CD-ASA5520# show run
: Saved
:
ASA Version 7.2(2)
!
hostname CD-ASA5520 //給防火牆命名
domain-name default.domain.invalid //定義工作域
enable password 9jNfZuG3TC5tCVH0 encrypted // 進入特權模式的密碼
names
dns-guard
!
interface GigabitEthernet0/0 //內網接口：
duplex full //接口作工模式：全雙工，半雙，自適應
nameif inside //爲端口命名 ：內部接口inside
security-level 100 //設置安全級別 0~100 值越大越安全
ip address 192.168.1.1 255.255.255.0 //設置本端口的IP地址
!
interface GigabitEthernet0/1 //外網接口
nameif outside //爲外部端口命名 ：外部接口outside
security-level 0
ip address 202.98.131.122 255.255.255.0 //IP地址配置
!
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 192.168.2.1 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0 //防火牆管理地址
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone CST 8
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list outside_permit extended permit tcp any interface outside eq 3389
//訪問控制列表
access-list outside_permit extended permit tcp any interface outside range 30000 30010
//允許外部任何用戶可以訪問outside 接口的30000-30010的端口。
pager lines 24
logging enable //啓動日誌功能
logging asdm informational
mtu inside 1500 內部最大傳輸單元爲1500字節
mtu outside 1500
mtu dmz 1500
ip local pool ***client 192.168.200.1-192.168.200.200 mask 255.255.255.0
//定義一個命名爲***client的IP地址池,爲remote用戶分配IP地址
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm p_w_picpath disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400 //arp空閒時間爲14400秒
global (outside) 1 interface //由於沒有配置NAT 故這裏是不允許內部用戶上INTERNET
static (dmz,outside) tcp interface 30000 192.168.2.2 30000 netmask 255.255.255.255
//端口映射 可以解決內部要公佈的服務太多，而申請公網IP少問題。
static (dmz,outside) tcp interface 30001 192.168.2.2 30001 netmask 255.255.255.255
//把dmz區192.168.2.2 30002 映射給外部30002端口上。
static (dmz,outside) tcp interface 30002 192.168.2.2 30002 netmask 255.255.255.255
static (dmz,outside) tcp interface 30003 192.168.2.2 30003 netmask 255.255.255.255
static (dmz,outside) tcp interface 30004 192.168.2.2 30004 netmask 255.255.255.255
static (dmz,outside) tcp interface 30005 192.168.2.2 30005 netmask 255.255.255.255
static (dmz,outside) tcp interface 30006 192.168.2.2 30006 netmask 255.255.255.255
static (dmz,outside) tcp interface 30007 192.168.2.2 30007 netmask 255.255.255.255
static (dmz,outside) tcp interface 30008 192.168.2.2 3008 netmask 255.255.255.255
static (dmz,outside) tcp interface 30009 192.168.2.2 30009 netmask 255.255.255.255
static (dmz,outside) tcp interface 30010 192.168.2.2 30010 netmask 255.255.255.255
static (dmz,outside) tcp interface 3389 192.168.2.2 3389 netmask 255.255.255.255
access-group outside_permit in interface outside
//把outside_permit控制列表運用在外部接口的入口方向。
route outside 0.0.0.0 0.0.0.0 202.98.131.126 1 //定義一個默認路由。
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
------------定義一個命名爲***client的組策略-------------------------
group-policy ***client internal //創建一個內部的組策略。
group-policy ***client attributes //設置***client組策略的參數
wins-server value 192.168.1.10 //定義WINS-SERVER 的IP地址。
dns-server value 192.168.1.10 61.139.2.69 //定義dns-server的IP地址。
***-idle-timeout none //終止連接時間設爲默認值
***-session-timeout none //會話超時採用默認值
***-tunnel-protocol IPSec //定義通道使用協議爲IPSEC。
split-tunnel-policy tunnelspecified //定義。
default-domain value cisco.com //定義默認域名爲cisco.com
------------定義一個命名爲l2l***的組策略-------------------------
group-policy l2l*** internal
group-policy l2l*** attributes
wins-server value 192.168.1.10
dns-server value 192.168.1.10 61.139.2.69
***-simultaneous-logins 3
***-idle-timeout none
***-session-timeout none
***-tunnel-protocol IPSec
username test password P4ttSyrm33SV8TYp encrypted privilege 0
//創建一個遠程訪問用戶來訪問安全應用
username cisco password 3USUcOPFUiMCO4Jk encrypted
http server enable //啓動HTTP服務
http 0.0.0.0 0.0.0.0 inside //允許內部主機HTTP連接
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
//snmp的默認配置
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
//配置轉集（定義了IPSC隧道使用的加密和信息完整性算法集合）
crypto dynamic-map ***_dyn_map 10 set transform-set ESP-DES-MD5
//爲動態加密圖條目定義傳換集
crypto map outside_map 10 ipsec-isakmp dynamic ***_dyn_map
//創建一個使用動態加密條目的加密圖
crypto map outside_map interface outside
//將 outside_map加密圖應用到outside端口
------------配置IKE--------------
crypto isakmp enable outside //在ostside 接口啓動ISAKMP
crypto isakmp policy 20 //isakmmp權值，值越小權值越高
authentication pre-share //指定同位體認證方法是共享密鑰
encryption des //指定加密算法
hash md5 //指定使用MD5散列算法
group 2 //指定diffie-hellman組2
lifetime 86400 //指定SA（協商安全關聯）的生存時間
crypto isakmp policy 65535
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
-------------調用組策略-----------------
crypto isakmp nat-traversal 20
tunnel-group DefaultL2LGroup general-attributes //配置這個通道組的認證方法
default-group-policy l2l*** //指定默認組策略名稱。
tunnel-group DefaultL2LGroup ipsec-attributes //配置認證方法爲IPSEC
pre-shared-key * //提供IKE連接的預共享密鑰
tunnel-group ***client type ipsec-ra //設置連接類型爲遠程訪問。
tunnel-group ***client general-attributes //配置這個通道組的認證方法
address-pool ***client //定義所用的地址池
default-group-policy ***client //定義默認組策略
-----設置認證方式和共享密鑰-------------
tunnel-group ***client ipsec-attributes //配置認證方法爲IPSEC
pre-shared-key * //提供IKE連接的預共享密鑰
telnet timeout 5 //telnet 超時設置
ssh 0.0.0.0 0.0.0.0 outside //允許外部通SSH訪問防火牆
ssh timeout 60 //SSH連接超時設置
console timeout 0 //控制檯超時設置
dhcp-client update dns server both
dhcpd dns 61.139.2.69 202.98.96.68 //dhcp 發佈的DNS
!
dhcpd address 192.168.1.10-192.168.1.254 inside //向內網發佈的地址池
dhcpd enable inside //啓動DHCP服務。
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:25e66339116f52e443124a23fef3d373
: end