网络工程 - ASA 不通过流量 - 吾爱随笔录

我讨厌发布这样的东西，但我们在这里退缩了。我们最近有一个新客户要求我们为他们 800 英里外的分支机构设立一个 ASA。我和一位同事昨晚盯着配置看，并没有发现它有什么明显的错误，但是 ASA 目前在新办公室就位，并且拒绝通过流量。

我们可以从 LAN ping 内部默认网关，从 ASA ping ISP 的网关，只是没有 LAN->WAN。0/1 是我们目前使用的外部连接，10.19.130.177 是最后的网关。我们今天正在考虑交换实物，但除此之外，我们不知所措。将不胜感激你们能提供的任何帮助。也欢迎在不先测试的情况下将其投入生产的火焰。

ASA5200：

!
hostname NY-ASA5200
domain-name tiddlywinks.com
enable password .OQUvNlAd8LFUGsq7R9h encrypted
passwd 2KFQNnbNIUdI.2TKYOUR encrypted
names
!
interface GigabitEthernet0/0
shutdown
nameif FIBER
security-level 0
ip address 172.16.0.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif OUTSIDE
security-level 0
ip address 10.19.130.190 255.255.255.240
!
interface GigabitEthernet0/2
nameif INSIDE
security-level 100
ip address 192.168.220.1 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
dns server-group DefaultDNS
domain-name tiddlywinks.com
object network inside-subnet
subnet 192.168.220.0 255.255.255.0
object network outside_IP
host 10.19.130.190
access-list inside_out_acl extended permit ip any any
access-list inside_out_acl extended permit icmp any any
pager lines 24
mtu FIBER 1500
mtu Regis 1500
mtu INSIDE 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network inside-subnet
nat (INSIDE,OUTSIDE) dynamic interface
route OUTSIDE 0.0.0.0 0.0.0.0 10.19.130.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 123
type echo protocol ipIcmpEcho 8.8.8.8 interface FIBER
num-packets 4
frequency 15
sla monitor schedule 123 life forever start-time now
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
!
track 1 rtr 123 reachability
telnet 192.168.220.0 255.255.255.0 INSIDE
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.220.100-192.168.220.150 INSIDE
dhcpd enable INSIDE
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption aes256-sha1
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic 
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
 Cryptochecksum:1bf8d350a86639071a01cf5ee2782a42