如何使用vmware和GNS3模拟ASA第一部分：首先手头的文件：1.GNS 32.ASA模拟器3.Vmware4.5.ASDM软件6.7.8.rules 文件接口分布规则：R0 F0/0 172.16.0.100R1 F0/0 172.16.1.100R2 F0/0 172.16.2.100ASA E0/0 172.16.0.200ASA E0/1 172.16.1.200ASA E0/2 172.16.2.200Loopback0 172.16.0.2Loopback1 172.16.1.2Loopback2 172.16.2.2第二部分，具体实施，分成几个步骤来做：第一：在装有windows的主机上建立3个环回口，并且为每个接口配置地址。
第二：运行安装有asa软件的linux系统，此系统安装在vmware上，其实就是启动vmware。
第三：实现asa的E0/0----Loopback 0, E0/1----Loopback 1, E0/2----Loopback 2之间的桥接3.1.首先实现vmware中vmnet和loopback口的桥接Vmnet 0-----Loopback 0，Vmnet 1-----Loopback 1，Vmnet 2-----Loopback 2，3.2 再实现vmware中vmnet和E0/0口的桥接Vmnet 0----E0/0，Vmnet 1----E0/1，Vmnet 2----E0/2第四，实现本地环回口和路由器的桥接，即：Loopback 0-----R0 F0/0,Loopback 1-----R1 F0/0,Loopback 2-----R2 F0/04.1,首先运行GNS 3，取出三个路由分别和本地接口互联实际上C0桥接到R0，C1桥接到R1……，就像下图最后效果就如下所示啦！第五最后，如果使用telnet 登陆到asa服务器和用asdm来管理asa呢？5.1 用telnet 来登陆到asa首先进入vmware 设置串口连接管道，注意 \\.\pipe\ASA注意，设置管道以后不能通过telnet直接登陆到ASA，需要借助一个软件nptp.exe,安装好以后,edit-new添加一个新连接，做好如图设置，端口号4000 保存连接后，状态为ready；然后打开vmware中的ASA系统，会显示如下状态，放置不用管他【内核已运行】！使用telnet 登录127.0.0.1 port 4000 即可！6、如何实现asdm来界面管理ASA呢？Asa需要一个bin文件的支持才可以页面式管理！首先为asa打开http服务：ciscoasa(config)# int e0/1 【dmz接口】ciscoasa(config-if)# http server enableciscoasa(config)# http 0 0 insideciscoasa(config)# username fanghao password fanghao privilege 15接下来利用tftp服务器拷贝一个bin文件补丁到ASA的ios中来支持页面管理。
zly(config-if)# show interfaceInterface GigabitEthernet0/0 "inside", is up, line protocol is upHardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usecFull-Duplex(Full-duplex), 1000 Mbps(1000 Mbps)MAC address 0023.5e25.5d9a, MTU 1500IP address 192.168.1.1, subnet mask 255.255.255.0261794 packets input, 18065039 bytes, 0 no bufferReceived 252123 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort147 L2 decode drops25202 packets output, 18524350 bytes, 0 underruns0 output errors, 0 collisions, 4 interface resets0 late collisions, 0 deferred0 input reset drops, 0 output reset dropsinput queue (curr/max packets): hardware (4/25) software (0/0)output queue (curr/max packets): hardware (0/24) software (0/0) Traffic Statistics for "inside":261634 packets input, 13278798 bytes25202 packets output, 18060271 bytes67127 packets dropped1 minute input rate2 pkts/sec, 130 bytes/sec1 minute output rate 0 pkts/sec, 329 bytes/sec1 minute drop rate, 0 pkts/sec5 minute input rate 3 pkts/sec, 173 bytes/sec5 minute output rate 1 pkts/sec, 428 bytes/sec5 minute drop rate, 0 pkts/secInterface GigabitEthernet0/1 "", is administratively down, line protocol is down Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usecAuto-Duplex, Auto-SpeedAvailable but not configured via nameifMAC address 0023.5e25.5d9b, MTU not setIP address unassigned0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 late collisions, 0 deferred0 input reset drops, 0 output reset dropsinput queue (curr/max packets): hardware (0/0) software (0/0)output queue (curr/max packets): hardware (0/0) software (0/0) Interface GigabitEthernet0/2 "", is administratively down, line protocol is down Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usecAuto-Duplex, Auto-SpeedAvailable but not configured via nameifMAC address 0023.5e25.5d9c, MTU not setIP