0
点赞
收藏
分享

微信扫一扫

cisco防火墙ASA配置NAT

实验拓扑

cisco防火墙ASA配置NAT_ip地址

配置IP地址

IOU1

IOU1(config)#in eth 0/0                              
IOU1(config-if)#ip address 200.1.1.2 255.255.255.0
IOU1(config-if)# no shu
IOU1(config-if)#duplex full
IOU1(config-if)#ex
IOU1(config)#in loo0
IOU1(config-if)#ip address 218.85.152.99 255.255.255.255
IOU1(config-if)#ex

IOU2

IOU2(config)#int eth 0/0
IOU2(config-if)#duplex full
IOU2(config)#int eth 0/0
IOU2(config-if)#ip address 192.168.0.11 255.255.255.0
IOU2(config-if)#no shu
IOU2(config-if)#ex
IOU2(config)#in loo0
IOU2(config-if)#ip address 192.168.1.11 255.255.255.255
IOU2(config-if)#ex
IOU2(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254
IOU2(config)#end

IOU3

IOU3(config)#int eth 0/0
IOU3(config-if)#duplex full
IOU3(config-if)#ex
IOU3(config)#int eth 0/0
IOU3(config-if)#ip address 172.16.1.1 255.255.255.0
IOU3(config-if)#no shu
IOU3(config-if)#ex
IOU3(config)#int loo0
IOU3(config-if)#ip address 172.16.88.11 255.255.255.255
IOU3(config-if)#ex
IOU3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254
IOU3(config)#end

ASA

asa(config)# int g 0
asa(config-if)# nameif outside
asa(config-if)# security-level 0
asa(config-if)# ip address 200.1.1.1 255.255.255.0
asa(config-if)# no shu
asa(config-if)# ex
asa(config)# int g 1
asa(config-if)# nameif dmz
asa(config-if)# security-level 50
asa(config-if)# ip address 192.168.0.254 255.255.255.0
asa(config-if)# no shu
asa(config-if)# ex
asa(config)# int g 2
asa(config-if)# nameif inside
asa(config-if)# ip address 172.16.1.254 255.255.255.0
asa(config-if)# no shu
asa(config-if)# ex
asa(config)# route outside 0 0 200.1.1.2
asa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11
asa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1
asa(config)# exit


查看地址

cisco防火墙ASA配置NAT_内网_02


配置动态nat

asa(config)#  object network out-pool
asa(config-network-object)# range 200.1.1.10 200.1.1.20
asa(config-network-object)# exit
asa(config)# object network in-ld
asa(config-network-object)# subnet 172.16.88.0 255.255.255.0
asa(config-network-object)# exit
asa(config)# object network in-xd
asa(config-network-object)# subnet 172.16.1.0 255.255.255.0
asa(config-network-object)# exit
asa(config)# object network dmz-1
asa(config-network-object)# subnet 192.168.0.0 255.255.255.0
asa(config-network-object)# exit
asa(config)# object network dmz-2
asa(config-network-object)# subnet 192.168.1.0 255.255.255.0
asa(config-network-object)# exit
asa(config)# object-group network in-lan
asa(config-network-object-group)# network-object object in-ld
asa(config-network-object-group)# network-object object in-xd
asa(config-network-object-group)# exit
asa(config)# object-group network dmz-lan
asa(config-network-object-group)# network-object object dmz-1
asa(config-network-object-group)# network-object object dmz-2
asa(config-network-object-group)# exit
asa(config)# nat (inside,outside) source dynamic in-lan out-pool
asa(config)# nat (dmz,outside) source dynamic dmz-lan out-pool

IOU1配置远程访问

IOU1(config)#username cisco privilege 15 password cisco
IOU1(config)#line vty 0 4
IOU1(config-line)#login local
IOU1(config-line)#transport input telnet
IOU1(config-line)#exit

测试telnat

cisco防火墙ASA配置NAT_ip地址_03

配置pat,多内网架构,多个网段,多个zone,直连外网接口 //先删除这两条命令在配置新命令

asa(config)# no nat (inside,outside) source dynamic in-lan out-pool                  
asa(config)# no nat (dmz,outside) source dynamic dmz-lan out-pool
asa(config)# nat (dmz,outside) source dynamic in-lan interface 
asa(config)# nat (dmz,outside) source dynamic dmz-lan interface

测试

cisco防火墙ASA配置NAT_ip地址_04

举报

相关推荐

0 条评论