ASA配置笔记

ASA配置笔记 ASA配置笔记

1. 常用技巧....................................................................................... 1 2. 故障倒换....................................................................................... 1 3. 配置telnet、ssh及http管理............................................................ 3 4. vpn常用管理命令.......................................................................... 3 5. 配置访问权限................................................................................ 3 6. 配置sitetosite之VPN...................................................................... 4 7. webvpn配置（ssl vpn）................................................................. 4 8. 远程拨入VPN................................................................................ 5 9. 日志服务器配置............................................................................. 6 10. Snmp网管配置............................................................................. 7 11. ACS配置...................................................................................... 7 12. AAA配置..................................................................................... 7 13. 升级IOS...................................................................................... 8 14. 疑难杂症...................................................................................... 8

1. 常用技巧

Sh ru ntp查看与ntp有关的 Sh ru crypto 查看与vpn有关的

Sh ru | inc crypto 只是关健字过滤而已 2. 故障倒换 failover

failover lan unit primary

failover lan interface testint Ethernet0/3 failover link testint Ethernet0/3

failover mac address Ethernet0/1 0018.1900.5000 0018.1900.5001

failover mac address Ethernet0/0 0018.1900.4000 0018.1900.4001 failover mac address Ethernet0/2 0018.1900.6000 0018.1900.6001 failover mac address Management0/0 0018.1900.7000 0018.1900.7001 failover interface ip testint 10.3.3.1 255.255.255.0 standby 10.3.3.2

注：最好配置虚拟MAC地址 sh failover显示配置信息

write standby写入到备用的防火墙中 failover命令集如下：

configure mode commands/options:

interface Configure the IP address and mask to be used for failover and/or stateful update information

interface-policy Set the policy for failover due to interface failures key Configure the failover shared secret or key

lan Specify the unit as primary or secondary or configure the interface and vlan to be used for failover communication link Configure the interface and vlan to be used as a link for stateful update information

mac Specify the virtual mac address for a physical interface polltime Configure failover poll interval

replication Enable HTTP (port 80) connection replication

timeout Specify the failover reconnect timeout value for asymmetrically routed sessions

sh failover 命令集如下：

history Show failover switching history

interface Show failover command interface information state Show failover internal state information

statistics Show failover command interface statistics information | Output modifiers

3. 配置telnet、ssh及http管理

username jiang password Csmep3VzvPQPCbkx encrypted privilege 15 aaa authentication enable console LOCAL aaa authentication telnet console LOCAL aaa authentication ssh console LOCAL aaa authorization command LOCAL

http 192.168.40.0 255.255.255.0 management ssh 192.168.40.0 255.255.255.0 inside 4. vpn常用管理命令

sh vpn-sessiondb full l2l 显示site to site 之vpn通道情况 sh ipsec stats 显示ipsec通道情况

sh vpn-sessiondb summary 显示vpn汇总信息 sh vpn-sessiondb detail l2l 显示ipsec详细信息 sh vpn-sessiondb detail svc 查看ssl client信息

sh vpn-sessiondb detail webvpn 查看webvpn信息

sh vpn-sessiondb detail full l2l 相当于linux下的ipsec whack ?Cstatus 如果没有建立连接，则表示ipsec通道还没有建立起来。 5. 配置访问权限

可以建立对象组，设定不同的权限，如： object-group network testgroup description test

network-object 192.168.100.34 255.255.255.255

access-list inside_access_in line 2 extended permit ip object-group all any access-group inside_access_in in interface inside

6. 配置sitetosite之VPN

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map outside_map 20 match address outside_cryptomap_20_1 crypto map outside_map 20 set pfs

crypto map outside_map 20 set peer 218.16.105.48

crypto map outside_map 20 set transform-set ESP-3DES-SHA crypto map outside_map interface outside isakmp identity address isakmp enable outside

isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash sha isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

tunnel-group 218.16.105.48 type ipsec-l2l tunnel-group 218.16.105.48 ipsec-attributes pre-shared-key *

peer-id-validate nocheck

tunnel-group-map enable rules

注：打打PFS并设定以IP地址作为peer名，一个接口只能有一个加密图 7. webvpn配置（ssl vpn） webvpn

enable outside

character-encoding gb2312

csd image disk0:/securedesktop-asa-3.1.1.16.pkg svc image disk0:/sslclient-win-1.1.0.154.pkg 1 svc enable

customization customization1 title text TEST WebVPN system

title style background-color:white;color: rgb(51,153,0);border-bottom:5px groo ve #669999;font-size:larger;vertical-align:middle;text-align:left;font-weight:bold tunnel-group-list enable