address unassigned0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 late collisions, 0 deferred0 input reset drops, 0 output reset dropsinput queue (curr/max packets): hardware (0/0) software (0/0)output queue (curr/max packets): hardware (0/0) software (0/0) Interface GigabitEthernet0/3 "", is administratively down, line protocol is down Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usecAuto-Duplex, Auto-SpeedAvailable but not configured via nameifMAC address 0023.5e25.5d9d, MTU not setIP address unassigned350 packets input, 27237 bytes, 95 no bufferReceived 350 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 late collisions, 0 deferred0 input reset drops, 0 output reset dropsinput queue (curr/max packets): hardware (0/0) software (0/0)output queue (curr/max packets): hardware (0/0) software (0/0) Interface Management0/0 "", is administratively down, line protocol is down Hardware is i82557, BW 100 Mbps, DLY 100 usecAuto-Duplex, Auto-SpeedAvailable but not configured via nameifMAC address 0023.5e25.5d99, MTU not setIP address unassigned0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max packets): hardware (0/0) software (0/0)output queue (curr/max packets): hardware (1/0) software (0/0) zly(config-if)#。
思科ASA防火墙基本配置思科ASA防火墙基本配置Fire Wall 防火墙，它是一种位于内部网络与外部网络之间的网络安全系统，当然，防火墙也分软件防火墙与硬件防火墙。
硬件防火墙又分为：基于PC架构与基于ASIC芯片今天来聊一聊思科的'硬件防火墙 Cisco ASACisco ASA 防火墙产品线挺多：Cisco ASA5505 Cisco ASA5510 Cisco ASA5520 Cisco ASA5540 Cisco ASA5550 等等ASA 的基本配置步骤如下：配置主机名、域名hostname [hostname]domain-name xx.xxhostname Cisco-ASA 5520domain-name 配置登陆用户名密码password [password]enable password [password]配置接口、路由interface interface_namenameif [name]name 有三种接口类型 insdie outside dmzsecurity-level xx(数值)数值越大接口安全级别越高注：默认inside 100 ,outside 0 ,dmz 介于二者之间静态路由route interface_number network mask next-hop-addressroute outside 0.0.0.0 0.0.0.0 210.210.210.1配置远程管理接入Telnettelnet {network | ip-address } mask interface_nametelnet 192.168.1.0 255.255.255.0 insidetelnet 210.210.210.0 255.255.255.0 outsideSSHcrypto key generate rsa modulus {1024| 2048 }指定rsa系数，思科推荐1024ssh timeout minutesssh version version_numbercrypto key generate rsa modulus 1024ssh timeout 30ssh version 2配置 ASDM(自适应安全设备管理器)接入http server enbale port 启用功能http {networdk | ip_address } mask interface_nameasdm image disk0:/asdm_file_name 指定文件位置username user password password privilege 15NATnat-controlnat interface_name nat_id local_ip maskglobal interface_name nat_id {global-ip [global-ip] |interface} nat-controlnat inside 1 192.168.1.0 255.255.255.0global outside 1 interfaceglobal dmz 1 192.168.202.100-192.168.202.150ACLaccess-list list-name standad permit | deny ip maskaccess-list list-name extendad permit | deny protocol source-ip mask destnation-ip mask portaccess-group list-name in | out interface interface_name如果内网服务器需要以布到公网上staic real-interface mapped-interface mapped-ip real-ip staic (dmz,outside) 210.210.202.100 192.168.202.1保存配置wirte memory清除配置clear configure (all)【思科ASA防火墙基本配置】。
