Basic configuration of ASA

Network Topology

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4B/F7/wKiom1Q2STWBG5RxAADqir0hadw389.jpg "Title =" 4.png" alt = "wkiom1q2stwbg5rxaadqir0hadw389.jpg"/>

Set dynamic pat on the ASA firewall so that the Intranet can access the Internet through a public address

The command is as follows:

Ciscoasa (config) # NAT (inside) 11900001.0 255.255.255.0

Ciscoasa (config) # global (outside) 1 Interface

 

Set static nat on the ASA firewall so that the client can access the web server in the DMZ region through a public address. You also need to set an ACL Policy to allow the client to access the DMZ region.

The command is as follows:

Ciscoasa (config) # static (DMZ, outside) 192.168.3.10 192.168.2.2

Ciscoasa (config) # access-list out_to_dmzpermit TCP any host 192.168.3.10 EQ 80

Ciscoasa (config) # access-group out_to_dmzin interface outside

 

Static Pat is similar to dynamic Nat, but static Pat allows specifying TCP or UDP ports for real and ing addresses

Command (use static pat to publish the DMZ Web site)

Ciscoasa (config) # static (DMZ, outside) tcp192.168.3.1 htt 192.168.2.2 HTTP

 

Note: Do not write static Pat after writing static Nat; otherwise, an error is reported.

 

This command is used to view the NAT translation table.

Ciscoasa (config) # Show Xlate detail

 

 

ACL settings, such as setting up an FTP server and a DNS server on the Intranet. If you want to access the Internet, you need to set an ACL Policy.

Ciscoasa (config) # access-list out_to_dmzpermit TCP any host 192.168.2.2 EQ 21

Ciscoasa (config) # access-list out_to_dmzpermit UDP any host 192.168.2.2 EQ 53

Ciscoasa (config) # access-group out_to_dmzin interface outside

 

URL filtering

Create class-map to identify transmission traffic

Ciscoasa (config) # access-List 1 permit tcp192.168.1.0 limit 255.0 any EQ 80

Ciscoasa (config) # class-MAP 2

Ciscoasa (config-cmap) # match access-List 1

Ciscoasa (config) # RegEx urll "\. Baidu \. com"

// Filtered websites

Ciscoasa (config) # class-map type regexmatch-any 3

Ciscoasa (config-cmap) # match RegEx urll

Ciscoasa (config) # class-map type inspecthttp 4

// Inspect HTTP checks HTTP traffic

Ciscoasa (config-cmap) # match request headerhost RegEx Class 3

Create Policy-map and associate class-Map

Ciscoasa (config) # policy-map type inspecthttp 5

Ciscoasa (config-pmap) # Class 4

Ciscoasa (config-pmap-C) # Drop-connectionlog

// Close the link and send system logs

Ciscoasa (config) # policy-map 6

Ciscoasa (config-pmap) # Class 2

Ciscoasa (config-pmap-C) # inspect HTTP 5

// Check HTTP traffic

Apply Policy-map to the interface

Ciscoasa (config-pmap-C) # service-policy 6 interface inside

 

Configure remote access for the device:

Telnet access

Ciscoasa (config) # telnet 192.168.1.0255.255.255.0 inside

Configure Shh access

Ciscoasa (config) # domain-name asadomain.com

Ciscoasa (config) # crypto key generate rsamodulus 1024

Ciscoasa (config) # SSH 192.168.1.0255.255.255.0 inside

External interface introduction, 0 0 indicates any address can be connected

Ciscoasa (config) # SSH 0 0 outside

This article from the "plum blossom from bitter cold" blog, please be sure to keep this http://wangjunkang.blog.51cto.com/8809812/1561831

Basic configuration of ASA