ASA防火墙新版本8.4-工程实用手册.docx

ASA防火墙新版本8.4-工程实用手册注意，现在思科ASA防火墙已经升级到8.4，从8.3开始很多配置都有颠覆性的不同，特别是NAT配置很不一样，使用了object /object-group的新方式这里为了大家工程实施起来方便，特别总结了如下NAT应用，希望能够帮助大家。ASA 8.3 NAT 转化新语法：Topology ：L100 200.0.9.10 R1 ---.2----192.168.1.0----.1---ASA----.1----10.10.10.0---.2---R2 L100 100.1.64.1The order of operations works as configured by each section. In order:1. Manual Nat2. Auto Nat3. After AutoDynamic NAT/PAT场景一：所有内网流量访问外网时都转换为接口的公网地址，此环境适用于仅有一个公网地址的小型办公室。Object network inside-outside-allSubnet 0.0.0.0 0.0.0.0Nat (inside,outside) dynamic interface原有的语法nat (inside) 1 0 0 global (outside) 1 interface验证：ciscoasa(config)# show nat detailAuto NAT Policies (Section 2)1 (inside) to (outside) source dynamic inside-outside-all interfacetranslate_hits = 1, untranslate_hits = 0Source - Origin: 0.0.0.0/0, Translated: 10.10.10.1/24ciscoasa(config)# show xlate1 in use, 4 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceTCP PAT from inside:192.168.1.2/18523 to outside:10.10.10.1/18124 flags ri idle 0:00:20 timeout 0:00:30ciscoasa(config)# show conn1 in use, 1 most usedTCP outside 100.1.64.1:23 inside 192.168.1.2:18523, idle 0:00:00, bytes 117, flags UIO场景二所有内网流量访问外网时都转换为特定的公网地址，此环境适用于的小型办公室或分支办公室。Object network inside-outside-allSubnet 0.0.0.0 0.0.0.0Nat (inside,outside) dynamic 10.10.10.3原有的语法nat (inside) 1 0 0global (outside) 1 10.10.10.3验证ciscoasa(config)# show nat detailAuto NAT Policies (Section 2)1 (inside) to (outside) source dynamic inside-outside-all 10.10.10.3translate_hits = 3, untranslate_hits = 0Source - Origin: 0.0.0.0/0, Translated: 10.10.10.3/32ciscoasa(config)# show xlate2 in use, 4 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twiceTCP PAT from inside:192.168.1.2/33470 to outside:10.10.10.3/46897 flags ri idle 0:00:10 timeout 0:00:30ICMP PAT from inside:192.168.1.2/33 to outside:10.10.10.3/50079 flags ri idle 0:00:15 timeout 0:00:30ciscoasa(config)# show conn1 in use, 1 most usedTCP outside 100.1.64.1:23 inside 192.168.