免费注册 查看新帖 |

Chinaunix

  平台 论坛 博客 文库
最近访问板块 发新帖
查看: 4036 | 回复: 2

求助!CISCO ASA5510防火墙配置出问题 [复制链接]

论坛徽章:
0
发表于 2009-01-09 17:04 |显示全部楼层
10可用积分
请高手,看看配置是那里出问题了

故障现象:
1.做映射内部服务器后,内部服务器外面只有在外网接口同一网段的pc可以直接访问服务器,超过外网接口网段其它的网段服务器不能访问.
2.映射内部服务器后,内部服务部不能通过NAT上网.取消映射后,可以上网.
3.非映射内部服务器地址,是可以上网的.
4.需要将内部服务器上网也固定转换成相应的固定外网上地址,不同时使用接口地址.

确认:1.路由正常,从防火墙PING其它外网地址正常.
     2.动态地址转换正常.



: Saved
: Written by enable_15 at 01:11:40.412 UTC Tue Jan 6 2009
!
ASA Version 7.0(
!
hostname ciscoasa
domain-name default.domain.invalid

names
dns-guard
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 61.X.X.215 255.255.255.128
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.255.1 255.255.255.0
management-only
!
ftp mode passive
access-list in-server extended permit icmp any any
access-list in-server extended permit ip any interface outside
access-list in-server extended permit ip any host 61.X.X.210
access-list in-server extended permit tcp any host 61.X.X.202 eq 3389
access-list in-server extended permit tcp any host 61.X.X.203 eq www
access-list in-server extended permit tcp any host 61.X.X.203 eq 32822
access-list in-server extended permit tcp any host 61.X.X.204 eq 32822
access-list in-server extended permit tcp any host 61.X.X.204 eq www
access-list in-server extended permit tcp any host 61.X.X.205 eq 3389
access-list in-server extended permit tcp any host 61.X.X.205 range ftp ftp-data
access-list in-server extended permit ip 192.168.1.0 255.255.255.0 any
access-list in-server extended permit ip 192.168.255.0 255.255.255.0 any
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0
static (inside,outside) 61.X.X.202 192.168.1.16 netmask 255.255.255.255
static (inside,outside) 61.X.X.203 192.168.1.223 netmask 255.255.255.255
static (inside,outside) 61.X.X.204 192.168.1.222 netmask 255.255.255.255
static (inside,outside) 61.X.X.205 192.168.1.18 netmask 255.255.255.255
static (inside,outside) 61.X.X.210 192.168.1.11 netmask 255.255.255.255
access-group in-server in interface outside
route outside 0.0.0.0 0.0.0.0 61.X.X.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username admin password 0jkspvKJRufzZo6i encrypted privilege 15
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.255.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
console timeout 0
management-access inside
dhcpd address 192.168.1.2-192.168.1.254 inside
dhcpd address 192.168.255.2-192.168.255.254 management
dhcpd dns 61.128.128.68 61.128.192.68
dhcpd lease 691200
dhcpd ping_timeout 50
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:cbce023c45a1024defce18bd44ceddd9
: end

论坛徽章:
0
发表于 2009-01-12 11:14 |显示全部楼层
帮你顶一下,貌似版主们已经有N久没有来过了,也没有高手主动转出来申请版主

论坛徽章:
0
发表于 2009-01-15 15:37 |显示全部楼层

已解决

是因为防火墙外网接口接外网路由器做IP地址绑定引起,
您需要登录后才可以回帖 登录 | 注册

本版积分规则 发表回复

  

北京盛拓优讯信息技术有限公司. 版权所有 京ICP备16024965号-6 北京市公安局海淀分局网监中心备案编号:11010802020122 niuxiaotong@pcpop.com 17352615567
未成年举报专区
中国互联网协会会员  联系我们:huangweiwei@itpub.net
感谢所有关心和支持过ChinaUnix的朋友们 转载本站内容请注明原作者名及出处

清除 Cookies - ChinaUnix - Archiver - WAP - TOP