ASA5520，双ISP接入配置实现功能如下：1，部分网通站点走网通线路，其余走电信实现负载均衡（电信为主）2，任何一条链路断掉，另一条可以继续用3，电信网通口上都启用VPNClient，保证电信，网通客户端都可以顺利拨入jxwsj(config)# show run: Saved:ASA Version 7.0(5)!hostname jxwsjdomain-name enable password fCoWG.vztqKmZjts encryptednamesdns-guard!interface GigabitEthernet0/0description tocncnameif outsidesecurity-level 0ip address 网通IP 255.255.255.248!interface GigabitEthernet0/1nameif insidesecurity-level 100ip address 192.1.5.2 255.255.255.0!interface GigabitEthernet0/2description to cntnameif ctsecurity-level 0ip address 电信IP 255.255.255.248!interface GigabitEthernet0/3nameif govsecurity-level 40ip address 21.36.255.14 255.255.255.0!interface Management0/0nameif managementsecurity-level 100ip address 192.168.1.1 255.255.255.0management-only!passwd nRRwDj.AHmVtB9jY encryptedftp mode passiveaccess-list 110 extended permit ip any anyaccess-list 150 extended permit tcp any any eq wwwaccess-list 150 extended permit tcp any any eq 8080access-list 150 extended permit tcp any any eq lotusnotesaccess-list 150 extended permit icmp any anyaccess-list 150 extended deny ip any anyaccess-list inside_in extended permit ip any anyaccess-list 102 extended permit ip 192.168.0.0 255.255.255.0 192.168.200.0 255.255.255.0 access-list 102 extended permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0 access-list 102 extended permit ip 192.168.3.0 255.255.255.0 192.168.200.0 255.255.255.0 access-list 102 extended permit ip 192.168.4.0 255.255.255.0 192.168.200.0 255.255.255.0 access-list 102 extended permit ip 192.1.5.0 255.255.255.0 192.168.200.0 255.255.255.0 access-list tempdeny extended deny ip host 192.168.3.11 anyaccess-list tempdeny extended deny ip host 192.168.3.12 anyaccess-list tempdeny extended deny ip host 192.168.3.13 anyaccess-list tempdeny extended deny ip host 192.168.3.14 anyaccess-list tempdeny extended permit ip any anyaccess-list 111 extended permit ip any anypager lines 24logging asdm informationalmtu outside 1500mtu inside 1500mtu gov 1500mtu management 1500mtu ct 1500ip local pool vpdn 192.168.200.1-192.168.200.100no failoverasdm image disk0:/asdm505.binno asdm history enablearp inside 192.168.3.14 0016.1727.a178arp inside 192.168.3.13 000a.480b.2295arp inside 192.168.3.12 0030.1b31.a88barp inside 192.168.3.11 000a.480e.24a4arp timeout 14400global (outside) 1 interfaceglobal (gov) 1 interfaceglobal (ct) 1 interfacenat (inside) 0 access-list 102nat (inside) 1 0.0.0.0 0.0.0.0access-group 110 in interface outsideaccess-group tempdeny in interface insideaccess-group 150 in interface govaccess-group 111 in interface ctroute outside 0.0.0.0 0.0.0.0 网通网关254route outside 222.160.0.0 255.224.0.0 网通网关1 route outside 222.162.0.0 255.255.0.0 网通网关1 route outside 222.160.0.0 255.254.0.0 网通网关1 route outside 222.136.0.0 255.248.0.0 网通网关1 route outside 222.132.0.0 255.252.0.0 网通网关1 route outside 222.128.0.0 255.252.0.0 网通网关1 route outside 221.216.0.0 255.248.0.0 网通网关1 route outside 221.213.0.0 255.255.0.0 网通网关1 route outside 221.212.0.0 255.255.0.0 网通网关1 route outside 221.208.0.0 255.252.0.0 网通网关1 route outside 221.207.0.0 255.255.192.0 网通网关1 route outside 221.204.0.0 255.254.0.0 网通网关1 route outside 221.200.0.0 255.252.0.0 网通网关1 route outside 221.199.192.0 255.255.240.0 网通网关1 route outside 221.199.128.0 255.255.192.0 网通网关1 route outside 221.199.32.0 255.255.240.0 网通网关1 route outside 