no passive-interface GigabitEthernet1/0/3
   network 10.1.1.0 0.0.0.255 area 1
   network 10.1.2.0 0.0.0.255 area 1
   network 10.1.3.0 0.0.0.255 area 1

SRPC-CORE-OFFICE#sho ip route

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C        10.1.1.0/24 is directly connected, Vlan100
L        10.1.1.1/32 is directly connected, Vlan100
C        10.1.2.0/24 is directly connected, Vlan120
L        10.1.2.1/32 is directly connected, Vlan120
C        10.1.3.0/24 is directly connected, Vlan130
L        10.1.3.1/32 is directly connected, Vlan130
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.0.0/24 is directly connected, GigabitEthernet1/0/3
L        172.16.0.1/32 is directly connected, GigabitEthernet1/0/3
S     192.168.0.0/16 is directly connected, GigabitEthernet1/0/3
S     192.168.5.0/24 is directly connected, GigabitEthernet1/0/3

！！

SRPC-CORE-OFFICE#sho ip int br | ex un
    Interface              IP-Address      OK? Method Status            Protocol
    Vlan100                10.1.1.1        YES NVRAM  up                    up      
    Vlan120                10.1.2.1        YES NVRAM  up                    up      
    Vlan130                10.1.3.1        YES NVRAM  up                    up    
    GigabitEthernet1/0/3   172.16.0.1      YES NVRAM  up                    up

！！

SRPC-CORE-OFFICE#sho vlan br | i active
    100  MANAGEMENT                       active 
    120  SRPC_WIFI                        active 
    130  SRPC_DATA                        active

Cisco ASA5506 相关配置：

SRPC-FW-01# sho run nat
        !
        object network obj_any
         nat (dmzTest,outside) dynamic interface

router ospf 1
 network 7.0.1.0 255.255.255.0 area 1
 network 10.1.1.10 255.255.255.255 area 1
 network 192.168.1.0 255.255.255.0 area 1
 log-adj-changes
 default-information originate

!
route dmzTest 10.1.0.0 255.255.224.0 172.16.0.1 1
!
!
SRPC-FW-01# sh int ip br 
Interface                  IP-Address      OK? Method Status            Protocol
GigabitEthernet1/1         108.225.177.202 YES DHCP   up                    up  
GigabitEthernet1/2         172.16.0.2      YES CONFIG up                    up  

!
!
SRPC-FW-01# sho nameif
       Interface                Name                     Security
       GigabitEthernet1/1       outside                    0
       GigabitEthernet1/2       dmzTest                  100
        !

access-list dmzTest-in extended permit tcp any any 
access-list dmzTest-in extended permit icmp any any 
access-list dmzTest-out extended permit tcp any any 
access-list management-in extended permit ip any any 
access-list management-out extended permit ip any any 
access-list OutsideATT-in extended permit ip any any 
access-list OutsideATT-out extended permit ip any any 
access-list dmztest-out extended permit icmp any any 
access-list outside_inbound_to_SRPC extended deny ip any any 
access-list outside_inbound_to_SRPC extended permit ip host 108.225.176.1 any 
access-list outside_outbound_to_INET extended permit ip 108.225.176.0 255.255.252.0 any 
access-list outside_outbound_to_INET extended permit ip any any 
!
!
!   
access-group outside_inbound_to_SRPC in interface outside
access-group outside_outbound_to_INET out interface outside
access-group dmzTest-in in interface dmzTest
access-group dmzTest-out out interface dmzTest
access-group OutsideATT-in in interface OutsideATT
access-group OutsideATT-out out interface OutsideATT
access-group management-in in interface management
access-group management-out out interface management
!

SRPC-FW-01# sho route
    Gateway of last resort is 108.225.176.1 to network 0.0.0.0

    S*    0.0.0.0 0.0.0.0 [1/0] via 108.225.176.1, outside
    S        10.1.0.0 255.255.224.0 [1/0] via 172.16.0.1, dmzTest
    C        108.225.176.0 255.255.252.0 is directly connected, outside
    L        108.225.177.202 255.255.255.255 is directly connected, outside
    C        172.16.0.0 255.255.255.0 is directly connected, dmzTest
    L        172.16.0.2 255.255.255.255 is directly connected, dmzTest