我有一个 Cisco ASA 5515，我的配置如下：
ASA Version 9.2(2)4
hostname ciscoasa
enable password ********* encrypted
names
!
interface GigabitEthernet0/0
nameif Public-IP
security-level 0
ip address 202.67.23.37 255.255.255.0
!
interface GigabitEthernet0/1
nameif CC-Camera
security-level 50
ip address 10.10.20.1 255.255.255.0
!
interface GigabitEthernet0/2
nameif Computer-Lab
security-level 90
ip address 10.10.21.1 255.255.255.0
!
interface GigabitEthernet0/3
nameif Private-LAN
security-level 100
ip address 10.10.22.1 255.255.255.0
!
interface GigabitEthernet0/4
nameif Wireless
security-level 80
ip address 10.10.23.1 255.255.255.0
!
interface GigabitEthernet0/5
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
management-only
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
!
boot system disk0:/asa922-4-smp-k8.bin
ftp mode passive
object network CC-Camera-subnet
subnet 10.10.20.0 255.255.255.0
object network Computer-Lab
subnet 10.10.21.0 255.255.255.0
object network Private-LAN
subnet 10.10.22.0 255.255.255.0
object network Wireless
subnet 10.10.23.0 255.255.255.0
!
object network CC-Camera-subnet
nat (CC-Camera,Public-IP) dynamic interface
object network Computer-Lab
nat (Computer-Lab,Public-IP) dynamic interface
object network Private-LAN
nat (Private-LAN,Public-IP) dynamic interface
object network Wireless
nat (Wireless,Public-IP) dynamic interface
access-group Public-IP_access_in in interface Public-IP
access-group CC-Camera_access_in in interface CC-Camera
route Public-IP 0.0.0.0 0.0.0.0 x.x.x.x
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
!
class-map inspection_default
match default-inspection-traffic
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
我的问题如下：
我的客户希望阻止 Facebook、YouTube、种子等。我怎样才能使用 ASDM 做到这一点？
ciscoasa(config)# sh module
Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
0 ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC ASA5515 FCH200571ES
ips Unknown N/A FCH200571ES
cxsc Unknown N/A FCH200571ES
sfr FirePOWER Services Software Module ASA5515 FCH200571ES
Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
0 00c8.8bd3.9f63 to 00c8.8bd3.9f6a 1.0 2.1(9)8 9.2(2)4
ips 00c8.8bd3.9f61 to 00c8.8bd3.9f61 N/A N/A
cxsc 00c8.8bd3.9f61 to 00c8.8bd3.9f61 N/A N/A
sfr 00c8.8bd3.9f61 to 00c8.8bd3.9f61 N/A N/A 5.3.1-152
Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
ips Unknown No Image Present Not Applicable
cxsc Unknown No Image Present Not Applicable
sfr ASA FirePOWER Up 5.3.1-152
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
0 Up Sys Not Applicable
ips Unresponsive Not Applicable
<--- More --->
cxsc Unresponsive Not Applicable
sfr Up Up
Mod License Name License Status Time Remaining
---- -------------- --------------- ---------------
ips IPS Module Disabled perpetual
由于火力模块状态上升，我希望我们可以阻止某些网站，但我看不到这样做的选项。
