cisco_asa5510_防火墻配置手冊(cè)(參考版)
2024-08-21 09:17本頁(yè)面
【正文】 ciscoasa(config)accesslist list_name standard deny/permit des_address netmask list_name:標(biāo)準(zhǔn)訪問(wèn)控制列表的名稱（199） deny/permit：阻止或是允許符合此條規(guī)則的流量 des_address ：需要做控制的目的地址 netmask:需要做控制的目的地址的掩碼ciscoasa(config)accessgroup list_name in/out interface interface_namein/out:標(biāo)準(zhǔn)訪問(wèn)控制列表的名稱interface_name:調(diào)用控制列表的接口名 擴(kuò)展訪問(wèn)控制列表ciscoasa(config)accesslist listname extended deny/permit tcp/udp sour_address sour_mask des_address des_mask eq port_numlistname:擴(kuò)展訪問(wèn)控制列表名稱deny/permit:拒絕/允許符合此條規(guī)則的流量tcp/udp：此條規(guī)則匹配的協(xié)議sour_address：此條規(guī)則匹配的源地址sour_mask：此條規(guī)則匹配的源地址掩碼des_address：此條規(guī)則匹配目的地址des_mask：此條規(guī)則匹配目的地址掩碼port_num：此條規(guī)則匹配的端口號(hào)ciscoasa(config)accessgroup list_name in/out interface interface_namein/out:調(diào)用接口的入與出口向interface_name：調(diào)用控制列表的接口名例句1：ciscoasa(config) accesslist 400 extended deny udp eq 80 ciscoasa(config)accessgroup 400 in interface inside六 ASA防火墻工作狀態(tài)調(diào)試 查看當(dāng)前ASA配置 Ciscoasa show runningconfig 查看CPU得用率：show cpu usage(正常應(yīng)該在80%以下)內(nèi)存使用：Ciscoasashow memoryXlate 表大小Ciscoasashow conn count端口狀態(tài)Ciscoasashow interface interface_name 驗(yàn)證防火墻的連接性 Ping Ciscoasaping ip_address(ip地址)查看路由表Ciscoasashow routeASA防火墻ACL檢查Ciscoasashow accesslistCISCO ASA具體配置如下：: Saved: Written by enable_15 at 01:00: UTC Tue Sep 21 2010!ASA Version (1) !hostname wyasazlzzxenable password kt7r2AarZ0QwX7lH encryptedpasswd PLBb27eKLE1o9FTB encryptednames!interface Ethernet0/0 nameif outside securitylevel 0 ip address .*.* !interface Ethernet0/1 nameif inside securitylevel 100 ip address !interface Ethernet0/2 shutdown no nameif no securitylevel no ip address!interface Ethernet0/3 shutdown no nameif no securitylevel no ip address!interface Management0/0 shutdown nameif management securitylevel 100 ip address managementonly!ftp mode passivesamesecuritytraffic permit interinterfaceaccesslist 100 extended permit tcp any host .*.* eq accesslist 100 extended permit tcp any host .*.* eq 81 accesslist 100 extended permit tcp any host .*.* eq 88 accesslist 100 extended permit tcp any host .*.* eq 230 accesslist 100 extended permit tcp any host .*.* eq 8888 accesslist 100 extended permit tcp any host .*.* eq 85 accesslist 100 extended permit tcp any host .*.* eq 6060 accesslist 100 extended permit tcp any host .*.* eq 5070 acce
環(huán)評(píng)公示相關(guān)推薦
鄂ICP備17016276號(hào)-1