cisco_asa5510_防火墻配置手冊(cè)-預(yù)覽頁
【正文】 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1timeout xlate 3:00:00timeout conn 1:00:00 halfclosed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcppat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sipinvite 0:03:00 sipdisconnect 0:02:00timeout sipprovisionalmedia 0:02:00 uauth 0:05:00 absolutetimeout tcpproxyreassembly 0:01:00dynamicaccesspolicyrecord DfltAccessPolicy server enable managementno snmpserver locationno snmpserver contactsnmpserver enable traps snmp authentication linkup linkdown coldstartcrypto ipsec securityassociation lifetime seconds 28800crypto ipsec securityassociation lifetime kilobytes 4608000telnet insidetelnet timeout 5ssh timeout 5console timeout 0dhcpd address managementdhcpd enable management!threatdetection basicthreatthreatdetection statistics accesslistno threatdetection statistics tcpinterceptwebvpn!classmap inspection_default match defaultinspectiontraffic!!policymap global_policy class inspection_default inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp !servicepolicy global_policy globalprompt hostname context Cryptochecksum:8be70372fa840cf34638dc522883d306: end。 //后面的10000為限制連接數(shù)，10為限制的半開連接數(shù)。Ciscoasa(config)nat (inside) 2 將此地址激活NATCiscoasa(config)global 2 .*.* .*.* PAT配置Ciscoasa(config)nat (inside) 3 將此地址激活NATCiscoasa(config)global (outside) 3 interface(這個(gè)是電信只提供了一個(gè)IP時(shí)可以這樣做，所有內(nèi)網(wǎng)共享一個(gè)IP上網(wǎng)) 什么時(shí)候要做端口映射 當(dāng)外網(wǎng)需要訪問內(nèi)網(wǎng)中的一臺(tái)服務(wù)器時(shí)，ASA并不知道訪問的是哪 一臺(tái)內(nèi)網(wǎng)中的機(jī)器，這時(shí)就需要做靜態(tài)的端口映射。內(nèi)部所有網(wǎng)絡(luò)均可以共享一個(gè)合法外部IP地址實(shí)現(xiàn)對(duì)intelnet的訪問，從而可以最大限度節(jié)約IP地址資源。CISCO ASA5510 防火墻配置手冊(cè)一． 密碼配置Ciscoasa(config)passwd 123 (用于telnet登陸ASA的密碼)Ciscoasa(config)enable password 456 (進(jìn)入enable特權(quán)模式的密碼)Ciscoasa(config)hostname wyciscoasa二． 接口配置Ciscoasa(config)interface Ethernet0/0Ciscoasa(configif)nameif outside 一般的情況將E0/0命為外網(wǎng)接口，而將E0/1命為內(nèi)網(wǎng)接口。PAT：指改變外出數(shù)據(jù)包的源端口并進(jìn)行端口轉(zhuǎn)換。Ciscoasa(config)nat (inside) 1 Ciscoasa(config)global(outside) 1 .*.* netmask *.*的地址。 16
環(huán)評(píng)公示相關(guān)推薦
鄂ICP備17016276號(hào)-1