《CISCO5520配置手册.doc》由会员分享，可在线阅读，更多相关《CISCO5520配置手册.doc（9页珍藏版）》请在taowenge.com淘文阁网|工程机械CAD图纸|机械工程制图|CAD装配图下载|SolidWorks_CaTia_CAD_UG_PROE_设计图分享下载上搜索。
1、-作者xxxx-日期xxxxCISCO5520配置手册【精品文档】CD-ASA5520# show run: Saved:ASA Version 7.2(2) !hostname CD-ASA5520 /定义工作域 enable password 9jNfZuG3TC5tCVH0 encrypted / 进入特权模式的密码 namesdns-guard!interface GigabitEthernet0/0 /内网接口：duplex full /接口作工模式：全双工，半双，自适应 nameif inside /为端口命名 ：内部接口insidesecurity-level 100 /设置本端
2、口的IP地址!interface GigabitEthernet0/1 /外网接口nameif outside /为外部端口命名 ：外部接口outsidesecurity-level 0ip address 202.98.131.122 255.255.255.0 /IP地址配置!interface GigabitEthernet0/2nameif dmzsecurity-level 50ip address 192.168.2.1 255.255.255.0 ! interface GigabitEthernet0/3shutdownno nameifno security-levelno
3、ip address!interface Management0/0 /防火墙管理地址shutdownno nameifno security-levelno ip address!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passive clock timezone CST 8dns server-group DefaultDNSdomain-name default.domain.invalidaccess-list outside_permit extended permit tcp any interface outside eq 3389 /
4、访问控制列表access-list outside_permit extended permit tcp any interface outside range 30000 30010 /允许外部任何用户可以访问outside 接口的30000-30010的端口。pager lines 24logging enable /启动日志功能logging asdm informationalmtu inside 1500 内部最大传输单元为1500字节mtu outside 1500mtu dmz 1500ip local pool vpnclient 192.168.200.1-192.168.2
5、00.200 mask 255.255.255.0/定义一个命名为vpnclient的IP地址池,为remote用户分配IP地址no failovericmp unreachable rate-limit 1 burst-size 1asdm image disk0:/asdm-522.binno asdm history enablearp timeout 14400 /arp空闲时间为14400秒 global (outside) 1 interface /由于没有配置NAT 故这里是不允许内部用户上INTERNETstatic (dmz,outside) tcp interface 30
6、000 192.168.2.2 30000 netmask 255.255.255.255 /端口映射 可以解决内部要公布的服务太多，而申请公网IP少问题。static (dmz,outside) tcp interface 30001 192.168.2.2 30001 netmask 255.255.255.255 /把dmz区192.168.2.2 30002 映射给外部30002端口上。static (dmz,outside) tcp interface 30002 192.168.2.2 30002 netmask 255.255.255.255 static (dmz,outsid
7、e) tcp interface 30003 192.168.2.2 30003 netmask 255.255.255.255 static (dmz,outside) tcp interface 30004 192.168.2.2 30004 netmask 255.255.255.255 static (dmz,outside) tcp interface 30005 192.168.2.2 30005 netmask 255.255.255.255 static (dmz,outside) tcp interface 30006 192.168.2.2 30006 netmask 25
8、5.255.255.255 static (dmz,outside) tcp interface 30007 192.168.2.2 30007 netmask 255.255.255.255 static (dmz,outside) tcp interface 30008 192.168.2.2 3008 netmask 255.255.255.255 static (dmz,outside) tcp interface 30009 192.168.2.2 30009 netmask 255.255.255.255 static (dmz,outside) tcp interface 300
9、10 192.168.2.2 30010 netmask 255.255.255.255 static (dmz,outside) tcp interface 3389 192.168.2.2 3389 netmask 255.255.255.255 access-group outside_permit in interface outside /把outside_permit控制列表运用在外部接口的入口方向。route outside .0 0.0.0.0 202.98.131.126 1 /定义一个默认路由。timeout conn 1:00:00 half-closed 0:10:00
10、 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout uauth 0:05:00 absolute-定义一个命名为vpnclient的组策略-group-policy vpnclient internal /创建一个内部的组策略。 group-policy vpnclien
11、t attributes /定义WINS-SERVER 的IP地址。dns-server value 192.168.1.10 61.139.2.69 /定义dns-server的IP地址。vpn-idle-timeout none /终止连接时间设为默认值 vpn-session-timeout none /会话超时采用默认值vpn-tunnel-protocol IPSec /定义通道使用协议为IPSEC。split-tunnel-policy tunnelspecified /定义默认域名为-定义一个命名为l2lvpn的组策略-group-policy l2lvpn internal g
12、roup-policy l2lvpn attributeswins-server value 192.168.1.10dns-server value 192.168.1.10 61.139.2.69vpn-simultaneous-logins 3vpn-idle-timeout nonevpn-session-timeout nonevpn-tunnel-protocol IPSec username test password P4ttSyrm33SV8TYp encrypted privilege 0 /创建一个远程访问用户来访问安全应用username cisco password
