10金币
公司有台ASA5512，想用双线接入一台WEB服务器，比喻电信用http://111.111.111.111:8081,联通用http://222.222.222.222:8081访问，给调防火墙的人来好几次没调好，我又是菜鸟。现在问题是电信能访问，联通就不行了。求高手给看看：$ c/ C* j3 v: J" a6 ~# t. F: j4 f
ASA Version 9.1(2) ( f: w2 c% P6 f9 p" F$ z
!
; d' f6 g1 b+ W4 B- B- f" p: q3 q9 F Hhostname ciscoasa
M4 W; b0 A; U+ }* `5 h( `! u% idomain-name default.domain.invalid
+ ]. r! m2 h, y! H6 I; W% q5 V: c% cenable password 2KFQnbNIdI.2KYOU encrypted
3 Y1 i8 ?0 }8 Q: ]+ U0 J$ ~4 Yxlate per-session deny tcp any4 any4
1 a8 m0 |) r" K3 N! N, Kxlate per-session deny tcp any4 any6
, K' z4 E# J0 Y3 C. Z9 V4 {: N* m1 \xlate per-session deny tcp any6 any4
9 f$ F2 S6 U& ]; o6 ]xlate per-session deny tcp any6 any6
; c2 d2 ]" _- W# txlate per-session deny udp any4 any4 eq domain/ `$ T( _ z4 F) N
xlate per-session deny udp any4 any6 eq domain
3 p- D* r% Y7 _3 i! }xlate per-session deny udp any6 any4 eq domain
: |, c* e a- j- S* Oxlate per-session deny udp any6 any6 eq domain
1 F5 ]1 ?$ q" f& `xlate per-session deny tcp any4 any4% m: o- c6 I* D% y. C1 R
xlate per-session deny tcp any4 any6+ P6 r" X$ ?9 o
xlate per-session deny tcp any6 any4- q& H6 w# u! J, N: p
xlate per-session deny tcp any6 any6) F, E; |* \7 X$ s/ n# v/ f
xlate per-session deny udp any4 any4 eq domain) ]* L% p' X7 W% Z5 b
xlate per-session deny udp any4 any6 eq domain6 }9 F- T3 |1 `6 F a* ^; e
xlate per-session deny udp any6 any4 eq domain7 ]% \/ K" ~9 M$ q! R& d( i5 d
xlate per-session deny udp any6 any6 eq domain
/ Y' g; ^* g% w( ?4 ?. D% Qnames
# w6 @/ F1 ] E6 P; v!
6 F3 w2 q6 j: B8 D8 Y2 Hinterface GigabitEthernet0/0. ^; W8 o2 ]) ?4 J3 O
nameif outside8 p4 {0 z, `' g0 T7 X+ S
security-level 0
/ z$ y1 @% r2 {ip address 111.111.111.111 255.255.255.248 -----电信IP
& d4 K) G' Z z!' M8 o% M; I X* Q
interface GigabitEthernet0/19 l$ q2 y6 P& l8 I# \6 O2 ?
nameif outside1
0 U) A3 Y# X; }' w* r( g, f. asecurity-level 0( t4 _2 m) ^+ z) _
ip address 222.222.222.222 255.255.255.248 -----联通IP
2 h: k* z, U' \; {3 O. [!! |: n* I# V( ` W
interface GigabitEthernet0/2
- e. A6 C/ v: E& Tnameif inside; y' P9 Z& E' E# g: F, ^
security-level 100% i$ t' X4 i7 ~
ip address 192.168.10.1 255.255.255.0
8 Y, o+ e7 G* {7 i) \!
8 x* i8 k" v. z4 ?% Kinterface GigabitEthernet0/32 R$ \3 U- i8 c5 Q8 {" W5 J
shutdown& t8 w/ m7 {1 N
no nameif
+ k* {" `; m+ Z' sno security-level; g5 U4 U& L5 i R. r3 i9 X
no ip address
) j2 c" b$ o" s5 t% v!
% t2 Z: \! N) K/ W$ V& [interface GigabitEthernet0/4
4 j: K) B7 V2 y# x$ `8 d" z( Gshutdown
: y9 ^2 {6 D1 e. Ono nameif
1 j: B& M3 e' bno security-level
& W$ x8 u- H" \no ip address
6 r0 i8 V: \. T1 K1 n% y' z!
