5540 asa 8.4 防火墙

配置等级策略，保证outside端口可以访问inside端口

access-list 100 extended permit icmp any any

access-list 100 extended permit ip any any

access-group 100 in interface outside

做PAT：

object network nat

subnet 192.168.1.0 255.255.255.0

nat (inside,ouside) dynamic interfac

做路由：

route outside 0.0.0.0 0.0.0.0 60.22.23.1
把内网路由到外网（内网的默认路由）

route inside 172.168.1.0 255.255.255.0 172.16.1.1 1
把外网路由到内网

route inside 192.168.0.0 255.255.0.0 172.16.1.1 1

9：开启SSH和telnet：

ciscoasa(config)#crypto key generate rsa modulus 1024

ciscoasa(config)#write mem

ciscoasa(config)#ssh 0.0.0.0 0.0.0.0 outside
//任何外网都可以通过shh登录

ciscoasa(config)#ssh timeout 30 //设置超时时间,单位为分钟

ciscoasa(config)#ssh version 1 //指定SSH版本,可以选择版本2

ciscoasa(config)#passwd 密码 //passwd命令所指定的密码为远程访问密码

telnet 0.0.0.0 0.0.0.0 inside

telnet 192.168.10.0 255.255.255.0 inside

telnet 10.1.2.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

开启ASDM

asdm image disk0:/asdm-645.bin

no asdm history enable

http server enable

http 192.168.0.0 255.255.0.0 inside

http 192.168.1.0 255.255.255.0 management

http 192.168.10.0 255.255.255.0 inside

配置SSL VPN：

----------------------产生证书---------------------------

crypto key generate rsa label asa.yeslab.net modulus 1024

crypto ca trustpoint localtrustpoint

enrollment self

fqdn asa.yeslab.net

subject-name cn=asa.yeslab.net

keypair asa.yeslab.net

crl configure

ssl trust-point localtrustpoint

---------------------anyconnect配置---------------------------

webvpn

enable outside

no anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.1047-k9.pkg 1

anyconnect enable

ip local pool vpn-pool 172.16.2.1-172.16.2.100
根据原有配置或者客户需求配置该地址池

group-policy simapolicy internal

group-policy simapolicy attributes

vpn-tunnel-protocol ikev2 ssl-client ssl-clientless

address-pools value vpn-pool

webvpn

url-list none

anyconnect ask enable

url-entry disable

username sima password 123 privilege 15 更具客户安排定义用户名和密码

username sima attributes

vpn-group-policy simapolicy

---------------------------IKEv2配置-----------------------------------

crypto ikev2 enable Outside client-services port 443

crypto ikev2 remote-access trustpoint localtrustpoint

crypto ikev2 policy 10

crypto ipsec ikev2 ipsec-proposal ikev2-p

crypto dynamic-map dymap 100 set ikev2 ipsec-proposal
ikev2-p

crypto map cisco 1000 ipsec-isakmp dynamic dymap

crypto map cisco interface Outside

12：隧道分离：

ciscoasa(config)# access-list split-ssl extended permit ip
172.16.1.0 255.255.255.252 any

!注意源地址为ASA的inside网络地址，目标地址始终为any

!

ciscoasa(config)# group-policy sslvpn-group-policy
attributes

ciscoasa(config-group-policy)# split-tunnel-policy
tunnelspecified

ciscoasa(config-group-policy)# split-tunnel-network-list value
split-ssl

13：SSL VPN关注流量不需要NAT：

object network inside-router-loop0

subnet 192.168.0.0 255.255.0.0

object network remote-vpn-address

subnet 172.16.2.0 255.255.255.0 //定义object关联做nat豁免

nat (inside,outside) source static inside-router-loop0
inside-router-loop0 destination static remote-vpn-address
remote-vpn-address

14: 端口映射

dhcpd address 192.168.55.2-192.168.55.254 management

dhcpd enable management

object network obj-192.168.2.27

host 192.168.2.27

object network obj-192.168.2.13

host 192.168.2.13

object network obj_any

subnet 0.0.0.0 0.0.0.0

nat (inside,outside) static 202.97.156.21 server tcp www
www

ERROR: Address 202.97.156.21 overlaps with outside interface
address.

ERROR: NAT Policy is not downloaded

object network obj-192.168.2.27

nat (inside,outside) static 218.26.213.126 service tcp www
8080

object network obj-192.168.2.13

nat (inside,outside) static 218.26.213.126 service tcp www
www

object network obj_any

nat (inside,outside) dynamic interface

SSL连接建立成功以后，ASA上将自动创建指向客户的静态路由。