ASA配置笔记Word格式文档下载.docx

ASA配置笔记Word格式文档下载.docx

《ASA配置笔记Word格式文档下载.docx》由会员分享，可在线阅读，更多相关《ASA配置笔记Word格式文档下载.docx（15页珍藏版）》请在冰豆网上搜索。

failovermacaddressEthernet0/20018.1900.60000018.1900.6001

failovermacaddressManagement0/00018.1900.70000018.1900.7001

failoverinterfaceiptestint10.3.3.1255.255.255.0standby10.3.3.2

注：

最好配置虚拟MAC地址

shfailover显示配置信息

writestandby写入到备用的防火墙中

failover命令集如下：

configuremodecommands/options:

interfaceConfiguretheIPaddressandmasktobeusedforfailover

and/orstatefulupdateinformation

interface-policySetthepolicyforfailoverduetointerfacefailures

keyConfigurethefailoversharedsecretorkey

lanSpecifytheunitasprimaryorsecondaryorconfigurethe

interfaceandvlantobeusedforfailovercommunication

linkConfiguretheinterfaceandvlantobeusedasalinkfor

statefulupdateinformation

macSpecifythevirtualmacaddressforaphysicalinterface

polltimeConfigurefailoverpollinterval

replicationEnableHTTP（port80）connectionreplication

timeoutSpecifythefailoverreconnecttimeoutvaluefor

asymmetricallyroutedsessions

shfailover命令集如下：

historyShowfailoverswitchinghistory

interfaceShowfailovercommandinterfaceinformation

stateShowfailoverinternalstateinformation

statisticsShowfailovercommandinterfacestatisticsinformation

|Outputmodifiers

<

cr>

3.配置telnet、ssh及http管理

usernamejiangpasswordCsmep3VzvPQPCbkxencryptedprivilege15

aaaauthenticationenableconsoleLOCAL

aaaauthenticationtelnetconsoleLOCAL

aaaauthenticationsshconsoleLOCAL

aaaauthorizationcommandLOCAL

http192.168.40.0255.255.255.0management

ssh192.168.40.0255.255.255.0inside

4.vpn常用管理命令

shvpn-sessiondbfulll2l显示sitetosite之vpn通道情况

shipsecstats显示ipsec通道情况

shvpn-sessiondbsummary显示vpn汇总信息

shvpn-sessiondbdetaill2l显示ipsec详细信息

shvpn-sessiondbdetailsvc查看sslclient信息

shvpn-sessiondbdetailwebvpn查看webvpn信息

shvpn-sessiondbdetailfulll2l相当于linux下的ipsecwhack?

Cstatus如果没有建立连接，则表示ipsec通道还没有建立起来。

5.配置访问权限

可以建立对象组，设定不同的权限，如：

object-groupnetworktestgroup

descriptiontest

network-object192.168.100.34255.255.255.255

access-listinside_access_inline2extendedpermitipobject-groupallany

access-groupinside_access_inininterfaceinside

6.配置sitetosite之VPN

cryptoipsectransform-setESP-3DES-SHAesp-3desesp-sha-hmac

cryptomapoutside_map20matchaddressoutside_cryptomap_20_1

cryptomapoutside_map20setpfs

cryptomapoutside_map20setpeer218.16.105.48

cryptomapoutside_map20settransform-setESP-3DES-SHA

cryptomapoutside_mapinterfaceoutside

isakmpidentityaddress

isakmpenableoutside

isakmppolicy10authenticationpre-share

isakmppolicy10encryption3des

isakmppolicy10hashsha

isakmppolicy10group2

isakmppolicy10lifetime86400

tunnel-group218.16.105.48typeipsec-l2l

tunnel-group218.16.105.48ipsec-attributes

pre-shared-key*

peer-id-validatenocheck

tunnel-group-mapenablerules

打打PFS并设定以IP地址作为peer名，一个接口只能有一个加密图

7.webvpn配置（sslvpn）

webvpn

enableoutside

character-encodinggb2312

csdimagedisk0:

/securedesktop-asa-3.1.1.16.pkg

svcimagedisk0:

/sslclient-win-1.1.0.154.pkg1

svcenable

customizationcustomization1

titletextTESTWebVPNsystem

titlestylebackground-color:

white;

color:

rgb（51,153,0）;

border-bottom:

5pxgroo

ve#669999;

font-size:

larger;

vertical-align:

middle;

text-align:

left;

font-weight:

