Cisco ASA站点间穿越nat互相访问的实验
1、 实验拓扑图:
1、 实验说明:
R1作为A公司的站点1,内部有台1.1.1.1/32的服务器需要A公司站点2的管理员实行远程telnet的设备管理;
R5作为A公司的站点2,内部有台2.2.2.2/32的服务器需要A公司站点1的管理员实行远程telnet的设备管理;
设备之间都有ASA防火墙的安全保护,R2作为互联网的一台路由器;
2、 实验配置:
R1#show run
usernamecisco password 0 cisco
!
interfaceLoopback0 //站点2管理员通过该地址进行R1设备的管理
ip address 1.1.1.1 255.255.255.0
!
interfaceLoopback1 //正常通过NAT上网的用户地址段
ip address 10.10.10.10 255.255.255.0
!
interfaceFastEthernet0/0
ip address 172.16.255.1 255.255.255.192
duplex auto
speed auto
!
interfaceFastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
routerospf 1
log-adjacency-changes
network 1.1.1.0 0.0.0.255 area 1
network 10.10.10.0 0.0.0.255 area 1
network 172.16.255.0 0.0.0.63 area 1
!
ipforward-protocol nd
!
no iphttp server
no iphttp secure-server
!
control-plane
!
line con0
exec-timeout 0 0
logging synchronous
line aux0
line vty0 4
password cisco
login local
transport input telnet
ASA1#show run
interfaceEthernet0/0
nameif Inside
security-level 100
ip address 172.16.255.2 255.255.255.192
!
interfaceEthernet0/1
nameif Outside
security-level 0
ip address 202.16.1.2 255.255.255.248
!
access-listoutside extended permit ip 10.10.10.0 255.255.255.0 any
access-listout extended permit icmp any any
access-listout extended permit tcp host 202.16.1.12 host 202.16.1.5 eq telnet
nat-control
global(Outside) 1 interface
nat(Inside) 1 access-list outside
static(Inside,Outside) 202.16.1.5 1.1.1.1 netmask 255.255.255.255
access-groupout in interface Outside
!
routerospf 1
network 172.16.255.0 255.255.255.192 area 1
log-adj-changes
default-information originate always
!
routeOutside 0.0.0.0 0.0.0.0 202.16.1.1 1
R2#show run
interfaceFastEthernet0/0
ip address 202.16.1.1 255.255.255.248
duplex auto
speed auto
!
interfaceFastEthernet0/1
ip address 202.16.1.9 255.255.255.248
duplex auto
speed auto
ASA2#show run
interfaceEthernet0/0
nameif Inside
security-level 100
ip address 172.16.255.130 255.255.255.192
!
interfaceEthernet0/1
nameif Outside
security-level 0
ip address 202.16.1.10 255.255.255.248
!
access-listout extended permit icmp any any
access-listout extended permit tcp host 202.16.1.5 host 202.16.1.12 eq telnet
access-listinside_nat1_outside extended permit ip 10.10.20.0 255.255.255.0 any
global(Outside) 1 interface
nat(Inside) 1 access-list inside_nat1_outside
static(Inside,Outside) 202.16.1.12 2.2.2.2 netmask 255.255.255.255
access-groupout in interface Outside
!
routerospf 10
network 172.16.255.128 255.255.255.192 area 0
log-adj-changes
default-information originate always
!
routeOutside 0.0.0.0 0.0.0.0 202.16.1.9 1
R3#show run
usernamecisco password 0 cisco
!
interfaceLoopback0 //站点2路由器需要通过该地址被管理
ip address 2.2.2.2 255.255.255.0
!
interfaceLoopback1 //用户上网地址
ip address 10.10.20.10 255.255.255.0
!
interfaceFastEthernet0/0
ip address 172.16.255.129 255.255.255.192
duplex auto
speed auto
!
routerospf 10
log-adjacency-changes
network 2.2.2.0 0.0.0.255 area 0
network 10.10.20.0 0.0.0.255 area 0
network 172.16.255.128 0.0.0.63 area 0
!
line vty0 4
password cisco
login local
transport input telnet
3、 站点间的互访测试:
R1#ping 202.16.1.9 source 10.10.10.10 //用户访问互联网
Typeescape sequence to abort.
Sending5, 100-byte ICMP Echos to 202.16.1.9, timeout is 2 seconds:
Packetsent with a source address of 10.10.10.10
!!!!!
Successrate is 100 percent (5/5), round-trip min/avg/max = 16/27/40 ms
Ciscoasa1# show xlate
2 in use,3 most used
PAT Global 202.16.1.2(2) Local10.10.10.10 ICMP id 23 //执行了正常的PAT转换
R1#telnet 202.16.1.12 /source-interfaceloopback 0 //正常的管理站点2设备
Trying 202.16.1.12 ... Open
!
User Access Verification
!
Username: cisco
Password:
R3>en
Password:
Password:
R3#
Ciscoasa1#show xlate //原因在于防火墙中有这条静态映射条目
1 in use, 3 most used
Global 202.16.1.5 Local 1.1.1.1
反之从R3– R1的测试结果是一样的,就由各位IT自己测试了。
本文出自 “我的技术博客” 博客,谢绝转载!
郑重声明:本站内容如果来自互联网及其他传播媒体,其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享,并不代表本站赞同其观点和对其真实性负责,也不构成任何其他建议。