221.199.0.0 255.255.224.0 网通网关1 route outside 221.198.0.0 255.255.0.0 网通网关1 route outside 221.196.0.0 255.254.0.0 网通网关1 route outside 221.192.0.0 255.252.0.0 网通网关1 route outside 221.14.0.0 255.254.0.0 网通网关1 route outside 221.13.128.0 255.255.128.0 网通网关1 route outside 221.13.64.0 255.255.224.0 网通网关1 route outside 221.13.0.0 255.255.192.0 网通网关1 route outside 125.210.0.0 255.255.0.0 网通网关1 route outside 58.100.0.0 255.255.0.0 网通网关1 route outside 219.82.0.0 255.255.0.0 网通网关1 route outside 218.108.0.0 255.255.0.0 网通网关1 route outside 221.12.128.0 255.255.192.0 网通网关1 route outside 221.12.0.0 255.255.128.0 网通网关1 route outside 221.11.128.0 255.255.224.0 网通网关1 route outside 221.11.0.0 255.255.128.0 网通网关1 route outside 221.10.0.0 255.255.0.0 网通网关1 route outside 221.8.0.0 255.254.0.0 网通网关1route outside 221.7.128.0 255.255.128.0 网通网关1 route outside 221.7.64.0 255.255.224.0 网通网关1 route outside 221.7.0.0 255.255.192.0 网通网关1 route outside 221.6.0.0 255.255.0.0 网通网关1route outside 221.4.0.0 255.254.0.0 网通网关1route outside 221.3.128.0 255.255.128.0 网通网关1 route outside 221.0.0.0 255.252.0.0 网通网关1route outside 218.67.128.0 255.255.128.0 网通网关1 route outside 218.60.0.0 255.254.0.0 网通网关1 route outside 218.56.0.0 255.252.0.0 网通网关1 route outside 218.28.0.0 255.254.0.0 网通网关1 route outside 218.26.0.0 255.254.0.0 网通网关1 route outside 218.24.0.0 255.254.0.0 网通网关1 route outside 218.12.0.0 255.255.0.0 网通网关1 route outside 218.11.0.0 255.255.0.0 网通网关1 route outside 218.10.0.0 255.255.0.0 网通网关1 route outside 218.8.0.0 255.254.0.0 网通网关1route outside 218.7.0.0 255.255.0.0 网通网关1route outside 202.111.160.0 255.255.224.0 网通网关1 route outside 202.111.128.0 255.255.224.0 网通网关1 route outside 202.110.192.0 255.255.192.0 网通网关1 route outside 202.110.64.0 255.255.192.0 网通网关1 route outside 202.110.0.0 255.255.192.0 网通网关1 route outside 202.108.0.0 255.255.0.0 网通网关1 route outside 202.107.0.0 255.255.128.0 网通网关1 route outside 202.106.0.0 255.255.0.0 网通网关1 route outside 202.102.224.0 255.255.224.0 网通网关1 route outside 202.102.128.0 255.255.192.0 网通网关1 route outside 202.99.224.0 255.255.224.0 网通网关1 route outside 202.99.192.0 255.255.224.0 网通网关1 route outside 202.99.128.0 255.255.192.0 网通网关1 route outside 202.99.64.0 255.255.192.0 网通网关1 route outside 202.99.0.0 255.255.192.0 网通网关1 route outside 202.98.0.0 255.255.224.0 网通网关1 route outside 202.97.192.0 255.255.192.0 网通网关1 route outside 202.97.160.0 255.255.224.0 网通网关1 route outside 202.97.128.0 255.255.224.0 网通网关1 route outside 202.96.64.0 255.255.224.0 网通网关1 route outside 202.96.0.0 255.255.192.0 网通网关1 route outside 61.189.0.0 255.255.128.0 网通网关1 route outside 61.182.0.0 255.255.0.0 网通网关1 route outside 61.181.0.0 255.255.0.0 网通网关1 route outside 61.180.128.0 255.255.128.0 网通网关1 route outside 61.179.0.0 255.255.0.0 网通网关1 route outside 61.176.0.0 255.255.0.0 网通网关1 route outside 61.168.0.0 255.255.0.0 网通网关1 route outside 61.167.0.0 255.255.0.0 网通网关1 route outside 61.163.0.0 255.255.0.0 网通网关1 route outside 61.162.0.0 255.255.0.0 网通网关1 route outside 61.161.128.0 255.255.128.0 网通网关1route outside 61.159.0.0 255.255.192.0 网通网关1route outside 61.158.128.0 255.255.128.0 网通网关1route outside 61.156.0.0 255.255.0.0 