bold

tunnel-group-listenable

也可通过ASDM图形界面进行配置

登录后，可访问内部资源，如下例：

（客户端首先要安装Java插件jre-1_5_0-windows-i586.exe,并打开浏览器的ActiveX）

1）输入用户名和密码

2）出现工具条

3）在EnterWebAddress内输入192.168.40.8即可访问内部网站

4）在browsenetwork输入192.168.40.8即可访问共享文件

5）点击applicationaccess，即可查看端口转发设置，如使用putty访问本机的2023端口，则即可通过ssh登录192.168.40.8

8.远程拨入VPN

相关的ASA配置命令如下：

access-listinside_access_inextendedpermitipobject-groupremotegroupany

access-listinside_access_inextendedpermiticmpobject-groupremotegroupany

access-listremotevpn_splitTunnelAclstandardpermit192.168.100.0255.255.255.0

access-listvpnclient_splitTunnelAclstandardpermit192.168.100.0255.255.255.0

iplocalpooldialuserIP192.168.101.1-192.168.101.254mask255.255.255.0

group-policyremotevpnattributes

dns-servervalue202.96.128.68192.168.40.16

default-domainvalue

cryptoipsectransform-setESP-DES-MD5esp-desesp-md5-hmac

cryptoipsectransform-setESP-DES-SHAesp-desesp-sha-hmac

cryptodynamic-mapoutside_dyn_map20setpfs

cryptodynamic-mapoutside_dyn_map20settransform-setESP-3DES-SHA

cryptodynamic-mapoutside_dyn_map20setreverse-route

cryptomapoutside_map65535ipsec-isakmpdynamicoutside_dyn_map

tunnel-groupremotevpntypeipsec-ra

tunnel-groupremotevpngeneral-attributes

address-pooldialuserIP

default-group-policyremotevpn

tunnel-groupremotevpnipsec-attributes

客户端设置如下：

9.日志服务器配置

loggingenable

loggingtimestamp

loggingemblem

loggingtrapinformational

loggingasdmwarnings

logginghostinside192.168.40.115formatemblem

loggingpermit-hostdown

vpn-simultaneous-logins3

10.Snmp网管配置

snmp-serverhostinside192.168.40.47communitytestsnmp

snmp-serverlocationDG-GTEST

snmp-servercontactjiangdaoyou:

6162

snmp-servercommunitytestsnmp

snmp-serverenabletrapssnmpauthenticationlinkuplinkdowncoldstart

指定主机后，192.168.40.47才可能进行管理

11.ACS配置

安装后管理：

http:

//ip:

2002通过ACS可以进行授权、认证等等很多功能

因内容太多，暂省略

12.AAA配置

Aaa服务器配置：

aaa-serverradius_dghost

keydfdfdfdf146**U

authentication-port1812

accounting-port1813

radius-common-pwdfdfdfdf146**U

对于拨入vpn的配置

tunnel-groupvg_testerpgeneral-attributes

address-poolciscovpnuser

authentication-server-groupradius_dg

default-group-policyvg_testerp

13.升级IOS

copytftp:

//192.168.40.180/asa/asa721-k8.bindisk0:

/asa721-k8.bin

bootsystemdisk0:

/asa721-k8.bin（多个Image时使用）

interfaceVlan2

nameifoutside--------------------对端口命名外端口

security-level0--------------------设置端口等级

ipaddressX.X.X.X255.255.255.224--------------------调试外网地址

!

interfaceVlan3

nameifinside--------------------对端口命名内端口

security-level100--------------------调试外网地址

ipaddress192.168.1.1255.255.255.0--------------------设置端口等级

interfaceEthernet0/0

switchportaccessvlan2--------------------设置端口VLAN与VLAN2绑定

interfaceEthernet0/1

switchportaccessvlan3--------------------设置端口VLAN与VLAN3绑定

interfaceEthernet0/2

shutdown

interfaceEthernet0/3

interfaceEthernet0/4

interfaceEthernet0/5

interfaceEthernet0/6

interfaceEthernet0/7

passwd2KFQnbNIdI.2KYOUencrypted

ftpmodepassive

dnsdomain-lookupinside

dnsserver-groupDefaultDNS

name-server211.99.129.210

name-server202.106.196.115

access-list102extendedpermiticmpanyany------------------设置ACL列表（允许ICMP全部通过）

access-list102extendedpermitipanyany------------------设置ACL列表（允许所有IP全部通过）

pagerlines24

mtuoutside1500

mtuinside1500

icmpunreachablerate-limit1burst-size1

noasdmhistoryenable

arptimeout14400

global（outside）1interface------------------设置NAT地址映射到外网口

nat（inside）10.0.0.00.0.0.0------------------NAT地址池（所有地址）

access-group102ininterfaceoutside------------------设置ACL列表绑定到外端口

routeoutside0.0.0.00.0.0.0x.x.x.x1------------------设置到外网的默认路由

timeoutxlate3:

00:

00

timeoutconn1:

00half-closed0:

10:

00udp0:

02:

00icmp0:

02

timeoutsunrpc0:

00h3230:

05:

00h2251:

00mgcp0:

00mgcp-pat0:

timeoutsip0:

30:

00sip_media0:

00sip-invite0:

03:

00sip-disconnect0:

timeoutuauth0:

00absolute

nosnmp-serverlocation

nosnmp-servercontact

telnet0.0.0.00.0.0.0inside------------------设置TELNET所有地址进入

telnettimeout5

ssh0.0.0.00.0.0.0outside------------------设置SSH所有地址进入

sshtimeout30

sshversion2

consoletimeout0

dhcpdaddress192.168.1.100-192.168.1.199inside------------------设置DHCP服务器地址池

dhcpddns211.99.129.210202.106.196.115interfaceinside------------------设置DNS服务器到内网端口

dhcpdenableinside------------------设置DHCP应用到内网端口

CD-ASA5520