8 r8 p+ V( W- K" ^interface GigabitEthernet0/5 \; S; q4 v$ j& I# A' g. c! p
shutdown
- ]6 |$ @- A$ R3 W% `3 hno nameif7 Z* |! f& l. V% T3 M
no security-level7 l& i' l2 S p1 U* h0 \
no ip address( Z% y% A0 x8 k* e7 f
!" \" z& o6 E' W1 a- H
interface Management0/0
% C$ w6 Q8 `7 C9 n3 ymanagement-only
: b: y6 I! j; J1 O3 U1 g f5 s1 p, [nameif guanli
( R' A% Z$ Y `1 Ssecurity-level 0
$ |% u& b6 K& i7 c* x hip address 192.168.2.1 255.255.255.0
$ z- i. T& J+ ]' W. r! n Y& h* W!$ K& w& v0 p* @9 g+ n7 H3 i; p
ftp mode passive0 A" z; L( X4 p( G" Q
dns server-group DefaultDNS# s k+ w4 I8 o9 R- F; l, q
domain-name default.domain.invalid7 L' Z4 E' F* ?. f
dns server-group defaultDNS
( n( x |) M* w) a5 `7 n; p) Bdns server-group defaultdns o7 K! R7 p, v- I& Z- X5 F
dns server-group enable( r# j$ x+ u7 V% F
dns server-group global
3 A/ K4 q4 \; |object network internet1 j4 s3 j+ f! X: v" y
subnet 192.168.10.0 255.255.255.0
5 B* R8 \4 D6 o: }2 L9 Robject network internet1
$ n, a9 h; Q7 j# m3 csubnet 192.168.10.0 255.255.255.0
5 x! b0 Z( g$ A; R I1 F" [object network Inside11: u' x0 T1 p; D) t' ?
host 192.168.10.2
% L8 c, H4 z ^6 C+ @ Z3 Cobject network Inside035 `: i7 h* |* _6 `! N2 B, `. [
host 192.168.10.34 q; ^2 [. V+ S; c. g* Y2 |
object network Inside02
& T5 U! @# ]" q. u* z' ihost 192.168.10.2
9 P# @. \7 }+ w" O, g9 ]. h! I: N( Yobject network Inside04; D6 n% R1 {' y( M% `/ B& O: J/ A! _
host 192.168.10.4
" r' `5 v- ]: N9 ?7 Robject network Inside12
5 c5 g/ o5 d" x7 thost 192.168.10.2' c. J# m4 G g" d( U& i& w6 X
object network Inside8081( ]1 H `/ T4 C9 J/ _
host 192.168.10.2 Y' V6 b1 n# J& ^) R$ |( A( u
access-list 102 extended permit tcp any host 192.168.10.2 eq 8266 2 r, Y8 L' ~! V# v+ f% a
access-list 102 extended permit tcp any host 192.168.10.2 eq 1188
3 B5 G5 W9 Z( ~% I. kaccess-list 104 extended permit tcp any host 192.168.10.2 eq 3389
0 @: l4 P) S$ L d; kaccess-list 104 extended permit tcp any host 192.168.10.2 eq www , t, i( h0 W3 M9 w9 p
access-list 104 extended permit tcp any host 192.168.10.3 eq 3389
: j/ m) W2 x0 V" H8 w& t5 o2 Faccess-list 104 extended permit tcp any host 192.168.10.4 eq 3389
/ g+ n- h1 M8 Mpager lines 24
8 q3 ~3 V- p R2 A. S1 U7 smtu outside 15009 B) B' [. W% T6 E
mtu outside1 1500$ c O8 O# R& U4 t+ h
mtu inside 15002 |+ Z6 h5 A+ t
mtu guanli 15001 C/ @7 a: ^5 t% v1 c) ]; J2 h
icmp unreachable rate-limit 1 burst-size 1
: N4 Q" k% Z: J* U jasdm history enable- _0 m2 V: u5 o
arp timeout 14400
, W$ Q, m0 p4 `4 _; o7 @no arp permit-nonconnected
* t- G1 z; ~# E1 V6 a. N& E: p!
