从PC1可以访问outside和dmz区啲网站，从Out主机可以访问DMZ区啲Web站点
从PC1可以ping通Out主机
实现思路
在ASA上配置只允许PC1进行SSH接入
配置nat和global命令实现从PC1可以访问outside和 dmz区啲网站，配置static和acl实现从Out主机可以访问DMZ区啲Web站点
在ASA上配置允许ICMP应答报文穿越ASA防火墙
1. 配置R1
Router>en
Router#conf t
Router(config)#host R1
R1(config)#line 0
R1(config-line)#logg s
R1(config-line)#exit
R1(config)#int f0/0
R1(config-if)#ip add 200.20.20.254 255.255.255.0
R1(config-if)#no shut
R1(config-if)#int f1/0
R1(config-if)#ip add 200.1.1.1 255.255.255.252
R1(config-if)#no shut
R1(config-if)#exit
ip route 200.10.10.248 255.255.255.248 200.1.1.2\\添加路由
R1(config)#do show ip int b
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 200.20.20.254 YES manual up up
FastEthernet1/0 200.1.1.1 YES manual up up
2. 配置ASAde主机名、域名和密码
ciscoasa> en
Password: \\开始为空，直接回车就Ok！
ciscoasa# conf t
ciscoasa(config)# hostname ASA\\配置主机名
ASA(config)# domain-name benet.com\\配置域名
ASA(config)# enable password cisco\\配置特权（使能）密码
ASA(config)# passwd cisco\\配置远程登录密码
3. 配置ASAde接口
ASA(config)# int e0/0
ASA(config-if)# nameif inside\\定义接口名字
INFO: Security level for "inside" set to 100 by default.
ASA(config-if)# security-level 100\\定义安全级别
ASA(config-if)# ip add 10.10.10.254 255.255.255.0
ASA(config-if)# no shut
ASA(config-if)# int e0/1
ASA(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by default.
ASA(config-if)# security-level 50
ASA(config-if)# ip add 10.20.20.254 255.255.255.0
ASA(config-if)# no shut
ASA(config-if)# int e0/2
ASA(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ASA(config-if)# security-level 0
ASA(config-if)# ip add 200.1.1.2 255.255.255.252
ASA(config-if)# no shut
ASA(config-if)# exit
ASA(config)# show ip
System IP Addresses:
Interface Name IP address Subnet mask Method
Ethernet0/0 inside 10.10.10.254 255.255.255.0 manual
Ethernet0/1 dmz 10.20.20.254 255.255.255.0 manual
Ethernet0/2 outside 200.1.1.2 255.255.255.252 manual
Current IP Addresses:
Interface Name IP address Subnet mask Method
Ethernet0/0 inside 10.10.10.254 255.255.255.0 manual
Ethernet0/1 dmz 10.20.20.254 255.255.255.0 manual
Ethernet0/2 outside 200.1.1.2 255.255.255.252 manual
4. 验证ASA是否可以pingde通Route计算机基础知识试题及答案
ASA(config)# ping 200.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/70/310 ms
5. 配置ASAde默认路由
ASA(config)# route outside 0.0.0.0 0.0.0.0 200.1.1.1
ASA(config)# show route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 200.1.1.1 to network 0.0.0.0
C 200.1.1.0 255.255.255.252 is directly connected, outside
C 10.20.20.0 255.255.255.0 is directly connected, dmz
C 10.10.10.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 200.1.1.1, outside
6. 在ASA上配置只允许PC1进行SSH接入
ASA(config)# crypto key generate rsa modulus 1024
INFO: The name for the keys will be:
Keypair generation process begin. Please wait...
\\生成RSA密钥对
ASA(config)# ssh 10.10.10.1 255.255.255.255 inside
\\只允许PC1进行SSH接入
7. 验证从PC1利用SSH可以远程登录到ASA 计算机基础教程
8. 为出站流量配置网络地址转换（NAT）,使用global命令定义一个全局地址池
ASA(config)# nat-control \\启用NAT
ASA(config)# nat (inside) 1 0 0\\为内网所有地址实施NAT
ASA(config)# global (outside) 1 int\\使outside接口地址作为PAT转换
INFO: outside interface address added to PAT pool
ASA(config)# global (dmz) 1 200.10.10.249-200.10.10.254\\定义一个全局地址池
9. 在PC1上可以访问outside和dmz区啲网站电脑入门
10. 在ASA上使用命令“show xlate”可以查看到两条地址转换条目计算机
ASA(config)# show xlate
2 in use, 2 most used
PAT Global 200.1.1.2(1024) Local 10.10.10.1(1163)
Global 200.10.10.249 Local 10.10.10.1
11. 配置ACL使PC1可以Ping同Out主机
ASA(config)# access-list 111 permit icmp any any echo-reply
ASA(config)# access-list 111 permit icmp any any unreachable
ASA(config)# access-list 111 permit icmp any any time-exceeded
ASA(config)# access-group 111 in interface outside\\应用到接口
