双区域ASA配置

Posted 2022-05-23 BE冢虎

实验需求：

配置ASA的接口和ACL，并验证接口间的通信。

实验环境：

实验配置：

配置接口：

asa:

enable
config terminal
interface gigabitEthernet 1
nameif inside
security-level 100
ip address 10.1.1.254 255.255.255.0
no shut
interface gigabitEthernet 0
nameif outside
security-level 0
ip address 172.16.1.254 255.255.255.0
no shut

R1:

config terminal
int e0/0
duplex full
ip address 10.1.1.1 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 10.1.1.254

R2:

config terminal
int e0/0
duplex full
ip address 172.16.1.1 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 172.16.1.254

配置telnet:

username bdqn privilege 15 password 123.123
line vty 0 4
login local 
transport input telnet
exit

验证在R1上可以Telnet到R2，但在R2上不能Telnet到R1，测试R1能否ping通R2。

配置ACL：

access-list ping permit icmp any any
access-group ping in interface outside
access-list telnet permit ip host 172.16.1.1 host 10.1.1.1
access-group telnet in interface outside

测试ACL配置是否成功

使用show conn detail命令查看ASA Conn表。

配置完成，实验结束。

（如有疏漏，还请读者指出）