Cisco ASA5505配置案例
现状：生产网3台服务器，发布4个网站，分别是
MES网站：192.168.1.249:8080
设备管理：192.168.1.249:8081
三维：192.168.1.250
SCADA：192.168.1.19
办公网(10.153.136.x;10.153.137.x......)访问映射：
MES：10.153.136.11:8080
设备管理：10.153.136.11:8081
三维：10.153.136.12
SCADA：10.153.136.23
掩码：255.255.255.192
网点：10.153.136.1
要求：
办公网10段可访问生产网内服务器，且仅可访问生产网服务器，生产网不可访问办公网
后来增加额外的端口映射要求：
办公网：10.153.136.23:2084生产内网：192.168.1.150：2084
10.153.136.23:2080192.168.1.150：2080
10.153.136.23:2085192.168.1.150：2080
10.153.136.23:2078192.168.1.150：2078
10.153.136.23:2082192.168.1.150：2082
办公网：10.153.136.23:3084生产内网：192.168.1.151：2084
10.153.136.23:3080192.168.1.151：2080
10.153.136.23:3085192.168.1.151：2080
10.153.136.23:3078192.168.1.151：2078
10.153.136.23:3082192.168.1.151：2082
CiscoASA5505配置：
conft
interfacevlan2
nameifoutside
securitylevel0
ipaddress10.153.136.21255.255.255.192
interfacevlan1
nameifinside
securitylevel100
ipaddress192.168.1.200255.255.255.0
interfaceethernet0/0
switchportaccessvlan2
noshutdown
interfaceethernet0/1
switchportaccessvlan1
noshutdown
static(inside,outside)10.153.136.11192.168.1.249netmask255.255.255.255
static(inside,outside)10.153.136.12192.168.1.250netmask255.255.255.255
static(inside,outside)tcp10.153.136.2380192.168.1.1980netmask255.255.255.255
static(inside,outside)tcp10.153.136.232084192.168.1.1502084netmask255.255.255.255
static(inside,outside)tcp10.153.136.232080192.168.1.1502080netmask255.255.255.255
static(inside,outside)tcp10.153.136.232085192.168.1.1502085netmask255.255.255.255
static(inside,outside)tcp10.153.136.232078192.168.1.1502078netmask255.255.255.255
static(inside,outside)tcp10.153.136.232082192.168.1.1502082netmask255.255.255.255
static(inside,outside)tcp10.153.136.233084192.168.1.1512084netmask255.255.255.255
static(inside,outside)tcp10.153.136.233080192.168.1.1512080netmask255.255.255.255
static(inside,outside)tcp10.153.136.233085192.168.1.1512085netmask255.255.255.255
static(inside,outside)tcp10.153.136.233078192.168.1.1512078netmask255.255.255.255
static(inside,outside)tcp10.153.136.233082192.168.1.1512082netmask255.255.255.255
access-list101extendedpermiticmpanyany
access-list101extendedpermittcpanyhost10.153.136.11eqwww
access-list101extendedpermittcpanyhost10.153.136.11eq8081
access-list101extendedpermittcpanyhost10.153.136.12eqwww
access-list101extendedpermittcpanyhost10.153.136.23eqwww
access-list101extendedpermittcpanyhost10.153.136.23eq2084
access-list101extendedpermittcpanyhost10.153.136.23eq2080
access-list101extendedpermittcpanyhost10.153.136.23eq2085
access-list101extendedpermittcpanyhost10.153.136.23eq2078
access-list101extendedpermittcpanyhost10.153.136.23eq2082
access-list101extendedpermittcpanyhost10.153.136.23eq3084
access-list101extendedpermittcpanyhost10.153.136.23eq3080
access-list101extendedpermittcpanyhost10.153.136.23eq3085
access-list101extendedpermittcpanyhost10.153.136.23eq3078
access-list101extendedpermittcpanyhost10.153.136.23eq3082
access-group101ininterfaceoutside
routeoutside10.153.0.0255.255.0.010.153.136.11
接线：
interfaceethernet0/0接办公网
interfaceethernet0/1接生产网
服务器设置：
网关设为192.168.1.200
页:
[1]