实验拓扑图
网络规划如下
IUO1 | Loopback0: 218.85.152.99 | e0/0： 200.1.1.2 | ||
IUO2 | Loopback0: 172.16.88.11 | e0/0： 172.16.1.1 | ||
IUO3 | Loopback0: 192.168.1.11 | e0/0： 192.168.0.11 | ||
防火墙 | g0：200.1.1.1 | g1：172.16.1.254 | g2： 192.168.0.254 |
一、基础配置
1、IUO1的配置
IOU1(config)#interface e 0/0
IOU1(config-if)#du fu
IOU1(config-if)#ip add 200.1.1.2 255.255.255.0
IOU1(config-if)#no shutdown
IOU1(config-if)#ex
IOU1(config)#interface loopback 0
IOU1(config-if)#ip add 218.85.152.99 255.255.255.0
IOU1(config-if)#ex
IOU1(config)#username bdqn privilege 15 password 123
IOU1(config)#line vty 0 4
IOU1(config-line)#login local
IOU1(config-line)#transport input telnet
IOU1(config-line)#
2、IUO2的配置
IOU2(config)#interface e 0/0
IOU2(config-if)#du fu
IOU2(config-if)#ip address 172.16.1.1 255.255.255.0
IOU2(config-if)#no shutdown
IOU2(config-if)#ex
IOU2(config)#interface loopback 0
IOU2(config-if)#ip add 172.16.88.11 255.255.255.0
IOU2(config-if)#no shutdown
IOU2(config-if)#ex
IOU2(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.254
3、IUO3的配置
IOU3(config)#interface e 0/0
IOU3(config-if)#ip add 192.168.0.11 255.255.255.0
IOU3(config-if)#du fu
IOU3(config-if)#no shutdown
IOU3(config-if)#ex
IOU3(config)#interface loopback 0
IOU3(config-if)#ip address 192.168.1.11 255.255.255.0
IOU3(config-if)#no shutdown
IOU3(config-if)#ex
IOU3(config)#ip route 0.0.0.0 0.0.0.0 192.168.0.254
4、防火墙配置
ciscoasa(config)# interface g 0
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# ip add 200.1.1.1 255.255.255.0
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ex
ciscoasa(config)# interface g 1
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# ip add 172.16.1.254 255.255.255.0
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ex
ciscoasa(config)# interface g 2
ciscoasa(config-if)# nameif dmz
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# ip add 192.168.0.254 255.255.255.0
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ex
ciscoasa(config)# route outside 0 0 200.1.1.2
ciscoasa(config)# route inside 172.16.88.0 255.255.255.0 172.16.1.1
ciscoasa(config)# route dmz 192.168.1.0 255.255.255.0 192.168.0.11
二、配置动态NAT实现telnet外网
1、定义动态NAT的地址池
ciscoasa(config)# object network out-pool
ciscoasa(config-network-object)# range 200.1.1.10 200.1.1.20
ciscoasa(config-network-object)# exit
2、指定内网网段
ciscoasa(config)# object network inside-1
ciscoasa(config-network-object)# subnet 172.16.1.0 255.255.255.0
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network inside-2
ciscoasa(config-network-object)# subnet 172.16.88.0 255.255.255.0
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network dmz-1
ciscoasa(config-network-object)# subnet 192.168.0.0 255.255.255.0
ciscoasa(config-network-object)# exit
ciscoasa(config)# object network dmz-2
ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0
ciscoasa(config-network-object)# exit
3、创建内网地址组
ciscoasa(config)# object-group network in-lan
ciscoasa(config-network-object-group)# network-object object inside-1
ciscoasa(config-network-object-group)# network-object object inside-2
ciscoasa(config-network-object-group)# exit
ciscoasa(config)# object-group network dmz-lan
ciscoasa(config-network-object-group)# network-object object dmz-1
ciscoasa(config-network-object-group)# network-object object dmz-2
ciscoasa(config-network-object-group)# exit
4、ASA配置nat
ciscoasa(config)# nat (inside,outside) source dynamic in-lan out-pool
ciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan out-pool
telnet测试
三、PAT，多内网架构，多个网段，多个zone，直接使用外网接口
ciscoasa(config)# nat (inside,outside) source dynamic in-lan interface
ciscoasa(config)# nat (dmz,outside) source dynamic dmz-lan interface
四、PAT，多内网架构使用一个指定外网IP
ciscoasa(config)# object network out-pat3
ciscoasa(config-network-object)# host 200.1.1.3
ciscoasa(config-network-object)# exit
ciscoasa(config)# nat (inside,outside) source dynamic in-ld pat-pool out-pat3
ciscoasa(config)# object network out-pool4
ciscoasa(config-network-object)# host 200.1.1.4
ciscoasa(config-network-object)# exit
ciscoasa(config)# nat (inside,outside) source dynamic in-xd pat-pool out-pool4
五、先动态NAT。最后用指定IP做PAT
ASA(config)# object network out-pool
ASA(config-network-object)# range 200.1.1.10 200.1.1.20
ASA(config-network-object)# exit
ASA(config)# object network out-pat3
ASA(config-network-object)# host 200.1.1.3
ASA(config-network-object)# exit
ASA(config)# object-group network out-nat
ASA(config-network-object-group)# network-object object out-pat3
ASA(config-network-object-group)# network-object object out-pool
ASA(config-network-object-group)# exit
ASA(config)# nat (inside,outside) source dynamic in-lan out-nat
六、静态NAT（一对一）
ASA(config)# object network web
ASA(config-network-object)# host 200.1.1.21
ASA(config-network-object)# exit
ASA(config)# object network dmz-web
ASA(config-network-object)# host 192.168.1.11
ASA(config-network-object)# exit
ASA(config)# access-list web extended permit tcp any host 192.168.1.11
ASA(config)# access-group web in interface outside
ASA(config)# nat (dmz,outside) source static dmz-web web
七、端口一对一
ASA(config)# object network teldmz
ASA(config-network-object)# host 200.1.1.22
ASA(config-network-object)# exit
ASA(config)# object network dmz-web
ASA(config-network-object)# host 192.168.1.11
ASA(config-network-object)# exit
ASA(config)# object service telnet
ASA(config-service-object)# service tcp source eq telnet
ASA(config-service-object)# exit
ASA(config)# nat (dmz,outside) source static dmz-web teldmz service telnet telnet
