- 论坛徽章:
- 0
|
10可用积分
请高手,看看配置是那里出问题了
故障现象:
1.做映射内部服务器后,内部服务器外面只有在外网接口同一网段的pc可以直接访问服务器,超过外网接口网段其它的网段服务器不能访问.
2.映射内部服务器后,内部服务部不能通过NAT上网.取消映射后,可以上网.
3.非映射内部服务器地址,是可以上网的.
4.需要将内部服务器上网也固定转换成相应的固定外网上地址,不同时使用接口地址.
确认:1.路由正常,从防火墙PING其它外网地址正常.
2.动态地址转换正常.
: Saved
: Written by enable_15 at 01:11:40.412 UTC Tue Jan 6 2009
!
ASA Version 7.0(
!
hostname ciscoasa
domain-name default.domain.invalid
names
dns-guard
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 61.X.X.215 255.255.255.128
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.255.1 255.255.255.0
management-only
!
ftp mode passive
access-list in-server extended permit icmp any any
access-list in-server extended permit ip any interface outside
access-list in-server extended permit ip any host 61.X.X.210
access-list in-server extended permit tcp any host 61.X.X.202 eq 3389
access-list in-server extended permit tcp any host 61.X.X.203 eq www
access-list in-server extended permit tcp any host 61.X.X.203 eq 32822
access-list in-server extended permit tcp any host 61.X.X.204 eq 32822
access-list in-server extended permit tcp any host 61.X.X.204 eq www
access-list in-server extended permit tcp any host 61.X.X.205 eq 3389
access-list in-server extended permit tcp any host 61.X.X.205 range ftp ftp-data
access-list in-server extended permit ip 192.168.1.0 255.255.255.0 any
access-list in-server extended permit ip 192.168.255.0 255.255.255.0 any
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0
static (inside,outside) 61.X.X.202 192.168.1.16 netmask 255.255.255.255
static (inside,outside) 61.X.X.203 192.168.1.223 netmask 255.255.255.255
static (inside,outside) 61.X.X.204 192.168.1.222 netmask 255.255.255.255
static (inside,outside) 61.X.X.205 192.168.1.18 netmask 255.255.255.255
static (inside,outside) 61.X.X.210 192.168.1.11 netmask 255.255.255.255
access-group in-server in interface outside
route outside 0.0.0.0 0.0.0.0 61.X.X.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username admin password 0jkspvKJRufzZo6i encrypted privilege 15
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.255.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
console timeout 0
management-access inside
dhcpd address 192.168.1.2-192.168.1.254 inside
dhcpd address 192.168.255.2-192.168.255.254 management
dhcpd dns 61.128.128.68 61.128.192.68
dhcpd lease 691200
dhcpd ping_timeout 50
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
Cryptochecksum:cbce023c45a1024defce18bd44ceddd9
: end |
|