注：也可通过ASDM图形界面进行配置 登录后，可访问内部资源，如下例：（客户端首先要安装Java插件jre-1_5_0-windows-i586.exe,并打开浏览器的ActiveX）

1) https://sslvpn.test.com.cn 输入用户名和密码 2) 出现工具条

3) 在Enter Web Address内输入192.168.40.8即可访问内部网站 4）在browse network输入192.168.40.8即可访问共享文件

5)点击application access，即可查看端口转发设置，如使用putty访问本机的2023端口，则即可通过ssh登录192.168.40.8 8. 远程拨入VPN 相关的ASA配置命令如下：

access-list inside_access_in extended permit ip object-group remotegroup any access-list inside_access_in extended permit icmp object-group remotegroup any access-list remotevpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0 access-list vpnclient_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0 ip local pool dialuserIP 192.168.101.1-192.168.101.254 mask 255.255.255.0 group-policy remotevpn attributes

dns-server value 202.96.128.68 192.168.40.16 default-domain value test.com.cn

username jiang password Csmep3VzvPQPCbkx encrypted privilege 15 crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA crypto dynamic-map outside_dyn_map 20 set reverse-route

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside tunnel-group remotevpn type ipsec-ra

tunnel-group remotevpn general-attributes address-pool dialuserIP

default-group-policy remotevpn

tunnel-group remotevpn ipsec-attributes pre-shared-key * 客户端设置如下：

9. 日志服务器配置 logging enable logging timestamp logging emblem

logging trap informational logging asdm warnings

logging host inside 192.168.40.115 format emblem logging permit-hostdown vpn-simultaneous-logins 3

10. Snmp网管配置

snmp-server host inside 192.168.40.47 community testsnmp snmp-server location DG-GTEST

snmp-server contact jiangdaoyou:6162 snmp-server community testsnmp

snmp-server enable traps snmp authentication linkup linkdown coldstart 注：指定主机后，192.168.40.47才可能进行管理 11. ACS配置

安装后管理：http://ip:2002 通过ACS可以进行授权、认证等等很多功能 因内容太多，暂省略 12. AAA配置 Aaa服务器配置：

aaa-server radius_dg host dc03.xxxx.com key dfdfdfdf146**U

authentication-port 1812 accounting-port 1813

radius-common-pw dfdfdfdf146**U 对于拨入vpn的配置

tunnel-group vg_testerp general-attributes address-pool ciscovpnuser

authentication-server-group radius_dg default-group-policy vg_testerp

13. 升级IOS

copy tftp://192.168.40.180/asa/asa721-k8.bin disk0:/asa721-k8.bin

boot system disk0:/asa721-k8.bin （多个Image时使用）

interface Vlan2

nameif outside --------------------对端口命名外端口 security-level 0 --------------------设置端口等级 ip address X.X.X.X 255.255.255.224 --------------------调试外网地址 !

interface Vlan3

nameif inside --------------------对端口命名内端口 security-level 100 --------------------调试外网地址 ip address 192.168.1.1 255.255.255.0 --------------------设置端口等级 !

interface Ethernet0/0

switchport access vlan 2 --------------------设置端口VLAN与VLAN2绑定 !

interface Ethernet0/1

switchport access vlan 3 --------------------设置端口VLAN与VLAN3绑定 !

interface Ethernet0/2 shutdown !

interface Ethernet0/3 shutdown !

interface Ethernet0/4 shutdown !

interface Ethernet0/5 shutdown !

interface Ethernet0/6 shutdown !

interface Ethernet0/7 shutdown !

passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive

dns domain-lookup inside dns server-group DefaultDNS name-server 211.99.129.210 name-server 202.106.196.115

access-list 102 extended permit icmp any any ------------------设置ACL列表（允许ICMP全部通过）

access-list 102 extended permit ip any any ------------------设置ACL列表（允许所有IP全部通过） pager lines 24 mtu outside 1500 mtu inside 1500

icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400

global (outside) 1 interface ------------------设置NAT地址映射到外网口

nat (inside) 1 0.0.0.0 0.0.0.0 ------------------NAT地址池（所有地址） access-group 102 in interface outside ------------------设置ACL列表绑定到外端口 route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 ------------------设置到外网的默认路由 timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute no snmp-server location no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet 0.0.0.0 0.0.0.0 inside ------------------设置TELNET所有地址进入

