本帖最后由 宅男女神 于 2016-11-28 22:59 编辑 6 d0 ?, h, P& W
+ t/ V7 l5 s% n3 d( b* P2 s问大家一个防火墙的问题：asa9.4版应该是支持PBR的，但是为啥不生效呢; \/ n, c( M9 Y$ R
问大家一个防火墙的问题：asa9.4版应该是支持PBR的，但是为啥不生效呢
8 E! Q' S% I- C目前好像如果单独使用其中任何一个ISP，上网都没有问题，但是只要双线路启用就会有问题1 h) u2 j: L1 |
2 s v/ ?7 J" z+ v& N' H/ d) `- A& @5 p
, ?% W$ x* T( t3 A9 A0 d+ E* J就是分别对两个内网网段做了动态NAT啊6 v2 S, T5 n6 {0 q6 P
! }3 ]( S6 u. ]8 \) T. Q+ X4 \6 ?2 y( c( a ~
另外一个网段不能上网0 j+ D. I1 F6 ]6 M
1 i9 l! h5 a. z3 o) B我在那个访问规则匹配值是看到了
7 [6 _# f; w4 b2 m/ P; V7 T0 I- B! u+ s7 a! J+ X
有数据的，那就应该是走那个策略路由出去了9 ? T! r5 _. e3 B; a* N# u
. l. B' q4 h, K: O( H0 J
9 L; b* X+ _: M* _+ e: l
本问题来自群 2258097& f6 y6 Q- Y8 ?# _
2 }* A, @3 P8 K, X" }# V0 }配置如下
" s. h- b( Z8 _) z8 z. Q3 p
: E: U X* w( u7 }$ K8 h/ s6 pciscoasa# show running-config
, w1 @. l0 n. E0 P7 o- t: Saved
! z* [5 Q/ F: c- L" j& Y. h
0 d. \0 R- y) A9 F4 t: 8 }3 F" p: U [3 _' A+ ^
: Serial Number: 9AN3CME1SPN4 p+ b" f0 y$ R7 l1 F: s, Z
: Hardware: ASAv, 2048 MB RAM, CPU Xeon 5500 series 1496 MHz
$ L2 I# Q! c' O% J O7 j# [' y:
! ?) i3 h$ L8 D( i- D0 KASA Version 9.4(1) 8 \* k5 b( D% E5 s# ^
!
) c5 F% a, [8 mhostname ciscoasa
( T- ~' d, e! A* G) x3 j% genable password 8Ry2YjIyt7RRXU24 encrypted
# l# q5 Z! z4 W1 [names# @0 C K1 c$ s0 S# k. Y
!
% d- B- W0 Q* |interface GigabitEthernet0/0
) A. R* T: m7 z, B; R nameif inside% j" j' O- r4 _7 m* E
security-level 100 z7 W z( P+ ?( b1 y, n
ip address 172.16.1.1 255.255.255.0 * E2 Y* X& o/ k3 s$ K U0 g2 E. R
policy-route route-map lan4 R1 F. o: y. |5 I: e* U, K7 b
!( G! f1 |4 I5 @: E- |$ G
interface GigabitEthernet0/10 z# T* @ `' v4 i2 c" d4 k6 D
nameif server* `8 |, b* u9 o5 x" z
security-level 100
9 O2 y" D, B0 ^/ p' u ip address 172.16.2.1 255.255.255.0 " u, N2 g9 s O- Z( p
policy-route route-map server
8 E8 y" F7 Y3 c, K0 E- c( ~; J!5 [' o8 ^" ]8 b; W0 V3 ?
interface GigabitEthernet0/2
C, C5 R) {0 G$ X% ?. a' C) l nameif outside
h/ T6 Z$ K- s: e8 r& f/ _1 m; [ security-level 0
- H& ]' K; O8 }* }) r ip address 192.168.1.1 255.255.255.0
! Y- D; C# w9 p" y+ F0 G!
