实验需求:

配置ASA的接口和ACL,并验证接口间的通信。


实验环境:

双区域ASA配置_Cisco ASA


实验配置:

配置接口:

asa:
enable
config terminal
interface gigabitEthernet 1
nameif inside
security-level 100
ip address 10.1.1.254 255.255.255.0
no shut
interface gigabitEthernet 0
nameif outside
security-level 0
ip address 172.16.1.254 255.255.255.0
no shut


R1:
config terminal
int e0/0
duplex full
ip address 10.1.1.1 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 10.1.1.254


R2:
config terminal
int e0/0
duplex full
ip address 172.16.1.1 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 172.16.1.254


配置telnet:

username bdqn privilege 15 password 123.123
line vty 0 4
login local
transport input telnet
exit


验证在R1上可以Telnet到R2,但在R2上不能Telnet到R1,测试R1能否ping通R2。

双区域ASA配置_ide_02

双区域ASA配置_ide_03


配置ACL:

access-list ping permit icmp any any
access-group ping in interface outside
access-list telnet permit ip host 172.16.1.1 host 10.1.1.1
access-group telnet in interface outside


测试ACL配置是否成功

双区域ASA配置_ide_04双区域ASA配置_ide_05


使用show conn detail命令查看ASA Conn表。双区域ASA配置_Cisco ASA_06


配置完成,实验结束。


(如有疏漏,还请读者指出)