ASA同一接口中转同区域流量测试（ASA 8.42）

一.拓扑图:

<a href="http://blog.51cto.com/attachment/201205/215900533.jpg" target="_blank"></a>

二.接口配置：

A.PC1：

eth0:202.1.1.1/24

B.ASA:

ciscoasa(config-if)# int g0

ciscoasa(config-if)# ip add 10.1.1.10 255.255.255.0

ciscoasa(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ciscoasa(config-if)# no sh

ciscoasa(config)# int gigabitEthernet 1

ciscoasa(config-if)# ip add 202.1.1.10 255.255.255.0

ciscoasa(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

C.R1:

R1(config)#int f0/0

R1(config-if)#ip add 10.1.1.1 255.255.255.0

R1(config-if)#no sh

R1(config-if)#int f0/1

R1(config-if)#ip add 20.1.1.1 255.255.255.0

D.R2:

R2(config)#int f0/0

R2(config-if)#ip add 10.1.1.2 255.255.255.0

R2(config-if)#no sh

E.R3:

R3(config)#int f0/0

R3(config-if)#ip add 20.1.1.3 255.255.255.0

R3(config-if)#no sh

三.路由配置：

ASA(config)# route inside 20.1.1.0 255.255.255.0 10.1.1.1

R1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.10 

R2(config-if)#ip route 0.0.0.0 0.0.0.0 10.1.1.10

R3(config-if)#ip route 0.0.0.0 0.0.0.0 20.1.1.1

四.防火墙NAT及策略配置：

ciscoasa(config)# object network inside-network1

ciscoasa(config-network-object)# subnet 10.1.1.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic interface

ciscoasa(config-network-object)# exit exit

ciscoasa(config)# object network inside-network2

ciscoasa(config-network-object)# subnet 20.1.1.0 255.255.255.0

ciscoasa(config-network-object)# exit

ASA(config)# access-list outside permit icmp any object inside-work1 echo-reply 

ASA(config)# access-list outside permit icmp any object inside-work2 echo-reply 

ASA(config)# access-group outside in interface outside

五.公网访问测试：

R1#ping 202.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 202.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/28/52 ms

R2#ping 202.1.1.1

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/29/68 ms

R3#ping 202.1.1.1

Success rate is 100 percent (5/5), round-trip min/avg/max = 24/52/72 ms

六.配置R2和R3互访：

A.R2 ping R3，防火墙有如下日志：

%ASA-3-106014: Deny inbound icmp src inside:10.1.1.2 dst inside:20.1.1.3 (type 8, code 0)

B.防火墙开启相同区域互访：

ASA(config)# same-security-traffic permit intra-interface 

R2#ping 20.1.1.3

Sending 5, 100-byte ICMP Echos to 20.1.1.3, timeout is 2 seconds:

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/52/96 ms

R3#ping 10.1.1.2

Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/51/96 ms

-----相对于pix 8.0，不用配置NAT免除。

七.验证tcp连接

A.R2 TELNET R3

R2#telnet 20.1.1.3

Trying 20.1.1.3 ... 

% Connection timed out; remote host not responding

R2#

防火墙日志如下:

%ASA-7-609001: Built local-host inside:10.1.1.2

%ASA-7-609001: Built local-host inside:20.1.1.3

%ASA-6-302013: Built inbound TCP connection 43 for inside:10.1.1.2/23957 (10.1.1.2/23957) to inside:20.1.1.3/23 (20.1.1.3/23)

%ASA-6-302014: Teardown TCP connection 43 for inside:10.1.1.2/23957 to inside:20.1.1.3/23 duration 0:00:00 bytes 0 TCP Reset-O

%ASA-7-609002: Teardown local-host inside:10.1.1.2 duration 0:00:00

%ASA-7-609002: Teardown local-host inside:20.1.1.3 duration 0:00:00

%ASA-6-302013: Built inbound TCP connection 44 for inside:10.1.1.2/23957 (10.1.1.2/23957) to inside:20.1.1.3/23 (20.1.1.3/23)

%ASA-6-302014: Teardown TCP connection 44 for inside:10.1.1.2/23957 to inside:20.1.1.3/23 duration 0:00:00 bytes 0 TCP Reset-O

%ASA-6-106015: Deny TCP (no connection) from 10.1.1.2/23957 to 20.1.1.3/23 flags RST  on interface inside

B.R3 TELNET R2

R3#telnet 10.1.1.2

Trying 10.1.1.2 ... 

