配置ASA访问规则

4321oiuy

内网路由器R1可以telnet路由器R2
配置ACL实现路由器R2可以telnet路由器R1
配置ACL实现路由器R2可以ping通inside接口
配置静态路由使全网互通

R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 10.10.10.2 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface loopback 0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#exit
R1(config)#line vty 0 4
R1 (config-line)#password 123
R1(config-line)#login
R1(config-line)#exit
R1(config)#enable password 123

R2(config)#interface fastEthernet 0/0
R2(config-if)#ip address 20.20.20.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface loopback 0
R2(config-if)#ip address 192.168.2.1 255.255.255.0
R2(config-if)#exit
R2(config)#line vty
R2config)#line vty 0 4
R2(config-line)#password 123
R2(config-line)#login
R2(config-line)#exit
R2(config)#enable password 123

ASA(config)# interface ethernet 0/0
ASA(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ASA(config-if)# ip address 10.10.10.1 255.255.255.0
ASA(config-if)# no shutdown
ASA(config-if)# exit
ASA(config)# interface ethernet 0/1
ASA(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ASA(config-if)# ip address 20.20.20.1 255.255.255.0
ASA(config-if)# no shutdown
ASA(config-if)# exit
ASA(config)# route inside 192.168.1.0 255.255.255.0 10.10.10.1
ASA(config)# route outside 192.168.2.0 255.255.255.0 20.20.20.1

R1(config)#ip route 20.20.20.0 255.255.255.0 10.10.10.1
R2(config)#ip route 10.10.10.0 255.255.255.0 20.20.20.1
R1(config)#do telnet 20.20.20.2
Trying 20.20.20.2 ... Open
User Access Verification
Password:
R2>ena
R2>enable
Password:
R2#

R2(config)#do telnet 10.10.10.2
Trying 10.10.10.2 ...
% Connection timed out; remote host not responding

ASA(config)# access-list 100 permit tcp host 20.20.20.2 host 10.10.10.2
ASA(config)# access-group 100 in interface outside
R2(config)#do telnet 10.10.10.2
Trying 10.10.10.2 ... Open
User Access Verification
Password:
R1>ena
R1>enable
Password:
R1#

ASA(config)# fixup protocol icmp
ASA(config)# access-list 101 permit icmp any any   
ASA(config)# access-group 101 in interface outside
R1(config)#do ping 20.20.20.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 20.20.20.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/24/76 ms

R2(config)#do ping 10.10.10.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/28/84 ms

R1(config)#ip route 192.168.2.0 255.255.255.0 20.20.20.2
R2(config)#ip route 192.168.1.0 255.255.255.0 10.10.10.2

R1(config)#do ping 192.168.2.1                          

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/32/80 ms

R2(config)#do ping 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/32/76 ms