CISCO ASA 5520 端口映射问题!!

末路狂奔

正常....

puding

可以用ASA抓包，看看是啥情况
capture cap1 access-list to_inside  interface outside

show capture cap1 detail

末路狂奔

3 packets captured
   1: 19:04:17.380671 00d0.0449.cc0a 0021.554f.2f74 0x0800 62: 111.111.185.226.12568 > 222.222.59.124.3389: S [tcp sum ok] 611720983:611720983(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 120, id 28491)
   2: 19:04:20.330869 00d0.0449.cc0a 0021.554f.2f74 0x0800 62: 111.111.185.226.12568 > 222.222.59.124.3389: S [tcp sum ok] 611720983:611720983(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 120, id 28500)
   3: 19:04:26.365123 00d0.0449.cc0a 0021.554f.2f74 0x0800 62: 111.111.185.226.12568 > 222.222.59.124.3389: S [tcp sum ok] 611720983:611720983(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 120, id 28513)
3 packets shown

hjp0021

Open the port tcp 25 in order to allow the hosts from the outside (Internet) to access the mail server placed in the DMZ network.

The Static command maps the outside address 192.168.5.3 to the real DMZ address 172.16.1.3.

ciscoasa(config)#static (DMZ,Outside) 192.168.5.3 172.16.1.3
netmask 255.255.255.255
ciscoasa(config)#access-list 100 extended permit tcp
any host 192.168.5.3 eq 25
ciscoasa(config)#access-group 100 in interface outside
Open the HTTPS port traffic: Open the port tcp 443 in order to allow the hosts from the outside (Internet) to access the web server (secure) placed in the DMZ network.

ciscoasa(config)#static (DMZ,Outside) 192.168.5.5 172.16.1.5
netmask 255.255.255.255
ciscoasa(config)#access-list 100 extended permit tcp
any host 192.168.5.5  eq 443
ciscoasa(config)#access-group 100 in interface outside
Allow the DNS traffic: Open the port udp 53 in order to allow the hosts from the outside (Internet) to access the DNS server (secure) placed in the DMZ network.

ciscoasa(config)#static (DMZ,Outside) 192.168.5.4 172.16.1.4
netmask 255.255.255.255
ciscoasa(config)#access-list 100 extended permit udp
any host 192.168.5.4  eq 53
ciscoasa(config)#access-group 100 in interface outside

末路狂奔

老兄,你这个是6.X的方法!

puding

不知道了，看配置应该是没有问题的
7.0貌似3389的问题比较多，可以升级到8.0看看

末路狂奔

^_^...升到了8.0!!
昨天两家思科金牌售后的人都来了,4个人都没搞定...今天还要过来...

ssffzz1

不会吧！

你在内网的3389那个机器上抓包结果如何？能抓到外网过来的包吗？

末路狂奔

搞定了...配置没问题.是我内网的服务器的网关自己改成了IP地址...好奇怪哦....网关自己还会变吖?

puding