思科防火墙asa官方nat实验配置.docx

《思科防火墙asa官方nat实验配置.docx》由会员分享，可在线阅读，更多相关《思科防火墙asa官方nat实验配置.docx（2页珍藏版）》请在第一文库网上搜索。

1、Insidednsserver:192.168.0.53/24员工：192.168.0.125/24Gw(asa)：192.168.0.1dmzwebserver:192.168.1.100gw(asa):192.168.1.1Outsideisp:198.51.100.130防火墙：198.51.100.100/24Isp边界router连接公司：G0/0198.51.100.130/24连接Internet用户：g1200.1.1.1/24互联网PC用户200.1.1.5/24ASA:ConftNoipdomain-1interfaceg1/1nameifoutsidesecurity-1

2、eve1Oipaddress198.51.100.100255.255.255.0noshut!interfaceg1/2nameifinsidesecurity-1eve1100ipaddress192.168.0.1255.255.255.0noshutIinterfaceg1/3nameifdmzsecurity-1eve150ipaddress192.168.1.1255.255.255.0noshut!routeoutside0.0.0.00.0.0.0198.51.100.11步-将NAT配置为允许主机连接到互联网nat:objectnetworkinside-subnetsubn

3、et192.168.0.0255.255.255.0nat(inside,outside)dynamicinterfaceIobjectnetworkdmz-subnetsubnet192.168.1.0255.255.255.0nat(dmz,outside)dynamicinterface第2步将NAT配置为从互联网访问Web服务器:objectnetworkwebserver-externa1-iphost198.51.100.101objectnetworkwebserverhost192.168.1.100nat(dmz,outside)static198.51.100.10第3步-

4、配置AC1：access-1istoutside_ac1extendedpermittcpanyobjectwebservereqwwwIaccess-groupoutside_ac1ininterfaceoutsideobjectnetworkdns-serverhost192.168.0.53Iaccess-1istdmz_ac1extendedpermitudpanyobjectdns-servereqdomainaccess-1istdmz_ac1extendeddenyipanyobjectinside-subnetaccess-1istdmz_ac1extendedpermitip

5、anyanyIaccess-groupdmz_ac1ininterfacedmz第4步-使用PacketTracer功能测试配置packet-tracerinputinsidetcp192.168.0.12512345203.0.113.180packet-tracerinputoutsidetcp192.0.2.12312345198.51.100.10180isp边界routerenconfthostISP-DIANXINNOipdomina-1Intg00Ipad198.51.100.130255.255.255.0NoshutIntg1Ipad200.1.1.1255.255.255.0Noshut