【正文】 oute inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1route inside 1timeout xlate 3:00:00timeout conn 1:00:00 halfclosed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcppat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sipinvite 0:03:00 sipdisconnect 0:02:00timeout sipprovisionalmedia 0:02:00 uauth 0:05:00 absolutetimeout tcpproxyreassembly 0:01:00dynamicaccesspolicyrecord DfltAccessPolicy server enable managementno snmpserver locationno snmpserver contactsnmpserver enable traps snmp authentication linkup linkdown coldstartcrypto ipsec securityassociation lifetime seconds 28800crypto ipsec securityassociation lifetime kilobytes 4608000telnet insidetelnet timeout 5ssh timeout 5console timeout 0dhcpd address managementdhcpd enable management!threatdetection basicthreatthreatdetection statistics accesslistno threatdetection statistics tcpinterceptwebvpn!classmap inspection_default match defaultinspectiontraffic!!policymap global_policy class inspection_default inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp !servicepolicy global_policy globalprompt hostname context Cryptochecksum:8be70372fa840cf34638dc522883d306: end。Ciscoasa(config) nat (inside) 2 將此地址激活NATCiscoasa(config) global (outside) 2 .*.* .*.* PAT配置Ciscoasa(config)nat (inside) 3 將此地址激活NATCiscoasa(config)global (outside) 3 interface(這個是電信只提供了一個IP時可以這樣做，所有內(nèi)網(wǎng)共享一個IP上網(wǎng)) 什么時候要做端口映射 當(dāng)外網(wǎng)需要訪問內(nèi)網(wǎng)中的一臺服務(wù)器時，ASA并不知道訪問的是哪 一臺內(nèi)網(wǎng)中的機(jī)器，這時就需要做靜態(tài)的端口映射。CISCO ASA5510 防火墻配置手冊一． 密碼配置Ciscoasa(config)passwd 123 (用于telnet登陸ASA的密碼)Ciscoasa(config)enable password 456 (進(jìn)入enable特權(quán)模式的密碼)Ciscoasa(config)hostname wyciscoasa二． 接口配置Ciscoasa(config)interface Ethernet0/0Ciscoasa(configif)nameif outside 一般的情況將E0/0命為外網(wǎng)接口，而將E0/1命為內(nèi)網(wǎng)接口。Ciscoasa(config) nat (inside) 1 Ciscoasa(config) global (outside) 1 .*.* netmask *.