ASA--WEB服务器环境应用配置

朱雀 2022-01-13 07:05 371阅读 0赞

外网------ASA-------内部服务器  
|  
内部客户机

ASA的基本配置一般包括：  
1、配置主机名、域名和密码  
2、配置接口  
3、配置路由  
4、配置远程管理接入  
5、为出站流量配置网络地址转换  
6、配置ACL

1、hostname ASA5520  
domain-name lpq.com  
enable password asa5520 特权密码  
passwd cisco 远程登录密码  
2、nameif name  
(inside outside dmz)  
security-level number(0<100 inside<dmz<outside)接口安全级别  
ip addr 192.168.1.1 255.255.255.0  
no shutdown  
exit  
3、route interface-name network mask next-hop-address 配置静态路由  
route outside 0.0.0.0 0.0.0.0 61.54.226.62  
show route  
4、telnet \{network|ip-address\} mask interface-name  
telnet 192.168.1.0 255.255.255.0 inside 允许网段  
telnet 192.168.1.5 255.255.255.255 inside 允许主机  
telnet timeout minutes 空闲超时  
配置SSH  
crypto key generate rsa modulus 1024 生成密钥对  
ssh 192.168.1.0 255.255.255.0 inside  
ssh 0 0 outside 允许SSH接入  
ssh timeout 30 超时  
ssh version 2 版本  
username asa5520 password cisco 设置一个本地账号  
aaa authertication ssh console LOCAL为SSH启用aaa认证  
passwd aaa 远程访问密码  
配置ASDM（自适应安全设备管理器）接入  
http server enable \[port\] 启用HTTPS服务器功能  
http \{network|ip-address\} mask interface\_name 允许HTTPS接入  
asdm p\_w\_picpath disk0:/asdmfile 指定ASDM映象位置  
username user password password privilege 15  
5、nat (interface\_name) nat-id local-ip mask 指定NAT  
global (interface\_name) nat-id \{global-ip\[global-ip\]|interface\} 定义全局地址池  
案例：nat-control  
nat (inside) 1 0 0  
global (outside) 1 interface  
global (dmz) 1 192.168.202.10-192.168.202.110  
6、access-list acl\_name standard \{permit|deny\} ip\_addr mask 标准访问列表  
access-list acl\_name extended \{permit|deny\} protocol src\_ip\_addr src\_mask dst\_ip\_addr dst\_mask \[operator port\] 扩展访问列表  
access-group acl\_name \{in|out\} interface interface\_name 将ACL应用到接口  
案例：access-list in\_to\_out extended deny ip 192.168.201.0 255.255.255.240 any  
access-list in\_to\_out extended permit ip any any  
access-group in\_to\_out in interface inside  
配置Static NAT  
static (real\_interface,mapped\_interface) mapped\_ip real\_ip  
案例：static (dmz,outside) 210.10.10.253 192.168.202.1  
access-list out\_to\_dmz extended permit tcp any host 210.10.10.253 eq www  
access-group out\_to\_dmz in inter outside  
ICMP协议  
access-list 111 permit icmp any any echo-reply  
access-list 111 permit icmp any any unreachable  
access-list 111 permit icmp any any time-exceeded  
access-group 111 in inter outside  
保存配置：write memory //copy running-config startup-config  
清除所有配置：clear configure all  
清除部分配置：clear configure command \[level2command\]

===============================================================  
ASA的高级应用  
1、URL地址过滤  
2、防火墙日志管理  
3、启用防火墙安全功能  
基本威胁检测  
防范IP分片\*\*\*  
启用集成的IDS特性执行边界\*\*\*检测功能  
\--------------------------------------------------------  
1、URL  
企业需求  
IP地址范围在192.168.202.1-192.168.202.15中的主机只能访问[www.sina.com][],不能访问其他任何网站。  
禁止所有主机访问[www.game.com][]  
实施URL过滤分为3个步骤  
创建映射class-map,识别传输流量  
access-list tcp\_filter1 permit tcp 192.168.201.0 255.255.255.240 any eq www  
class-map tcp\_filter\_class1  
match access-list tcp\_filter1  
exit  
  
regex url1 \\.sina\\.com  
  
class-map type regex match-any url\_class1  
match regex url1  
exit

class-map type inspect http http\_url\_class1  
match not request header host regex class url\_class1  
exit  
创建策略映射policy-map,关联class-map  
应用策略映射policy-map到接口上

转载于:https://blog.51cto.com/lipq09/1118955

[www.sina.com]: http://www.sina.com
[www.game.com]: http://www.game.com