网通网关1route outside 61.148.0.0 255.254.0.0 网通网关1route outside 61.139.128.0 255.255.192.0 网通网关1route outside 61.138.128.0 255.255.192.0 网通网关1route outside 61.138.64.0 255.255.192.0 网通网关1route outside 61.138.0.0 255.255.192.0 网通网关1route outside 61.137.128.0 255.255.128.0 网通网关1route outside 61.136.64.0 255.255.192.0 网通网关1route outside 61.135.0.0 255.255.0.0 网通网关1route outside 61.134.96.0 255.255.224.0 网通网关1route outside 61.133.0.0 255.255.128.0 网通网关1route outside 61.55.0.0 255.255.0.0 网通网关1route outside 61.54.0.0 255.255.0.0 网通网关1route outside 61.52.0.0 255.254.0.0 网通网关1route outside 61.48.0.0 255.252.0.0 网通网关1route outside 60.220.0.0 255.252.0.0 网通网关1route outside 60.216.0.0 255.254.0.0 网通网关1route outside 60.208.0.0 255.248.0.0 网通网关1route outside 60.31.0.0 255.255.0.0 网通网关1route outside 60.24.0.0 255.248.0.0 网通网关1route outside 60.16.0.0 255.248.0.0 网通网关1route outside 60.13.128.0 255.255.128.0 网通网关1route outside 60.13.0.0 255.255.192.0 网通网关1route outside 60.12.0.0 255.255.0.0 网通网关1route outside 60.10.0.0 255.255.0.0 网通网关1route outside 60.8.0.0 255.254.0.0 网通网关1route outside 60.0.0.0 255.248.0.0 网通网关1route inside 192.168.0.0 255.255.255.0 192.1.5.1 1route inside 192.168.3.0 255.255.255.0 192.1.5.1 1route inside 192.168.4.0 255.255.255.0 192.1.5.1 1route inside 192.168.1.0 255.255.255.0 192.1.5.1 1route gov 21.0.0.0 255.0.0.0 21.36.255.1 1route ct 0.0.0.0 0.0.0.0 电信网关1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absolutegroup-policy clientgroup internalgroup-policy clientgroup attributesvpn-idle-timeout 20split-tunnel-policy tunnelallwebvpnusername zmkm password B1MJgn6i2mF.NKjz encrypted username owen password G7ZPUlDLDg6W94ag encrypted username cisco password e1OkT/res2LB3io6 encryptedhttp server enablehttp 192.168.0.2 255.255.255.255 insidehttp 192.168.1.0 255.255.255.0 managementno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set aaades esp-3des esp-md5-hmaccrypto ipsec transform-set aaades1 esp-3des esp-md5-hmaccrypto dynamic-map dynomap 10 set transform-set aaadescrypto dynamic-map dynomap1 20 set transform-set aaades1crypto map vpnpeer 20 ipsec-isakmp dynamic dynomapcrypto map vpnpeer interface outsidecrypto map vpnpeer1 30 ipsec-isakmp dynamic dynomap1crypto map vpnpeer1 interface ctisakmp identity addressisakmp enable outsideisakmp enable ctisakmp policy 10 authentication pre-shareisakmp policy 10 encryption 3desisakmp policy 10 hash md5isakmp policy 10 group 2isakmp policy 10 lifetime 86400tunnel-group huhao type ipsec-ratunnel-group huhao general-attributesaddress-pool vpdnauthorization-server-group LOCALdefault-group-policy clientgrouptunnel-group huhao ipsec-attributespre-shared-key *tunnel-group cnt type ipsec-ratunnel-group cnt general-attributesaddress-pool vpdnauthentication-server-group noneauthorization-server-group LOCALdefault-group-policy clientgrouptunnel-group cnt ipsec-attributespre-shared-key *telnet 0.0.0.0 0.0.0.0 insidetelnet timeout 5ssh 0.0.0.0 0.0.0.0 outsidessh 0.0.0.0 0.0.0.0 ctssh timeout 60console timeout 0dhcpd address 192.168.1.2-192.168.1.254 management dhcpd lease 3600dhcpd ping_timeout 50Cryptochecksum:38caa994b55d5b8bf627a1e972ed56ee : end。