R3#

防火墙对应日志如下：

%ASA-6-106015: Deny TCP (no connection) from 10.1.1.2/23 to 20.1.1.3/21221 flags SYN ACK  on interface inside

%ASA-6-106015: Deny TCP (no connection) from 10.1.1.2/23 to 20.1.1.3/21221 flags ACK  on interface inside

C.分析不通的原因

①R2 TELNET R3

   tcp三次握手，R2发出SYN包经过防火墙inside接口转发，送给R1，到达R3，

                            R3回复的SYN-ACK到达R1后，R1直接给了R2，

                            R2收到了SYN-ACK包后，回复ACK包，但是包送给了防火墙，防火墙更改ACK值后转给R1，最终到达R3并被其丢弃。

----------备注：在模拟器中抓包时发现奇怪的现象，R3回复的SYN-ACK包从R1的接口出来是ACK=1，但是到达R2后ACK=666538828,从而被R2拒绝。

②配置MPF:

ciscoasa(config)# access-list inside-inside permit ip object inside-network1 object insdie-network2

ciscoasa(config)# access-list inside-inside permit ip object inside-network2 object insdie-network1

ciscoasa(config)# class-map inside

ciscoasa(config-cmap)# match access-list inside-inside

ciscoasa(config)# policy-map inside

ciscoasa(config-pmap)# class inside

ciscoasa(config-pmap-c)# set connection random-sequence-number disable

③telnet出现了变化，出现open：

Trying 20.1.1.3 ... Open

lll

^C

^Z

^^^C^C^C^C^C^C

^^^^^^^^^^^

quit

[Connection to 20.1.1.3 closed by foreign host]

--------通过抓包发现三次握手成功建立，但是后续的会话无法双向进行，所以停留在连接状态，需要手工输入quit才会退出。

④.R3 TELNET R2

  tcp三次握手，R3发出的SYN包到底R1后，R1直接给了R2，但是R2回复SYN-ACK包时给了防火墙，被防火墙丢弃，从而TCP三次握手无法建立。

7. 两种解决方式：

A.来回的数据包都不经过防火墙

R2上添加去往20.1.1.0的路由器走R1

R2(config)#ip route 20.1.1.0 255.255.255.0 10.1.1.1

----TELNET测试正常

R3#  telnet 10.1.1.2

Trying 10.1.1.2 ... Open

User Access Verification

Password: 

B.来回的数据包都经过防火墙

①R1设定策略路由,指定下一跳为防火墙接口

R1(config)#ip access-list extended inside

R1(config-ext-nacl)#permit ip any 10.1.1.0 0.0.0.255

R1(config-ext-nacl)#exit

R1(config)#route-map inside permit 10

R1(config-route-map)#match ip address inside

R1(config-route-map)#set ip next-hop 10.1.1.10

R1(config-route-map)#exit

R1(config)#interface f0/1

R1(config-if)#ip policy rout

R1(config-if)#ip policy route-map inside

R1(config-if)#exit

Password:

②R1上添加主机路由，指向防火墙

R1(config)#ip route 10.1.1.2 255.255.255.255 10.1.1.10

③R1上设定101.1.2的mac地址为防火墙inside接口的mac地址

ASA# show interface e0

Interface Ethernet0 "inside", is up, line protocol is up

 Hardware is i82559, BW 100 Mbps, DLY 100 usec

       Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)

       MAC address 00ab.bffb.c400, MTU 1500

       IP address 10.1.1.10, subnet mask 255.255.255.0

R1(config)#arp 10.1.1.2 00ab.bffb.c400 arpa 

8.总结：

A.ASA8.42 从同一接口进又从该接口出的流量不会撞击NAT,因此不需配置NAT免除

-----我的理解，因为object中配置NAT时已经指定了区域的原因，这是新NAT与传统NAT配置的优势，一个语句就搞定。

B.ASA8.3之后的NAT跟以前版本的NAT配置方式有很大的不同

<b>本文转自 碧云天 51CTO博客，原文链接：</b><b>http://blog.51cto.com/333234/859180</b><b>，如需转载请自行联系原作者</b>