I. Testing the topology
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/73/38/wKioL1X38T-gdNFLAAB2SFv8Pow785.jpg "title=" top. JPG "alt=" Wkiol1x38t-gdnflaab2sfv8pow785.jpg "/>
Two. Test ideas
1. Test the continuous port Pat for TCP and UDP, respectively
2. Then use the static port conversion tool to convert the TCP port and UDP port to a common port for testing
---TCP conversion to TCP23, test with Telnet
---UDP conversion to UDP514, test with syslog send
3. For easy testing, the firewall only has two zones outside and inside
---Map the tcp1000~2000 of the inside server to the tcp1000~2000 of the firewall outside port
---Map the udp1000~2000 of the inside server to the upd2000~3000 of the firewall outside port
4. Test finds that if the TCP port range is the same as the UDP port range, the second NAT is not configured, and the following error is reported:
Error:nat Unable to reserve ports.
Three. Basic Configuration
1.Outside Server
Ip:202.100.1.8/24
2. Firewall ASA842
Interface GigabitEthernet0
Nameif Outside
Security-level 0
IP address 202.100.1.10 255.255.255.0
!
Interface GigabitEthernet1
Nameif Inside
Security-level 100
IP address 10.1.1.10 255.255.255.0
3.Intside Server
Ip:10.1.1.8/24
gw:10.1.1.10
Four. Static Pat Port range configuration
1. Defining a port Range object
Object Network Inside_server
Host 10.1.1.8
Object Service Tcp_ports
Service TCP Destination range 1000 2000
Object Service Udp_ports
Service UDP destination Range 2000 3000
2. Configure Twice-nat
Nat (Outside,inside) source static any any destination static interface Inside_server service Tcp_ports tcp_ports
Nat (Outside,inside) source static any any destination static interface Inside_server service Udp_ports udp_ports
3. Configure and apply a firewall policy
Access-list Outside Extended Permit TCP any object Inside_server range 1000 2000
Access-list Outside extended Permit UDP any object Inside_server range 2000 3000
Access-group Outside in Interface Outside
4. Test validation
---can be verified in a variety of ways, if the static port conversion is too cumbersome, can be directly caught packet verification
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/73/3B/wKiom1X371WjYC-zAAKKG3cPRyk111.jpg "title=" top. JPG "alt=" Wkiom1x371wjyc-zaakkg3cpryk111.jpg "/>
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/73/3B/wKiom1X375rBWB5FAAi4Hi0gI4M239.jpg "title=" top. JPG "alt=" Wkiom1x375rbwb5faai4hi0gi4m239.jpg "/>
This article is from the "Httpyuntianjxxll.spac.." Blog, make sure to keep this source http://333234.blog.51cto.com/323234/1695049
ASA firewall static PAT port range test