CISCO 5510 中文配置手冊

GAMETUZI CISCO 5510 中文配置手冊 07－8.23
ASA 5510 IN CHINA GAMETUZI spoto s USER
OK 開始上電配置…

配置設備介紹：（只爲作實驗實際應用請根據本身具體狀況更改相關參數便可）
核心交換機 4507
提供VLAN3 網關地址：192.168.3.254
提供 DNS 服務器鏈接：192.168.0.1
接入交換機 2960
提供 VLAN3 TURNK 鏈接，
可用IP地址爲
192.168.3.0－192.168.3.240
掩碼：255.255.255.0
網關：192.168.3.254
DNS: 192.168.0.1
內網實驗防火牆 CISCO ASA 5510
E0/0 IP:192.168.3.234
E0/1 IP 10.1.1.1

實現配置策略

1. 動態內部 PC1 DHCP 自動得到IP地址，可訪問INTERNET，並PING通外部網關。
PC1 Ethernet adapter 本地鏈接:
Connection-specific DNS Suffix . : gametuzi
Description . . . . . . . . . . . : Broadcom 440x roller
Physical Address. . . . . . . . . : 00-13-77-04-9
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.1.1.20
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.1.1.1
DHCP Server . . . . . . . . . . . : 10.1.1.1
DNS Servers . . . . . . . . . . . : 192.168.0.1

2. 靜態內部 PC2 手動分配地址，可訪問 INTERNET ，並PING通外部網關。
PC1 Ethernet adapter 本地鏈接:
Connection-specific DNS Suffix . : gametuzi
Description . . . . . . . . . . . : Broadcom 440x roller
Physical Address. . . . . . . . . : 00-13-77-04-9
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.1.34.34
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.1.1.1
DHCP Server . . . . . . . . . . . : 10.1.1.1
DNS Servers . . . . . . . . . . . : 192.168.0.1

3. ASA 5510 啓動PAT NAT DNS DHCP 服務

好開始鏈接
ASA 5510

ciscoasa#
ciscoasa# conf t 進入全局配置模式
ciscoasa(config)# hos
ciscoasa(config)# hostname gametuzi 命名
gametuzi(config)#
gametuzi(config)# hostname gametuzi5510 新的名字
gametuzi5510(config)# conf t
gametuzi5510(config)# int e0/0 進入E0/0 接口
gametuzi5510(config-if)# n
gametuzi5510(config-if)# n?

interface mode commands/options:
nameif no

configure mode commands/options:
name names nat nat-control
no ntp

exec mode commands/options:
no

gametuzi5510(config-if)# name
gametuzi5510(config-if)# nameif ou
gametuzi5510(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
gametuzi5510(config-if)# sec
gametuzi5510(config-if)# security-level 0 配置安全級別 由於是外部接口，安全級別爲最高
gametuzi5510(config-if)# nameif outside 命名接口爲外部接口
gametuzi5510(config-if)# ip
gametuzi5510(config-if)# ip addre
gametuzi5510(config-if)# ip address 192.168.3.234 255.255.255.0 添加IP地址
gametuzi5510(config-if)# no shu 啓動端口
gametuzi5510(config-if)# no shu
gametuzi5510(config-if)# end
gametuzi5510# conf t
gametuzi5510(config)# int e0/1 進入E0/1接口
gametuzi5510(config-if)# se
gametuzi5510(config-if)# ser
gametuzi5510(config-if)# secu
gametuzi5510(config-if)# security-level 100 設置內部安全級別爲100
gametuzi5510(config-if)# na
gametuzi5510(config-if)# name
gametuzi5510(config-if)# nameif in
gametuzi5510(config-if)# nameif inside 命名內部網絡
gametuzi5510(config-if)# ip addre
gametuzi5510(config-if)# ip address 10.1.1.1 255.255.0.0 添加IP地址
gametuzi5510(config-if)# no shu
gametuzi5510(config-if)# no shu
gametuzi5510(config-if)# end
gametuzi5510# go
gametuzi5510# gol
gametuzi5510# gol?
ERROR: % Unrecognized command
gametuzi5510# gl
gametuzi5510# gl?
ERROR: % Unrecognized command
gametuzi5510# conf t
gametuzi5510(config)# gol
gametuzi5510(config)# gol?
ERROR: % Unrecognized command
gametuzi5510(config)# gk
gametuzi5510(config)# gl?

configure mode commands/options:
global
gametuzi5510(config)# gl
gametuzi5510(config)# global ou
gametuzi5510(config)# global (outside)1 in
gametuzi5510(config)# global (outside)1 in?
ERROR: % Unrecognized command
gametuzi5510(config)# global (outside) 1 int
gametuzi5510(config)# global (outside) 1 interface PAT地址轉換！
INFO: outside interface address added to PAT pool
gametuzi5510(config)# end
gametuzi5510# conf t
gametuzi5510(config)# route ou
gametuzi5510(config)# route outside 0.0.0.0 0.0.0.0 192.168.3.254 默認路由 訪問全部外部地址從192.168.3.254 流出。
gametuzi5510(config)# nat (inside) 1 10.1.0.0 255.255.0.0 內部地址轉換 10.1.0.0 網段
gametuzi5510(config)# dhcpd?
configure mode commands/options:
dhcpd
gametuzi5510(config)# dhcpd ?