- ^* h: R+ D3 ninterface GigabitEthernet0/36 U& u* i+ F, m2 S' B. Y9 w( n
nameif outbackup: g9 q. ^- x7 }
security-level 0
$ y; R$ x; v: ?! \8 ^ ip address 192.168.13.250 255.255.255.0
" R; z# i3 n' {' I4 g7 ~" E8 L. x!6 y- I; u* q4 B1 k' z& T4 c* l, X3 \
interface Management0/0
; j# | {- y3 H W' K- r5 I7 q+ g% K management-only
1 j' M; f4 |7 b$ e( X shutdown
8 V' ^$ Y6 f" \- t2 d0 a Y no nameif
' A" X( m3 x* k no security-level
9 j _+ n# Z e% [ no ip address
5 U s2 j+ d- z7 k" @" l. E! N!
. m* P: j9 u% u# oftp mode passive
+ P9 y: w; u# w% G7 S5 ]9 q% Jobject network lan
% l8 X4 C7 i7 l. ~( v! |: k$ B subnet 172.16.1.0 255.255.255.0! z$ j& h @# | n; S1 Y* I
object network server$ O! P( c0 A* p& f1 `5 V K( x j( T
subnet 172.16.2.0 255.255.255.00 L- |3 A9 O8 `% q$ n
access-list lan extended permit ip 172.16.1.0 255.255.255.0 any 4 \: K3 F H3 x! I
access-list server extended permit ip 172.16.2.0 255.255.255.0 any
2 n% Y" l q+ j) p7 N0 }% Lpager lines 23+ s. N+ O% o. V- [/ P& F
mtu inside 1500+ c5 o1 o4 S; S+ c2 a0 d
mtu server 1500/ B$ S5 H* v* p) v, x# i$ {& m* W
mtu outside 15007 N q5 {3 _& t& K* T, x0 Q4 b4 i7 j
mtu outbackup 1500
( D; ]$ A& s* p7 h8 }no failover3 }7 g4 h8 o! I" t
no monitor-interface service-module
& q0 v2 _- d7 \+ [3 E* ?* vicmp unreachable rate-limit 1 burst-size 1
1 r& V6 Q: e. X" eno asdm history enable
* J6 R9 d6 c! Z/ ~7 }8 Varp timeout 14400' B/ B: [7 \8 W' O4 N
no arp permit-nonconnected- S8 m+ K2 I" j1 b3 ~6 g7 ?& L
nat (inside,outside) source dynamic lan interface
7 z4 u& d6 Z( R0 ?* O0 v4 P8 `nat (inside,outbackup) source dynamic server interface# ]# w7 L4 _: _6 X9 l! N! ~
!
' T+ W- @- S* `9 o; Xroute-map server permit 101 o4 I# ~; A, {3 j, v
match ip address server2 P7 N# m' f ? L5 l
set ip next-hop 192.168.13.2 n2 ^7 W( |" ~
) e+ Q0 ^( D: P
!
4 ~* O+ _! n( Q, j6 @+ Lroute-map lan permit 10
6 |8 j8 {6 `9 {& [( ` match ip address lan
4 I2 `7 L- K$ z set ip next-hop 192.168.1.24 j. J: d- q+ M* D9 H. q0 _
& g5 E/ ~! L+ P/ O. {+ J!