13、3USUcOPFUiMCO4Jk encryptedhttp server enable /启动HTTP服务http 0.0.0.0 0.0.0.0 inside /允许内部主机HTTP连接no snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstart/snmp的默认配置crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac/配置转集（定义了IPSC隧道使用的加密和
14、信息完整性算法集合）crypto dynamic-map vpn_dyn_map 10 set transform-set ESP-DES-MD5 /为动态加密图条目定义传换集crypto map outside_map 10 ipsec-isakmp dynamic vpn_dyn_map /创建一个使用动态加密条目的加密图crypto map outside_map interface outside/将 outside_map加密图应用到outside端口-配置IKE-crypto isakmp enable outside /在ostside 接口启动ISAKMP crypto isa
15、kmp policy 20 /isakmmp权值，值越小权值越高authentication pre-share /指定同位体认证方法是共享密钥encryption des /指定加密算法hash md5 /指定使用MD5散列算法group 2 /指定diffie-hellman组2lifetime 86400 /指定SA（协商安全关联）的生存时间crypto isakmp policy 65535 authentication pre-shareencryption deshash md5group 2lifetime 86400-调用组策略-crypto isakmp nat-traver
16、sal 20 tunnel-group DefaultL2LGroup general-attributes /配置这个通道组的认证方法default-group-policy l2lvpn /指定默认组策略名称。tunnel-group DefaultL2LGroup ipsec-attributes /配置认证方法为IPSECpre-shared-key * /提供IKE连接的预共享密钥tunnel-group vpnclient type ipsec-ra /设置连接类型为远程访问。 tunnel-group vpnclient general-attributes /配置这个通道组的认
17、证方法address-pool vpnclient /定义所用的地址池default-group-policy vpnclient /定义默认组策略-设置认证方式和共享密钥-tunnel-group vpnclient ipsec-attributes /配置认证方法为IPSECpre-shared-key * /提供IKE连接的预共享密钥telnet timeout 5 /telnet 超时设置ssh 0.0.0.0 0.0.0.0 outside /允许外部通SSH访问防火墙ssh timeout 60 /SSH连接超时设置console timeout 0 /控制台超时设置 /dhcp
18、发布的DNS!dhcpd address 192.168.1.10-192.168.1.254 inside /向内网发布的地址池dhcpd enable inside /启动DHCP服务。!class-map inspection_defaultmatch default-inspection-traffic!policy-map type inspect dns migrated_dns_map_1parameters message-length maximum 512policy-map global_policy class inspection_defaultinspect dns
19、 migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp !service-policy global_policy globalprompt hostname context Cryptochecksum:25e66339116f52e4431
20、24a23fef3d373: end思科实战 cisco asa5520怎么配置就可以内网与外网互相通信补充资料asa5520(config)# show run: Saved:ASA Version 7.0(6)!hostname asa5520domain-name enable password 2745OAJS2l2oSQqc encryptednamesdns-guard!interface GigabitEthernet0/0nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0!interface G
21、igabitEthernet0/1nameif outsidesecurity-level 0ip address 202.100.10.1 255.255.255.0!interface GigabitEthernet0/2nameif dmzsecurity-level 50ip address 192.168.2.1 255.255.255.0!interface GigabitEthernet0/3shutdownno nameifno security-levelno ip address!interface Management0/0nameif guanlisecurity-le
22、vel 100ip address 192.168.3.10 255.255.255.0!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passiveaccess-list icmp_in extended permit icmp any anypager lines 24mtu inside 1500mtu outside 1500mtu dmz 1500mtu guanli 1500no failoverno asdm history enablearp timeout 14400global (outside) 1 interfacenat (ins
23、ide) 1 192.168.1.0 255.255.255.0static (inside,outside) 192.168.1.6 202.100.10.6 netmask 255.255.255.255access-group icmp_in in interface outsideroute outside 0.0.0.0 0.0.0.0 202.100.10.1 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h3
24、23 0:05:00 h225 1:00:00 mgcp 0:05:00timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absolutehttp server enablehttp 192.168.3.0 255.255.255.0 guanlino snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstarttelnet timeout 5ssh timeout 5console timeout 0Cryptochecksum:38cfab60ffa6873052f5a35134a278c6: end问题：1配置管理端口和IP地址后不能登录远程管理？ (10 KB)2010-9-27 21:522内部网络不能ping通内部网关，也就是inside的ip地址，Ping不通outside.3outside可以ping自己网关，但不能ping“inside”。【精品文档】