配置等级策略,保证outside端口可以访问inside端口
access-list 100 extended permit icmp any any
access-list 100 extended permit ip any any

access-group 100 in interface outside

做PAT:
object network nat
subnet 192.168.1.0 255.255.255.0
nat (inside,ouside) dynamic interfac

做路由:
route outside 0.0.0.0 0.0.0.0 60.22.23.1 把内网路由到外网(内网的默认路由)
route inside 172.168.1.0 255.255.255.0 172.16.1.1 1 把外网路由到内网
route inside 192.168.0.0 255.255.0.0 172.16.1.1 1


9:开启SSH和telnet:
ciscoasa(config)#crypto key generate rsa modulus 1024
ciscoasa(config)#write mem
ciscoasa(config)#ssh 0.0.0.0 0.0.0.0 outside //任何外网都可以通过shh登录
ciscoasa(config)#ssh timeout 30 //设置超时时间,单位为分钟
ciscoasa(config)#ssh version 1 //指定SSH版本,可以选择版本2
ciscoasa(config)#passwd 密码 //passwd命令所指定的密码为远程访问密码

telnet 0.0.0.0 0.0.0.0 inside
telnet 192.168.10.0 255.255.255.0 inside
telnet 10.1.2.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
 

开启ASDM
asdm p_w_picpath disk0:/asdm-645.bin
no asdm history enable
http server enable
http 192.168.0.0 255.255.0.0 inside
http 192.168.1.0 255.255.255.0 management
http 192.168.10.0 255.255.255.0 inside
 

配置SSL ×××:
----------------------产生证书---------------------------
crypto key generate rsa label asa.yeslab.net modulus 1024

crypto ca trustpoint localtrustpoint
enrollment self
fqdn asa.yeslab.net
subject-name cn=asa.yeslab.net
keypair asa.yeslab.net
crl configure

ssl trust-point localtrustpoint
---------------------anyconnect配置---------------------------
webvpn
enable outside
no anyconnect-essentials
anyconnect p_w_picpath disk0:/anyconnect-win-3.0.1047-k9.pkg 1
anyconnect enable

ip local pool vpn-pool 172.16.2.1-172.16.2.100 根据原有配置或者客户需求配置该地址池

group-policy simapolicy internal
group-policy simapolicy attributes
vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
address-pools value vpn-pool
webvpn
url-list none
anyconnect ask enable
url-entry disable

username sima password 123 privilege 15 更具客户安排定义用户名和密码
username sima attributes
vpn-group-policy simapolicy

---------------------------IKEv2配置-----------------------------------
crypto ikev2 enable Outside client-services port 443
crypto ikev2 remote-access trustpoint localtrustpoint
crypto ikev2 policy 10
crypto ipsec ikev2 ipsec-proposal ikev2-p

crypto dynamic-map dymap 100 set ikev2 ipsec-proposal ikev2-p
crypto map cisco 1000 ipsec-isakmp dynamic dymap
crypto map cisco interface Outside
12:隧道分离:
ciscoasa(config)# access-list split-ssl extended permit ip 172.16.1.0 255.255.255.252 any
!注意源地址为ASA的inside网络地址,目标地址始终为any
!
ciscoasa(config)# group-policy sslvpn-group-policy attributes
ciscoasa(config-group-policy)# split-tunnel-policy tunnelspecified
ciscoasa(config-group-policy)# split-tunnel-network-list value split-ssl
13:SSL ×××关注流量不需要NAT:
object network inside-router-loop0
subnet 192.168.0.0 255.255.0.0
object network remote-vpn-address
subnet 172.16.2.0 255.255.255.0 //定义object关联做nat豁免
nat (inside,outside) source static inside-router-loop0 inside-router-loop0 destination static remote-vpn-address remote-vpn-address
14: 端口映射
dhcpd address 192.168.55.2-192.168.55.254 management
dhcpd enable management
object network obj-192.168.2.27
host 192.168.2.27
object network obj-192.168.2.13
host 192.168.2.13
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) static 202.97.156.21 server tcp www www
ERROR: Address 202.97.156.21 overlaps with outside interface address.
ERROR: NAT Policy is not downloaded
object network obj-192.168.2.27
nat (inside,outside) static 218.26.213.126 service tcp www 8080
object network obj-192.168.2.13
nat (inside,outside) static 218.26.213.126 service tcp www www
object network obj_any
nat (inside,outside) dynamic interface
SSL连接建立成功以后,ASA上将自动创建指向客户的静态路由。