0 T, B. B+ @. V! i e1 I% o; Ctimeout xlate 3:00:00
- u, r2 e: s# [1 B$ g, Qtimeout pat-xlate 0:00:30
5 O: D0 c, n+ jtimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02* @' i5 N" y6 e" R
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
) J3 h( v( v. n' K N/ v5 P3 ~timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
; p7 I i7 |; F) @! Z: z, Ptimeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
. g8 w3 w% A8 B% jtimeout tcp-proxy-reassembly 0:01:00$ C9 \+ v& C& p
timeout floating-conn 0:00:00
/ @: D% C2 u6 z) o" juser-identity default-domain LOCAL
o- d- U ~2 v1 wno snmp-server location
1 v' V! C8 m9 H4 I- d" @/ [no snmp-server contact6 ~, Z5 @3 l( D8 \
crypto ipsec security-association pmtu-aging infinite3 O& ?1 o' P9 ]0 W' p
crypto ca trustpoint _SmartCallHome_ServerCA
- ~. q F' G- h. j: a2 C3 w no validation-usage
8 x* j2 V! l! q" h* W crl configure
1 o5 L v4 G8 A6 F' Y! ?1 @( Bcrypto ca trustpool policy
. b4 k+ b# }: `, ncrypto ca certificate chain _SmartCallHome_ServerCA! K5 g; p* a9 K1 |8 o
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
0 H9 A7 h* p- @1 ? 308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130 ) I: z/ \! [3 Y3 E5 j
0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
2 x* {1 c+ U" x; a( ^# \( a; ` 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
' {/ } F' P4 [) V. c 13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504 % g. Z' C+ G8 p% Q: G( E
0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72 9 ~/ O5 y: V" G4 I* w
20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56 3 y# c2 o- {! E' s) R3 A# R8 L
65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043 6 M' b2 I: I7 W4 d: F6 y, n7 [, \. w ?
65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31 " D% J# E8 K: P7 V2 W
30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b 8 w! s9 p8 |4 V# m+ [$ m4 S
30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20 " r/ R: o% n f" Y7 Q
496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
, I, X0 ?0 N u- ~ 74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420 4 @: l$ W# B8 {1 O
68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329 0 {/ Z) g6 }7 U4 L5 o$ C2 E7 G9 h9 Y
3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365 / N$ a; j3 w1 T% m7 h2 P
63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
/ U. v; o# {- W O5 i+ c, | 0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597 % \' R+ j6 ` X* q6 J
a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
# [1 i7 Z0 v( q5 m( F 9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
! C3 y7 ], |6 ?/ V4 `7 | 7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b + H' x+ b* A; T2 A. B$ i
15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845 $ U' o# f* `0 \! {) o( h. r
63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
' O B7 h2 |, c! E9 O: [ 18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced 7 `$ m2 ?$ R" l9 N
4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
& v) g0 r3 O+ D 81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201 7 N: M% _+ }9 k/ T/ w( g! U
db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
$ G8 ?& ~% Z% w5 ]. M) A7 ?' M) t 7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
% K6 x3 [# Q" i5 k1 w& B ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8 : y( N8 b# B, A( E
45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777 - ~) I& }' }$ T" ^- V) H! V) [
2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
( s4 g" J; h: ?! ?# r# v 1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
& L& P% L4 j. K, D 03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973 2 C" a6 X+ U" U' F( b1 Y
69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403 Y1 T! T' ^$ Y7 B+ @9 A
02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
2 [3 G( ]- f0 h) m3 b) ~/ l 6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
1 F; D3 l& ]- t/ l0 j7 o c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973 ' A9 W( t7 E4 A5 n2 b
