ASA 5500系列防火牆基本配置

一.初始配置
ciscoasa> enable
ciscoasa# configure terminal
ciscoasa(config)# hostname asa5505
2.配置telnet
asa5505(config)#telnet 192.168.1.0 255.255.255.0 inside ↑//容許內部接口

192.168.1.0網段telnet防火牆
3.配置密碼
asa5505(config)# password cisco ------------------遠程密碼
asa5505(config)# enable password cisco ------------------特權模式密碼

二.接口配置

 interface GigabitEthernet0/0
 nameif Outside
 security-level 0
 ip address 119.95.225.242 255.255.255.252

 interface GigabitEthernet0/1
 nameif Inside
 security-level 100
 ip address 192.168.102.1 255.255.255.0

 interface GigabitEthernet0/2
 nameif dmz
 security-level 100
 ip address 192.168.103.1 255.255.255.0

 dns domain-lookup inside
 dns server-group DefaultDNS
 name-server 211.99.129.210
 name-server 202.106.196.115
 domain-name cnpcfcc.cn

三.路由設置
  route Outside 0.0.0.0 0.0.0.0 119.97.225.241 1 ------------------設置到外

網的默認路由
  route Inside 192.168.100.0 255.255.255.0 192.168.102.2 1
  route Inside 192.168.101.0 255.255.255.0 192.168.102.2 1------------設置

到內網路由
  route Inside 192.168.103.0 255.255.255.0 192.168.102.2 1
  route Inside 192.168.104.0 255.255.255.0 192.168.102.2 1

四.訪問控制

1.基本訪問控制
   access-list 101 extended permit ip any any ------------------設置ACL列表

（容許許全部IP所有經過）
   access-list 101 extended permit icmp any any ------------------設置ACL列

表（容許ICMP所有經過）
   access-group 101 in interface outside --------------控制列表101應用到

outside接口
  
2.其餘訪問控制
access-list acl_out extended permit tcp any any eq www ------------------允

許tcp協議80端口入站
access-list acl_out extended permit tcp any any eq https ------------------

容許tcp協議443端口入站
access-list acl_out extended permit tcp any host 218.16.37.223 eq ftp
                                                           //容許tcp協議21

端口到218.16.37.223主機
access-list acl_out extended permit tcp any host 218.16.37.224 eq 3389  遠

程桌面
                                                          //容許tcp協議3389

端口到218.16.37.224主機
access-list acl_out extended permit tcp any host 218.16.37.225 eq 1433  sql

默認端口
                                                         //容許tcp協議1433

端口到218.16.37.225主機
access-list acl_out extended permit tcp any host 218.16.37.226 eq 8080 www

代理服務
                                                         //容許tcp協議8080

端口到218.16.37.226主機

五.地址映射
   global (outside) 1 interface  ----------------------------------------設

置NAT地址映射到外網口
   nat (inside) 1 0.0.0.0 0.0.0.0  0---------------------------------NAT地

址池（全部地址映射到外網）0無最大會話數限制
   或者
   nat (Inside) 1 192.168.100.0 255.255.255.0
   nat (Inside) 1 192.168.102.0 255.255.255.0------------------------將這些

內網地址映射到外網
   nat (Inside) 1 192.168.103.0 255.255.255.0
六.其餘映射
asa5505(config)# static (inside,outside) 218.16.37.223 192.168.1.6 netmask

255.255.255.255
                                                       //外網218.16.37.223

映射到內網192.168.1.6

asa5505(config)#static (inside,dmz) 10.10.10.37 192.168.1.16 netmask

255.255.255.255
                                                         //dmz10.10.10.37映

射到內網192.168.1.16
asa5505(config)#static (inside,outside) 221.221.147.195 192.168.0.10 tcp

8089
                                                 //外網218.16.37.223:8089映

射到內網192.168.1.6:8089