asa防火墻vlan子接口互相通訊配置實例

《asa防火墻vlan子接口互相通訊配置實例》由會員上傳分享，免費在線閱讀，更多相關內(nèi)容在行業(yè)資料-天天文庫。

1、ASA防火墻vlan子接口互相通訊配置實例作者:金振宇日期:2008-5-1319:47:5實例需求：CiscoASA5520防火墻用于內(nèi)部多個vlan之間互相通訊。拓撲圖：??????????配置實例：[asa防火墻配置]:Saved:ASAVersion7.0(7)!hostname*****enablepasswordGSk/3FjsRAiPoooiencryptednamesdns-guard!interfaceGigabitEthernet0/0?shutdown?nameifoutside?security-level0?n

2、oipaddress!interfaceGigabitEthernet0/1?nonameif?nosecurity-level?noipaddress!interfaceGigabitEthernet0/1.1?????????????//?啟用子接口連接vlan10，安全及別99，分配地址?vlan10?nameifTest1?security-level99?ipaddress10.8.128.254255.255.255.0!????????????interfaceGigabitEthernet0/1.2???????????

3、?//?啟用子接口連接vlan20，安全及別98，分配地址?vlan20?nameifTest2?security-level98?ipaddress10.8.129.254255.255.255.0!interfaceGigabitEthernet0/1.3????????????//?啟用子接口連接vlan30，安全及別97，分配地址?vlan30?nameifTest3?security-level97?ipaddress10.8.130.254255.255.255.0!interfaceGigabitEthernet0/2?s

4、hutdown?nonameif?nosecurity-level?noipaddress!interfaceGigabitEthernet0/3?descriptionLANFailoverInterface!interfaceManagement0/0?nameifmanagement?security-level100?ipaddress192.168.1.1255.255.255.0?management-only!passwd2KFQnbNIdI.2KYOUencryptedftpmodepassiveaccess-lista

5、cl_Test1extendedpermiticmpanyany????//?設置訪問列表，允許全通過，為了測試方便access-listacl_Test1extendedpermitipanyanyaccess-listacl_Test2extendedpermiticmpanyanyaccess-listacl_Test2extendedpermitipanyanyaccess-listacl_Test3extendedpermiticmpanyanyaccess-listacl_Test3extendedpermitipanyan

6、yaccess-listnonatextendedpermitipanyany???????????????//這個acl是用在bypassnat所用??*pagerlines24loggingasdminformationalmtumanagement1500mtuoutside1500mtuTest11500mtuTest21500mtuTest31500failoverfailoverlanunitprimaryfailoverlaninterfacefailoverGigabitEthernet0/3failoverkey***

7、**failoverinterfaceipfailover192.168.254.1255.255.255.0standby192.168.254.2noasdmhistoryenablearptimeout14400nat(Test1)0access-listnonat?????????????//把互通的子接口啟用bypassnat，讓子接口各vlan數(shù)據(jù)互通?*nat(Test2)0access-listnonatnat(Test3)0access-listnonataccess-groupacl_Test1ininterface

8、Test1???//把相應的訪問列表設置在對應的接口上?*access-groupacl_Test2ininterfaceTest2access-groupacl_Test3ininterfaceTest3