configure mode commands/options:
address Configure the IP pool address range after this keyword
auto_config Enable auto configuration from client
dns Configure the IP addresses of the DNS servers after this
keyword
domain Configure DNS domain name after this keyword
enable Enable the DHCP server
lease Configure the DHCPD lease length after this keyword
option Configure options to pass to DHCP clients after this keyword
ping_timeout Configure ping timeout value after this keyword
wins Configure the IP addresses of the NETBIOS servers after this
keyword
gametuzi5510(config)# dhcpd adre
gametuzi5510(config)# dhcpd addre
gametuzi5510(config)# dhcpd address ?

configure mode commands/options:
WORD IP address[es], <ip1>[-<ip2>]
gametuzi5510(config)# dhcpd address 10.1.1.20-10.1.1.150 ?

configure mode commands/options:
Available interfaces on which to enable the DHCP server:
inside Name of interface Ethernet0/1
outside Name of interface Ethernet0/0
gametuzi5510(config)# dhcpd address 10.1.1.20-10.1.1.150 in
gametuzi5510(config)# dhcpd address 10.1.1.20-10.1.1.150 inside ?

configure mode commands/options:
<cr>
gametuzi5510(config)# dhcpd address 10.1.1.20-10.1.1.150 inside 配置DHCP 可分配網段，並標識爲內部接口
gametuzi5510(config)# dhcpd ?

configure mode commands/options:
address       Configure the IP pool address range after this keyword
auto_config   Enable auto configuration from client
dns           Configure the IP addresses of the DNS servers after this keyword
domain        Configure DNS domain name after this keyword
enable        Enable the DHCP server
lease         Configure the DHCPD lease length after this keyword
option        Configure options to pass to DHCP clients after this keyword
ping_timeout  Configure ping timeout value after this keyword
wins          Configure the IP addresses of the NETBIOS servers after this keyword
gametuzi5510(config)# dhcpd dns ?

configure mode commands/options:
Hostname or A.B.C.D IP address of server 1
gametuzi5510(config)# dhcpd dns 192.168.0.1 添加DNS解析服務器地址
gametuzi5510(config)# dhcpd do
gametuzi5510(config)# dhcpd domain gametuzi 域名
gametuzi5510(config)# dhcpd en
gametuzi5510(config)# dhcpd enable ?

configure mode commands/options:
Available interfaces on which to enable the DHCP server:
inside Name of interface Ethernet0/1
outside Name of interface Ethernet0/0
gametuzi5510(config)# dhcpd enable in
gametuzi5510(config)# dhcpd enable inside >?
ERROR: % Unrecognized command
gametuzi5510(config)# dhcpd enable inside ?

configure mode commands/options:
<cr>
gametuzi5510(config)# dhcpd enable inside 啓動內部DHCP服務
gametuzi5510(config)# end
gametuzi5510# wr 保存配置
Building configuration...
Cryptochecksum: 7b31abf1 b002711b ecfb3fa0 1612c057

1797 bytes copied in 3.610 secs (599 bytes/sec)
[OK]
gametuzi5510# ac
gametuzi5510# conf t
gametuzi5510(config)# ac
gametuzi5510(config)# acc
gametuzi5510(config)# access-grou
gametuzi5510(config)# access-group icmp_in in int
gametuzi5510(config)# access-group icmp_in in interface ou
gametuzi5510(config)# access-group icmp_in in interface outside
ERROR: access-list <icmp_in> does not exist
gametuzi5510(config)# ac
gametuzi5510(config)# acc
gametuzi5510(config)# access-li
gametuzi5510(config)# access-list icmp_in e
gametuzi5510(config)# access-list icmp_in extended pe
gametuzi5510(config)# access-list icmp_in extended permit icm
gametuzi5510(config)# access-list icmp_in extended permit icmp an
gametuzi5510(config)# access-list icmp_in extended permit icmp any an
gametuzi5510(config)# access-list icmp_in extended permit icmp any any 潤許PING協議轉發
gametuzi5510(config)# ac
gametuzi5510(config)# acce
gametuzi5510(config)# access-gr
gametuzi5510(config)# access-group icmp
gametuzi5510(config)# access-group icmp_in in in
gametuzi5510(config)# access-group icmp_in in interface ou
gametuzi5510(config)# access-group icmp_in in interface outside潤許PING協議轉發
gametuzi5510(config)# end
gametuzi5510# wr
Building configuration...
Cryptochecksum: 32d3d557 0d55d4a3 a1a7fa13 76667f5f

1889 bytes copied in 3.640 secs (629 bytes/sec)
[OK]
gametuzi5510#