asa防火墻vlan子接口互相通訊配置實(shí)例

《asa防火墻vlan子接口互相通訊配置實(shí)例》由會(huì)員上傳分享，免費(fèi)在線(xiàn)閱讀，更多相關(guān)內(nèi)容在行業(yè)資料-天天文庫(kù)。

1、ASA防火墻vlan子接口互相通訊配置實(shí)例作者:金振宇日期:2008-5-1319:47:5實(shí)例需求：CiscoASA5520防火墻用于內(nèi)部多個(gè)vlan之間互相通訊。拓?fù)鋱D：??????????配置實(shí)例：[asa防火墻配置]:Saved:ASAVersion7.0(7)!hostname*****enablepasswordGSk/3FjsRAiPoooiencryptednamesdns-guard!interfaceGigabitEthernet0/0?shutdown?nameifoutside?security-level0?noipadd

2、ress!interfaceGigabitEthernet0/1?nonameif?nosecurity-level?noipaddress!interfaceGigabitEthernet0/1.1?????????????//?啟用子接口連接vlan10，安全及別99，分配地址?vlan10?nameifTest1?security-level99?ipaddress10.8.128.254255.255.255.0!????????????interfaceGigabitEthernet0/1.2????????????//?啟用子接口連接v

3、lan20，安全及別98，分配地址?vlan20?nameifTest2?security-level98?ipaddress10.8.129.254255.255.255.0!interfaceGigabitEthernet0/1.3????????????//?啟用子接口連接vlan30，安全及別97，分配地址?vlan30?nameifTest3?security-level97?ipaddress10.8.130.254255.255.255.0!interfaceGigabitEthernet0/2?shutdown?nonameif?n

4、osecurity-level?noipaddress!interfaceGigabitEthernet0/3?descriptionLANFailoverInterface!interfaceManagement0/0?nameifmanagement?security-level100?ipaddress192.168.1.1255.255.255.0?management-only!passwd2KFQnbNIdI.2KYOUencryptedftpmodepassiveaccess-listacl_Test1extendedpermitic

5、mpanyany????//?設(shè)置訪(fǎng)問(wèn)列表，允許全通過(guò)，為了測(cè)試方便access-listacl_Test1extendedpermitipanyanyaccess-listacl_Test2extendedpermiticmpanyanyaccess-listacl_Test2extendedpermitipanyanyaccess-listacl_Test3extendedpermiticmpanyanyaccess-listacl_Test3extendedpermitipanyanyaccess-listnonatextendedpermi

6、tipanyany???????????????//這個(gè)acl是用在bypassnat所用??*pagerlines24loggingasdminformationalmtumanagement1500mtuoutside1500mtuTest11500mtuTest21500mtuTest31500failoverfailoverlanunitprimaryfailoverlaninterfacefailoverGigabitEthernet0/3failoverkey*****failoverinterfaceipfailover192.168

7、.254.1255.255.255.0standby192.168.254.2noasdmhistoryenablearptimeout14400nat(Test1)0access-listnonat?????????????//把互通的子接口啟用bypassnat，讓子接口各vlan數(shù)據(jù)互通?*nat(Test2)0access-listnonatnat(Test3)0access-listnonataccess-groupacl_Test1ininterfaceTest1???//把相應(yīng)的訪(fǎng)問(wèn)列表設(shè)置在對(duì)應(yīng)的接口上?*access-groupa

8、cl_Test2ininterfaceTest2access-groupacl_Test3ininterfaceTest3