/ `5 A1 c1 w( kobject network internet
# L$ p9 k4 V/ g Inat (inside,outside) dynamic interface dns
/ i/ k, R3 y# o3 h$ Sobject network internet1
# G* K9 J/ {4 S0 X8 Znat (inside,outside1) dynamic interface dns+ S0 c5 D( k( V
object network Inside11
& F3 ]4 F' n* mnat (inside,outside) static interface service tcp 3389 33892 " X6 s9 m8 u4 x ~2 l4 s
object network Inside033 V! C4 o5 g6 }; R+ B
nat (inside,outside) static interface service tcp 3389 33893 5 B% o. O9 \! \4 }2 W% t0 C1 d, A. a# a
object network Inside02. }/ a& `( @* c' b+ q! D
nat (inside,outside) static interface service tcp www 8081
, V. e8 c) I% m2 Iobject network Inside04; {& Q& d" t k% h5 T2 _+ D/ h
nat (inside,outside) static interface service tcp 3389 33894
; _2 B% V u1 Zobject network Inside12
" y* \3 m. l1 U% L( G0 b, Jnat (inside,outside1) static interface service tcp 3389 33892
( f* I$ j3 |2 T4 L9 [object network Inside8081+ Y1 v3 J3 w( M* F
nat (inside,outside1) static interface service tcp www 8081
4 ?2 B$ G" s3 }3 W; X3 L* h& caccess-group 104 in interface outside
' v$ {+ c% R6 g8 |0 ^0 aaccess-group 104 in interface outside1- U4 n% x4 }# U7 _+ m) V
route outside 0.0.0.0 0.0.0.0 111.111.111.110 1
4 w; u- Y! d7 ~- n. p* Groute outside1 0.0.0.0 0.0.0.0 222.222.222.220 2
* l3 o8 ]: Z" @3 t6 Ptimeout xlate 3:00:00( k8 N6 \/ H1 i% Z1 g5 i
timeout pat-xlate 0:00:30( V/ } X3 I- ~6 ], B
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
1 t3 d$ r: N, w* mtimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:007 H2 l( E, }* e* r, u4 O2 Q& D8 o
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
4 J! l, a- o6 W- U- X |, Etimeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute+ H2 a' H7 g' ?3 G+ ?7 z
timeout tcp-proxy-reassembly 0:01:009 j9 ]' J6 M3 F& _3 \/ a: w6 W
timeout floating-conn 0:00:00! ]$ F, ?% ~9 B( F
dynamic-access-policy-record DfltAccessPolicy- x8 w5 A& i: d% i5 |( k3 `: ]
aaa-server LOCAl protocol tacacs+/ V$ v- S0 p! d
aaa-server Local protocol tacacs+, I1 [- v' n3 j9 H% G
aaa-server Local (inside) host aaa-ssh1 M/ o: X( [& i6 X2 R: R$ d( l$ ~0 ^
user-identity default-domain LOCAL
) L% w" {2 ?; v: ~& \) Uaaa authentication ssh console LOCAL
& [' r" `5 v% y+ `) n; u0 Fhttp server enable
! j& s4 q2 a# n/ E. Khttp 192.168.2.0 255.255.255.0 guanli
8 f( X4 g# d) N( }. _no snmp-server location
3 u/ E+ H' ^% E6 a [/ C5 bno snmp-server contact' |. E8 V0 H; y! e d. e6 ~
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart' ?* G- w& o: U$ ^
crypto ipsec security-association pmtu-aging infinite
0 p/ ?1 ^- f- p0 c- k$ g: L+ c xcrypto ca trustpool policy
+ L9 n' d8 _2 {# A. w' G7 ttelnet 192.168.10.0 255.255.255.0 inside
( |; z& s y3 r) ^0 `' t7 vtelnet timeout 5
" G( m4 v! t) j- l% t F: Jssh 0.0.0.0 0.0.0.0 outside
1 W# k9 w0 e0 j0 s+ f1 Q5 Zssh 192.168.10.0 255.255.255.0 inside( X' L* @- W/ Q- B4 z
ssh timeout 30
: `8 b9 ] [% O1 O& wssh version 2. v, z" F/ W+ o8 H5 N
ssh key-exchange group dh-group1-sha1
9 W: ]4 h& c" V7 Xconsole timeout 0
' o# A. C( f& m$ i3 `7 Fdhcpd address 192.168.10.20-192.168.10.200 inside) ^2 ^, M$ p2 M/ x+ M, H) Y
dhcpd dns 219.146.1.66 202.102.128.68 interface inside
4 m1 K4 C$ \5 D* Q7 Vdhcpd enable inside
+ Q* ]( K! K j0 M- T2 `!
