ASA-- common application configuration
Experimental network structure diagram:
DNS Server- (outside) ASA-Firewall (inside)-LAN Client
| |
DMZ-WEB-Server
IP address assignment
Public network: 210.10.10.0.0 Universe 30
Intranet: 192.168.210.0Maple 24
DMZ: 192.168.202.0/24
Basic ASA configuration:
Configure hostname, domain name, and password
Configure Interfac
Configure routin
Configure remote management access
Configure network address translation for outbound traffic
Configure ACL
Enable
Conf t
Hostname ASA5520
Domain-name lpq.com
Enable password ASA5520
Passwd cisco
Conf t
Interface e0/0
Nameif outside
Security-level 0
Ip address 210.10.10.2 255.255.255.0
No shutdown
Exit
Interface e0/1
Nameif inside
Security-level 100
Ip address 192.168.201.1 255.255.255.0
No shutdown
Exit
Interface e0/2
Nameif dmz
Security-level 50
Ip address 192.168.202.1 255.255.255.0
No shutdown
Exit
Route outside 0.0.0.0 0.0.0.0 210.10.10.1
End
Show route
Conf t
Telnet 192.168.201.0 255.255.255.0 inside
Telnet timeout 15
Crypto key generate rsa modulus 1024
Ssh 192.168.201.0 255.255.255.0 inside
Ssh 0 0 outside
Ssh timeout 30
Ssh version 2
Username ASA5520 password cisco
Aaa authertication ssh console LOCAL
Passwd aaa
Http server enable 8008
Http 192.168.201.0 255.255.255.0 inside
Http 0 0 outside
Http 0 0 inside
Asdm p_w_picpath disk0:/asdm-615.bin
Username admin password admin privilege 15
Access-list 111 extended permit icmp any any
Access-list 111 permit ip any any
Access-group 111 in inter outside
Access-group 111 in inter inside
Access-group 111 in inter dmz
Access-list testacl deny ip 192.168.201.33 255.255.255.255 any
Access-list testacl permit ip any any
Access-group testacl in inter inside
-
Nat-control
Nat (inside) 1 0 0
Global (outside) 1 interface
Global (dmz) 1 192.168.202.100-192.168.202.110
Static (dmz,outside) 210.10.10.2 192.168.202.2
Access-list out_to_dmz permit tcp any host 210.10.10.2 eq 80
Access-group out_to_dmz in interface outside
End
Write memory
Copy running-config startup-config
Clear configuration information:
Conf t
Clear configure all
Clear configure comman [level2 command]
End
=
Advanced Application of ASA-URL filtering
Conf t
Access-list tcp_filter1 permit tcp 192.168.201.0 255.255.255.240 any eq www
Class-map tcp_filter_class1
Match access-list tcp_filter1
Exit
Regex url1\ .sina\ .com
Class-map type regex match-any url_class1
Match regex url1
Exit
Class-map type inspect http http_url_class1
Match not request header host regex class url_class1
Exit
Policy-map type inspect http http_url_policy1
Class http_url_class1
Drop-connection log
Exit
Exit
Policy-map inside_http_url_policy
Class tcp_filter_class1
Inspect http http_url_policy1
Exit
Exit
Delete this line when service-policy inside_http_url_policy interface inside / / complete configuration
-
Access-list tcp_filter2 permit tcp any any eq www
Class-map tcp_filter_class2
Match access-list tcp_filter2
Exit
Regex url2\ .game\ .com
Class-map type regex match-any url_class2
Match regex url2
Exit
Class-map type inspect http http_url_class2
Match request header host regex class url_class2
Exit
Policy-map type inspect http http_url_policy2
Class http_url_class2
Drop-connection log
Exit
Exit
Policy-map inside_http_url_policy
Class tcp_filter_class2
Inspect http http_url_policy2
Exit
Exit
Service-policy inside_http_url_policy interface inside
-
