思考防火墙ASA配置NAT

实验拓扑图

地址如图所示

实验步骤

1.配置地址

IOU1

IOU1(config)#interface ethernet 0/0
IOU1(config-if)#duplex full 
IOU1(config-if)#ip address 200.1.1.2 255.255.255.0
IOU1(config-if)#no shutdown
IOU1(config-if)#exit
IOU1(config)#interface loopback 0
IOU1(config-if)#ip address 218.85.152.99 255.255.255.255
IOU1(config-if)#exit

IOU2

IOU2(config)#interface ethernet 0/0
IOU2(config-if)#duplex full 
IOU2(config-if)#ip address 192.168.0.11 255.255.255.0
IOU2(config-if)#no shutdown
IOU2(config-if)#exit
IOU2(config)#interface loopback 0
IOU2(config-if)#ip address 192.168.1.11 255.255.255.255
IOU2(config-if)#exit
IOU2(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254
IOU2(config)#exit

IOU3

IOU3(config)#interface ethernet 0/0
IOU3(config-if)#duplex full 
IOU3(config-if)#ip address 172.16.1.1 255.255.255.0
IOU3(config-if)#no shutdown
IOU3(config-if)#exit 
IOU3(config)#interface loopback 0
IOU3(config-if)#ip address 172.16.88.11 255.255.255.255
IOU3(config-if)#exit       
IOU3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254

ASA

ciscoasa(config)# interface gigabitEthernet 0
ciscoasa(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# ip address 200.1.1.1 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# interface gigabitEthernet 1
ciscoasa(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by default.
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# ip address 192.168.0.254 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# interface gigabitEthernet 2
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 172.16.1.254 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# route outside 0 0 200.1.1.2
ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11
ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1
ciscoasa(config)# exit

查看地址配置

查看路由

配置动态NAT

ASA

ASA(config)# object network out-pool                     
ASA(config-network-object)# range 200.1.1.10 200.1.1.20
ASA(config-network-object)# exit
ASA(config)# object network in-ld
ASA(config-network-object)# subnet 172.16.88.0 255.255.255.0
ASA(config-network-object)# exit
ASA(config)# object network in-kd
ASA(config-network-object)# subnet 172.16.1.0 255.255.255.0
ASA(config-network-object)# exit
ASA(config)# object network dmz-l
ASA(config-network-object)# subnet 192.168.0.0 255.255.255.0
ASA(config-network-object)# exit
ASA(config)# object network dmz-2
ASA(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA(config-network-object)# exit
ASA(config)# object-group network in-lan
ASA(config-network-object-group)# network-object object in-ld
ASA(config-network-object-group)# network-object object in-xd
ASA(config-network-object-group)# exit
ASA(config)# object-group network dmz-lan   
ASA(config-network-object-group)# network-object object dmz-1
ASA(config-network-object-group)# network-object object dmz-2
ASA(config-network-object-group)# exit
ASA(config)# 
ASA(config)# nat (inside,outside) source dynamic in-lan out-pool
ASA(config)# nat (dmz,outside) source dynamic dmz-lan out-pool

IOU1配置远程访问

IOU1(config)#username zhangsan privilege 15 password cisco
IOU1(config)#line vty 0 4
IOU1(config-line)#login local 
IOU1(config-line)#transport input telnet 
IOU1(config-line)#exit

测试

在ASA使用show xlate查看

在IOU1上使用show users查看

2.配置PAT，多内网架构，多个网段，多个zone，直接使用外网接口

ASA(config)# no nat (inside,outside) source dynamic in-lan out-pool
ASA(config)# no nat (dmz,outside) source dynamic dmz-lan out-pool

//先删除这两条命令再配置新命令

ASA(config)# nat (inside,outside) source dynamic in-lan interface 
ASA(config)# nat (dmz,outside) source dynamic dmz-lan interface

测试

在ASA使用show xlate查看