ASA8.4的Inside區域同時通路DMZ公網位址和真實位址測試

一.測試拓撲

   R1---Outside----ASA842----Inside-----R2

                                    |

                                  DMZ

                                  R3

二.測試思路

  利用ASA的twice nat實作通路DMZ的公網位址時轉向DMZ的真實位址。

三.基本配置

A.R1:

interface FastEthernet0/0

 ip address 202.100.1.1 255.255.255.0

 no shut

B.R2:

 ip address 10.1.1.1 255.255.255.0

ip route 0.0.0.0 0.0.0.0 10.1.1.10

C.R3:

 ip address 192.168.1.1 255.255.255.0

ip route 0.0.0.0 0.0.0.0 192.168.1.10

line vty 0 4

 password cisco

 login

D.ASA842:

interface GigabitEthernet0

 nameif Outside

 security-level 0

 ip address 202.100.1.10 255.255.255.0 

interface GigabitEthernet1

 nameif DMZ

 security-level 50

 ip address 192.168.1.10 255.255.255.0 

interface GigabitEthernet2

 nameif Inside

 security-level 100

 ip address 10.1.1.10 255.255.255.0 

四.ASA靜态NAT,twice-NAT和政策配置

A.定義對象：

object network R3-dmz

 host 192.168.1.1

object network R3-outside

 host 202.100.1.8

object network Inside-net

 subnet 10.1.1.0 255.255.255.0

B.配置DMZ到Outside的靜态NAT:

    nat (DMZ,Outside) static R3-outside

C.配置inside到DMZ的的twice-nat：

nat (Inside,DMZ) source static Inside-net Inside-net destination static R3-outside R3-dmz

D.配置并應用outside接口政策:

-----Inside通路DMZ預設放行

access-list Outside extended permit ip any object R3-dmz 

access-group Outside in interface Outside

五.驗證：

A.從Ouside通路DMZ的公網位址：

R1#telnet 202.100.1.8

Trying 202.100.1.8 ... Open

User Access Verification

Password: 

R3>show users

    Line       User       Host(s)              Idle       Location

   0 con 0                idle                 00:14:22   

*  2 vty 0                idle                 00:00:00 202.100.1.1

  Interface    User               Mode         Idle     Peer Address

R3>

B.從Inside通路DMZ的公網位址：

R2#telnet 202.100.1.8

   0 con 0                idle                 00:16:37   

*  2 vty 0                idle                 00:00:00 10.1.1.1

C.從Inside通路DMZ真實位址：

R2#telnet 192.168.1.1

Trying 192.168.1.1 ... Open

   0 con 0                idle                 00:17:03   

本文轉自 碧雲天 51CTO部落格，原文連結：http://blog.51cto.com/333234/1604895，如需轉載請自行聯系原作者