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside ------------------设置SSH所有地址进入 ssh timeout 30 ssh version 2

console timeout 0 !

dhcpd address 192.168.1.100-192.168.1.199 inside ------------------设置DHCP服务器地址池

dhcpd dns 211.99.129.210 202.106.196.115 interface inside ------------------设置DNS服务器到内网端口

dhcpd enable inside ------------------设置DHCP应用到内网端口

CD-ASA5520# show run : Saved :

ASA Version 7.2(2) !

hostname CD-ASA5520 //给防火墙命名

domain-name default.domain.invalid //定义工作域 enable password 9jNfZuG3TC5tCVH0 encrypted // 进入特权模式的密码 names dns-guard !

interface GigabitEthernet0/0 //内网接口：

duplex full //接口作工模式：全双工，半双，自适应 nameif inside //为端口命名 ：内部接口inside

security-level 100 //设置安全级别 0~100 值越大越安全 ip address 192.168.1.1 255.255.255.0 //设置本端口的IP地址 !

interface GigabitEthernet0/1 //外网接口

nameif outside //为外部端口命名 ：外部接口outside security-level 0

ip address 202.98.131.122 255.255.255.0 //IP地址配置 !

interface GigabitEthernet0/2 nameif dmz security-level 50

ip address 192.168.2.1 255.255.255.0 !

interface GigabitEthernet0/3 shutdown no nameif

no security-level no ip address !

interface Management0/0 //防火墙管理地址 shutdown no nameif

no security-level no ip address !

passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive clock timezone CST 8

dns server-group DefaultDNS

domain-name default.domain.invalid

access-list outside_permit extended permit tcp any interface outside eq 3389

//访问控制列表

access-list outside_permit extended permit tcp any interface outside range 30000 30010 //允许外部任何用户可以访问outside 接口的30000-30010的端口。 pager lines 24

logging enable //启动日志功能 logging asdm informational

mtu inside 1500 内部最大传输单元为1500字节 mtu outside 1500 mtu dmz 1500

ip local pool vpnclient 192.168.200.1-192.168.200.200 mask 255.255.255.0 //定义一个命名为vpnclient的IP地址池,为remote用户分配IP地址 no failover

icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-522.bin no asdm history enable

arp timeout 14400 //arp空闲时间为14400秒

global (outside) 1 interface //由于没有配置NAT 故这里是不允许内部用户上INTERNET

static (dmz,outside) tcp interface 30000 192.168.2.2 30000 netmask 255.255.255.255 //端口映射 可以解决内部要公布的服务太多，而申请公网IP少问题。

static (dmz,outside) tcp interface 30001 192.168.2.2 30001 netmask 255.255.255.255 //把dmz区192.168.2.2 30002 映射给外部30002端口上。

static (dmz,outside) tcp interface 30002 192.168.2.2 30002 netmask 255.255.255.255 static (dmz,outside) tcp interface 30003 192.168.2.2 30003 netmask 255.255.255.255 static (dmz,outside) tcp interface 30004 192.168.2.2 30004 netmask 255.255.255.255 static (dmz,outside) tcp interface 30005 192.168.2.2 30005 netmask 255.255.255.255 static (dmz,outside) tcp interface 30006 192.168.2.2 30006 netmask 255.255.255.255 static (dmz,outside) tcp interface 30007 192.168.2.2 30007 netmask 255.255.255.255 static (dmz,outside) tcp interface 30008 192.168.2.2 3008 netmask 255.255.255.255 static (dmz,outside) tcp interface 30009 192.168.2.2 30009 netmask 255.255.255.255 static (dmz,outside) tcp interface 30010 192.168.2.2 30010 netmask 255.255.255.255 static (dmz,outside) tcp interface 3389 192.168.2.2 3389 netmask 255.255.255.255 access-group outside_permit in interface outside

//把outside_permit控制列表运用在外部接口的入口方向。

route outside 0.0.0.0 0.0.0.0 202.98.131.126 1 //定义一个默认路由。 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute

------------定义一个命名为vpnclient的组策略-------------------------

group-policy vpnclient internal //创建一个内部的组策略。 group-policy vpnclient attributes //设置vpnclient组策略的参数 wins-server value 192.168.1.10 //定义WINS-SERVER 的IP地址。 dns-server value 192.168.1.10 61.139.2.69 //定义dns-server的IP地址。 vpn-idle-timeout none //终止连接时间设为默认值 vpn-session-timeout none //会话超时采用默认值

vpn-tunnel-protocol IPSec //定义通道使用协议为IPSEC。 split-tunnel-policy tunnelspecified //定义。

default-domain value my3377.com //定义默认域名为my3377.com ------------定义一个命名为l2lvpn的组策略------------------------- group-policy l2lvpn internal group-policy l2lvpn attributes wins-server value 192.168.1.10

dns-server value 192.168.1.10 61.139.2.69 vpn-simultaneous-logins 3 vpn-idle-timeout none vpn-session-timeout none vpn-tunnel-protocol IPSec

username test password P4ttSyrm33SV8TYp encrypted privilege 0 //创建一个远程访问用户来访问安全应用

username my3377 password 3USUcOPFUiMCO4Jk encrypted http server enable //启动HTTP服务

http 0.0.0.0 0.0.0.0 inside //允许内部主机HTTP连接 no snmp-server location no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart //snmp的默认配置

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

//配置转集（定义了IPSC隧道使用的加密和信息完整性算法集合） crypto dynamic-map vpn_dyn_map 10 set transform-set ESP-DES-MD5 //为动态加密图条目定义传换集

crypto map outside_map 10 ipsec-isakmp dynamic vpn_dyn_map //创建一个使用动态加密条目的加密图 crypto map outside_map interface outside

//将 outside_map加密图应用到outside端口 ------------配置IKE--------------

crypto isakmp enable outside //在ostside 接口启动ISAKMP crypto isakmp policy 20 //isakmmp权值，值越小权值越高 authentication pre-share //指定同位体认证方法是共享密钥 encryption des //指定加密算法

hash md5 //指定使用MD5散列算法 group 2 //指定diffie-hellman组2

lifetime 86400 //指定SA（协商安全关联）的生存时间 crypto isakmp policy 65535 authentication pre-share encryption des hash md5 group 2

lifetime 86400

-------------调用组策略----------------- crypto isakmp nat-traversal 20

tunnel-group DefaultL2LGroup general-attributes //配置这个通道组的认证方法 default-group-policy l2lvpn //指定默认组策略名称。 tunnel-group DefaultL2LGroup ipsec-attributes //配置认证方法为IPSEC

pre-shared-key * //提供IKE连接的预共享密钥

tunnel-group vpnclient type ipsec-ra //设置连接类型为远程访问。 tunnel-group vpnclient general-attributes //配置这个通道组的认证方法 address-pool vpnclient //定义所用的地址池 default-group-policy vpnclient //定义默认组策略 -----设置认证方式和共享密钥-------------

tunnel-group vpnclient ipsec-attributes //配置认证方法为IPSEC pre-shared-key * //提供IKE连接的预共享密钥 telnet timeout 5 //telnet 超时设置

ssh 0.0.0.0 0.0.0.0 outside //允许外部通SSH访问防火墙 ssh timeout 60 //SSH连接超时设置

console timeout 0 //控制台超时设置

dhcp-client update dns server both

dhcpd dns 61.139.2.69 202.98.96.68 //dhcp 发布的DNS !

dhcpd address 192.168.1.10-192.168.1.254 inside //向内网发布的地址池 dhcpd enable inside //启动DHCP服务。 ! !

class-map inspection_default match default-inspection-traffic ! !

policy-map type inspect dns migrated_dns_map_1 parameters

message-length maximum 512 policy-map global_policy class inspection_default

inspect dns migrated_dns_map_1 inspect ftp

inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp !

service-policy global_policy global prompt hostname context

Cryptochecksum:25e66339116f52e443124a23fef3d373 : end

dhcp-client update dns server both

dhcpd dns 61.139.2.69 202.98.96.68 //dhcp 发布的DNS !

dhcpd address 192.168.1.10-192.168.1.254 inside //向内网发布的地址池 dhcpd enable inside //启动DHCP服务。 ! !

class-map inspection_default match default-inspection-traffic ! !

policy-map type inspect dns migrated_dns_map_1 parameters

message-length maximum 512 policy-map global_policy class inspection_default

inspect dns migrated_dns_map_1 inspect ftp

inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp !

service-policy global_policy global prompt hostname context

Cryptochecksum:25e66339116f52e443124a23fef3d373 : end

本文来源：https://www.bwwdw.com/article/gs97.html