ASA방화벽-1

맵을 먼저 만들어야 한다.

[default]

en

conf t

no ip domain lookup

logg sy

exec-timeout 0

exit

 

[asa]

show firewall

conf t

firewall transparent ->2계층

no firewall transparent ->3계층

sh int ip b (sh ip int b 아님)

 

int g0/0

no sh

nameif Inside

desc ##Inside_Network

ip add 200.1.1.254 255.255.255.0

security-level 100 ->기본셋팅이긴 함

exit

int g0/1

no sh

nameif Outside

desc ##Outside_Network

ip add 1.1.100.1 255.255.255.252

security-level 0 ->기본셋팅이긴 함

exit

int g0/2

no sh

nameif DMZ

desc ##DMZ_Network

ip add 100.1.1.254 255.255.255.0

security-level 50

(100->0 낮은곳으로 흐름)

 

[ISP]

int f0/1

no sh

ip add dhcp

exit

int f0/0

no sh

ip add 1.1.100.6 255.255.255.252

exit

int f1/0

no sh

ip add 2.2.2.254 255.255.255.0

exit

 

ip route 0.0.0.0 0.0.0.0 f0/1 10.0.0.1

ip route 1.1.100.0 255.255.255.252 f0/0 1.1.100.5

ip route 100.1.1.0 255.255.255.0 f0/0 1.1.100.5

ip route 200.1.1.0 255.255.255.0 f0/0 1.1.100.5

 

ip access-list standard DMZ_Inside

permit 100.1.1.0 0.0.0.255

permit 200.1.1.0 0.0.0.255

permit 2.2.2.0 0.0.0.255

permit 1.1.100.0 0.0.0.3

exit

ip nat inside source list DMZ_Inside interface f0/1 overload

int f0/0

ip nat in

int f1/0

ip nat in

int f0/1

ip nat out

 

[ce]

int f0/1

no sh

ip add 1.1.100.5 255.255.255.252

exit

int f0/0

no sh

ip add 1.1.100.2 255.255.255.252

exit

 

ip route 0.0.0.0 0.0.0.0 f0/1 1.1.100.6

ip route 100.1.1.0 255.255.255.0 f0/0 1.1.100.1

ip route 200.1.1.0 255.255.255.0 f0/0 1.1.100.1

 

[dsw]

ip routing

int f0/0

no sh

ip add 200.1.1.2 255.255.255.0

ip route 0.0.0.0 0.0.0.0 f0/0 200.1.1.254

 

[dmz-sw]

no ip routing

 

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

WIN7

Kahli

vi /etc/network/interfaces

Win2016

CentOS

vi /etc/sysconfig/network-scripts/ifcfg-ens33

--------------------------------------------------

구간별 ping 가기 위해서

[asa]

policy-map global_policy

class inspection_default

inspect icmp

 

route Outside 0 0 1.1.100.2

-> 0.0.0.0 0.0.0.0 1.1.100.2

---------------------------------------

[dsw]

telnet 200.1.1.254         ->텔넷이 되지 않는다.

[asa]

telnet 200.1.1.0 255.255.255.0 Inside

telnet 100.1.1.0 255.255.255.0 DMZ

telnet 1.1.100.0 255.255.255.252 Outside

password cisco

[dsw]

telnet 200.1.1.254     ->이제 텔넷이 됨

win2016이랑 centos에서도 된다.

(ce에서는 telent안된다. security레벨낮아서)

---------------------------------------

asa]

username admin password cisco

aaa authentication ssh console LOCAL

crypto key generate rsa modulus 1024

yes

ssh 200.1.1.0 255.255.255.0 Inside

ssh 1.1.100.2 255.255.255.255 Outside

--> 

ssh는 security레벨낮아도 된다. 따라서 ce에서도 ssh 가능

ssh -l admin 1.1.100.1

------------------------------------

sh int ip br

int M0/0

no sh

nameif Management

security-level 100

ip add 192.168.1.254 255.255.255.0

desc ##Managemnet_Interface

exit

 

이제 GUI로 제어를 해보자 기존에 CLI로 작성한 정책을 지워준다.

clear configure telnet

clear configure ssh

 

그리고 ASA에 접근할 수 있는 PC의 ssh를 허가해줌

ssh 192.168.1.0 255.255.255.0 Management

 

win702 파일에 TFTP파일을 C드라이브에 넣어주었고 asdm-781-150.bin  파일을 해당 폴더에 넣었다.

해당 파일은 asdm 이미지파일로 이것을 asa에 설치하는 과정

 

[asa]

copy tftp: flash

192.168.1.1

asdm-781-150.bin

위 명령어로 ASA에 asdm을설치한다.

 

username admin password cisco

asdm image flash:asdm-781-150.bin

http server enable

http 192.168.1.1 255.255.255.255 Managemnet

wr

---------------------------------------

win 702에서 접속