69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30 " ? v7 Z. F0 o/ c
1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
7 q, |% E0 _8 [0 `6 F! d: Y. { 551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
6 V: Q, [( h4 h3 D 1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609 7 ]- A7 j% i/ V V2 F
2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 * [( U0 {' m Q; j% w
4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e % d& }; E% O' I' a
b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a 2 f$ s. c# L) H1 i
6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc / N% @* ?& A+ b' {: Y
481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
+ X" u& T2 d7 v- W& d* B/ x b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0 0 |5 @% Z( b1 J: h" F; f! v; j1 K8 e
5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
: I0 P5 z. W+ O, F- ^$ ` 6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
# t* f6 W) F8 M 6c2527b9 deb78458 c61f381e a4c4cb66" x! e. \% s6 f" n" J/ k8 `0 \7 t
quit
9 D; }- E! H; z4 Y0 Btelnet timeout 5
& z; ~7 }; a0 y0 q( @ s$ N4 f1 Hssh stricthostkeycheck
! s2 }8 ` _8 M; @9 j" C B) Wssh timeout 5; \6 A( J% g6 U! m
ssh key-exchange group dh-group1-sha1
( s9 T& w4 M- v/ C1 Fconsole timeout 0
3 v0 y9 E6 i7 Hthreat-detection basic-threat) K& ]' O5 }* {' i' T% o6 O; p' w
threat-detection statistics access-list& ^9 q3 j# V7 y2 t- e
no threat-detection statistics tcp-intercept, o* O: e9 P- I
dynamic-access-policy-record DfltAccessPolicy$ A! a6 M5 |; `( J' z
!4 K# B' M- l9 Q v1 Y) X2 |3 ? i
class-map inspection_default8 v8 C8 z( Y+ |$ k; e4 v
match default-inspection-traffic7 U/ d3 }1 Z1 l0 U3 [
!/ h! [% f# A0 q% ]; w3 f
!; Y4 H0 I. k! e+ u2 B! t5 ^
policy-map type inspect dns preset_dns_map- v2 G) z' S$ y! T) R7 W# z* j; }
parameters3 F) K0 R' N9 t. ^4 D
message-length maximum client auto! ?9 u7 F$ \) ^; p
message-length maximum 512+ K, A/ B! @6 J0 Y5 n
policy-map global_policy
) o0 L/ Y( p7 @! S class inspection_default; v) d2 ?- B" H5 U4 n
inspect rtsp
( G: D V1 ?& T% q inspect sunrpc # V; |- v6 e! K& j# c. O- R
inspect xdmcp 7 g* f6 O- |8 c/ f
inspect netbios , o0 u) G6 {" C9 p
inspect tftp / j7 {& [& T& u/ u0 s/ b" ]. p
inspect ip-options . S& ^3 q$ G3 `
inspect dns preset_dns_map
5 ^2 _1 h* a. }$ G# g. _9 Q2 E inspect ftp
3 u$ J( m/ v V; p inspect h323 h225
$ [& o: B; ], c2 v" G' g8 g2 W: a inspect h323 ras
) i, P1 d- _6 V( u h, f! c inspect rsh . M, f) y7 h7 F; D# ^& X7 n
inspect esmtp # q9 k/ l" H9 ~+ v
inspect sqlnet / W# t( {5 v, t1 ?0 U
inspect sip 4 G, \1 u9 \. q# R0 l
inspect skinny
]% @5 z) M4 g7 D$ C3 A0 P!( |: t9 k: f3 e' x! j7 I
service-policy global_policy global
+ d6 d% a8 x0 Fprompt hostname context
0 N$ q7 L; P3 L( z* Tno call-home reporting anonymous
; T# T5 Y' W; ?# ^5 U6 U, C/ u# L* ncall-home
# b5 V% Y+ Q7 R! K$ ?: F* l9 v profile CiscoTAC-1) N8 q/ Z& P8 n# ^& U2 ~ M
no active* N6 e8 H) T7 M7 Y
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
0 o; b. a7 w) @+ ? X4 j9 \" D destination address email callhome@cisco.com: N( l7 @, D) j3 C
destination transport-method http) U1 Q* d1 s7 l( x% a3 t
subscribe-to-alert-group diagnostic" `- E- ~1 c$ I* s. y. H
subscribe-to-alert-group environment/ r0 n/ z- J4 Q3 y
subscribe-to-alert-group inventory periodic monthly 27
" M# g1 M+ d7 w5 `; q: G& k; @ subscribe-to-alert-group configuration periodic monthly 27" N$ g9 \' x/ {7 C; `, _
subscribe-to-alert-group telemetry periodic daily
* U& x7 c n8 q+ y6 x profile License
* _+ H z) X* A5 W0 m destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
1 K7 V7 k3 p$ k+ B6 P/ @. w8 e destination transport-method http
' E" i& o3 ]2 p" _Cryptochecksum:367d7bcd02decad6d2fe819ab124d263
. k; g* r9 K$ n& j9 W) |4 s: end8 E( U G2 b; @" ?
" p! F( c" N- @, A, s
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
先考虑路由问题吧，这明显不是9.0，是8.4以前的版本，考虑这种NAT和策略路由能否共存。。。。。