W0 d8 |3 \0 O, L( y. Ythreat-detection basic-threat
1 B# ^0 ?* E% G9 K$ i: g! |9 Athreat-detection statistics access-list& J& p* }: L1 z9 [2 F' f
no threat-detection statistics tcp-intercept) f9 ^* w- }+ o4 B- f/ R
username admin password izZCkX0.j7FlRkeS encrypted: a* D: G# S x7 J m, H
username cisco password miNpFG.9QSZNEuyO encrypted
5 F& @" J: m% k1 |- h!" E5 M: f# z5 K* Q# m1 M; m3 H
class-map inspection_default* G: {% G' P3 H& C% A3 K3 q
match default-inspection-traffic' A9 d8 D/ N0 A5 e# C" Q, x
!6 S" Z4 U. y. e1 X. K! s8 w
!: ?4 B+ {; N* |& c% ?2 j
policy-map type inspect dns preset_dns_map+ S0 W2 W) _0 K( l
parameters
9 a& }: J9 v5 p7 T message-length maximum client auto1 a4 ~! E5 J& Q% x( A* a8 t% p8 u; Z
message-length maximum 512
+ `/ H) N! t+ f' W4 `/ ^policy-map global_policy( _# l" P4 c# N' E
class inspection_default E: H U* u+ T1 S4 `! |
inspect dns preset_dns_map + |( U, ^) ^. X# p+ I) N
inspect ftp
: d/ T) c Y" v5 H inspect h323 h225
9 f, M" f6 d$ p inspect h323 ras # ~6 x1 d/ }: H! S" F$ J6 d0 W% t
inspect ip-options
( b3 X' j4 o( z9 y: G) j$ A inspect netbios - X$ p# z% ]% p/ S
inspect rsh ; i' Y' P" B: o8 S( ?7 y g5 U* |( e3 I
inspect rtsp $ g7 G1 S6 N8 m# ]; m% ]2 J3 B
inspect skinny
8 M0 j# K- H. X5 ] w* _ inspect esmtp & f F7 S E, I5 K5 h
inspect sqlnet
0 W) {4 H$ ^0 M: f6 D inspect sunrpc
( E7 n: d5 i x' [2 T, w inspect tftp ! b8 M3 p# T0 W) {/ W
inspect sip
i* a, |2 X' n. n$ [) I1 m$ E inspect xdmcp & P, p$ `8 v! ~) M( A2 D
!4 @- ~1 K1 y ~& i. r9 f& {
service-policy global_policy global
* n, l& S4 E! {5 ?/ ^prompt hostname context
" I2 ^" d9 U/ N; Sno call-home reporting anonymous
+ D5 G: q( \! R3 G3 qcall-home
0 N, Q6 V; |7 B7 Zprofile CiscoTAC-17 N) b! K2 h, y5 o8 y
no active. D) O1 C, L- T, X5 h9 |6 k2 _: ~
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService7 K6 l* I) V3 x l. `! g
destination address email callhome@cisco.com T+ p$ X; j2 m% K
destination transport-method http
: H! Z& o. P! N, y subscribe-to-alert-group diagnostic) j B5 {) A. a( Q0 d4 f
subscribe-to-alert-group environment- u, S8 y. O6 R: b: V; ]
subscribe-to-alert-group inventory periodic monthly 22. i! |, c9 Q$ X3 J
subscribe-to-alert-group configuration periodic monthly 22/ F4 l+ v4 r4 J u3 b
subscribe-to-alert-group telemetry periodic daily. Y6 S/ f2 \" h
Cryptochecksum:6487eeef6ad7a7a17fb12f33dddb2638' H. y" r8 N" `/ l8 u
: end$ r# f2 d% ~# r( y
! M; \7 q" j; ?, M6 f/ D5 `) L: g
6 b" J- z D% e3 h1 g, O+ U, l/ U) R; s7 @9 y: c
|
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
