【正文】 config)accessgroup list_name in/out interface interface_namein/out:調(diào)用接口的入與出口向interface_name：調(diào)用控制列表的接口名例句1：ciscoasa(config) accesslist 400 extended deny udp eq 80 ciscoasa(config)accessgroup 400 in interface inside六 ASA防火墻工作狀態(tài)調(diào)試 查看當(dāng)前ASA配置 Ciscoasa show runningconfig 查看CPU得用率：show cpu usage(正常應(yīng)該在80%以下)內(nèi)存使用：Ciscoasashow memoryXlate 表大小Ciscoasashow conn count端口狀態(tài)Ciscoasashow interface interface_name 驗證防火墻的連接性 Ping Ciscoasaping ip_address(ip地址)查看路由表Ciscoasashow routeASA防火墻ACL檢查Ciscoasashow accesslistCISCO ASA具體配置如下：: Saved: Written by enable_15 at 01:00: UTC Tue Sep 21 2010!ASA Version (1) !hostname wyasazlzzxenable password kt7r2AarZ0QwX7lH encryptedpasswd PLBb27eKLE1o9FTB encryptednames!interface Ethernet0/0 nameif outside securitylevel 0 ip address .*.* !interface Ethernet0/1 nameif inside securitylevel 100 ip address !interface Ethernet0/2 shutdown no nameif no securitylevel no ip address!interface Ethernet0/3 shutdown no nameif no securitylevel no ip address!interface Management0/0 shutdown nameif management securitylevel 100 ip address managementonly!ftp mode passivesamesecuritytraffic permit interinterfaceaccesslist 100 extended permit tcp any host .*.* eq accesslist 100 extended permit tcp any host .*.* eq 81 accesslist 100 extended permit tcp any host .*.* eq 88 accesslist 100 extended permit tcp any host .*.* eq 230 accesslist 100 extended permit tcp any host .*.* eq 8888 accesslist 100 extended permit tcp any host .*.* eq 85 accesslist 100 extended permit tcp any host .*.* eq 6060 accesslist 100 extended permit tcp any host .*.* eq 5070 accesslist 100 extended permit tcp any host .*.* eq 6080 accesslist 100 extended permit tcp any host .*.* eq 10000 accesslist 100 extended permit tcp any host .*.* eq 231 accesslist 100 extended permit tcp any host .*.* eq 1433 accesslist 100 extended permit tcp any host .*.* eq 9000 accesslist 100 extended permit tcp any host .*.* eq 84 accesslist 100 extended permit tcp any host .*.* eq 10020 accesslist 100 extended permit tcp any host .*.* eq 10040 accesslist 100 extended permit tcp any host .*.* eq 87 accesslist 100 extended permit tcp any host .*.* eq 10101 accesslist 100 extended permit udp any host .*.*