10金币
公司有台ASA5512，想用双线接入一台WEB服务器，比喻电信用http://111.111.111.111:8081,联通用http://222.222.222.222:8081访问，给调防火墙的人来好几次没调好，我又是菜鸟。现在问题是电信能访问，联通就不行了。求高手给看看：
& F3 |1 N% N7 v/ S2 Y! QASA Version 9.1(2)
1 J3 X; m9 X7 ?& `) K8 A!+ B8 B$ i: L. g8 K7 e
hostname ciscoasa
0 M9 B/ ]$ ~# m8 gdomain-name default.domain.invalid) h! T3 u8 }# l+ s
enable password 2KFQnbNIdI.2KYOU encrypted
& Q$ V, [2 l1 |- W) b1 u. ixlate per-session deny tcp any4 any44 J8 s0 _) i8 [+ F
xlate per-session deny tcp any4 any6
) P8 U( c! E/ R3 w7 v+ gxlate per-session deny tcp any6 any4" E) q. a. F L2 d
xlate per-session deny tcp any6 any6" K9 `; O, J- r5 A: r$ c! ^
xlate per-session deny udp any4 any4 eq domain& `; }2 Y3 c* P# q/ m2 T1 |
xlate per-session deny udp any4 any6 eq domain
, l$ D8 O* u9 W% U, q+ d7 J% Nxlate per-session deny udp any6 any4 eq domain( t3 S7 x0 |$ }1 c6 j% t, h5 F
xlate per-session deny udp any6 any6 eq domain( W1 [- w: Q9 u( U2 P, o
xlate per-session deny tcp any4 any43 g: T: l: Y. W4 q/ L
xlate per-session deny tcp any4 any6
2 |3 o/ Z7 b& e# Hxlate per-session deny tcp any6 any4
& s* U# q' b- \# y6 Z" Oxlate per-session deny tcp any6 any6
% K/ K, F5 O$ j& b" n; x" nxlate per-session deny udp any4 any4 eq domain
: O' `! \& p& n+ V1 h! m, hxlate per-session deny udp any4 any6 eq domain3 y1 X9 A) C3 m! E# Z( {4 n
xlate per-session deny udp any6 any4 eq domain
1 n9 l) u7 R2 @* K6 s2 }xlate per-session deny udp any6 any6 eq domain3 c4 }) _5 I/ r7 b/ e
names0 t* `# b. H! z1 i' V- I
!
. @2 A R! ]# X4 B) t, tinterface GigabitEthernet0/0: [ ?2 \6 F8 z9 {) T( K
nameif outside7 _1 I- m' ^0 v/ N$ D/ `
security-level 03 a/ S2 {$ C/ q* O( |2 J _. K
ip address 111.111.111.111 255.255.255.248 -----电信IP
& `, K; m+ u& Z! `!
8 e$ h {8 Z! h& Zinterface GigabitEthernet0/1( z' _, r1 X) y4 a( q
nameif outside1
8 `* k' s! p6 H( B6 wsecurity-level 0
4 L8 r* G1 k* Oip address 222.222.222.222 255.255.255.248 -----联通IP7 g, ^; }8 H% W. }0 }! K) }
!) f8 {' {9 t# W5 ?
interface GigabitEthernet0/26 s) F1 a; r9 N+ T
nameif inside; T3 D1 U' k- o. J9 ^
security-level 100
9 B R+ _4 v) h1 }9 pip address 192.168.10.1 255.255.255.0
0 ^! k: G5 ^; v- d; g* |!. [( ?# G3 k h. c& v$ L: \* t
interface GigabitEthernet0/3
% n( u# ?9 l# B i. S$ Lshutdown2 Y L6 H2 o: F5 _) \* \8 V4 }
no nameif. F( L& W' y! n$ K: X7 u5 [
no security-level# A, g! N1 c) T) S9 b- @2 h! {
no ip address
7 P2 A6 t- L' _3 T: T1 J!' r) Z4 o0 \! s4 t3 J
interface GigabitEthernet0/4/ G: b. |# B' P" ` l# A+ w* H8 k e( Y
shutdown
! x0 y- H0 D) n' l4 Qno nameif! i$ R+ C( f3 }0 _! E7 F5 m0 ~, k
no security-level
* B) g1 V2 m& c9 D% m% {& ]4 U% f: Eno ip address
8 ]- Z9 I' |/ P# w. @!3 {7 h u# v$ b; m
interface GigabitEthernet0/5
6 X# o; L& ?0 d- `: n5 Zshutdown& q- Z+ q8 r: ^! q+ `4 [ k
no nameif
9 @7 x: ~4 h7 A5 G& l1 t* r/ sno security-level
7 ~% x+ o8 M' Q% ^% dno ip address
& m& m {5 N5 b!- _! D+ ?* E6 A7 i m
interface Management0/0
. S" W* }# y* X" H0 wmanagement-only
! e! t1 t5 b7 S7 ^$ ^nameif guanli
; m6 m1 H. ?: Ysecurity-level 07 n. D, X0 l4 `! M6 t3 A3 n) T
ip address 192.168.2.1 255.255.255.0
2 T5 N7 `" r2 q5 i& K! j+ X!
, p6 W6 O! |7 c& o( K9 V" ~2 }ftp mode passive: X2 ? ~4 u7 q4 G* \9 F
dns server-group DefaultDNS
; H1 d3 w D/ W/ |domain-name default.domain.invalid
) V5 }- P* U8 l0 rdns server-group defaultDNS
9 J) t! m- A5 g; hdns server-group defaultdns
& F, |. H+ _0 D% T; H' z. Ndns server-group enable6 p2 P: ]( w- X! _4 q8 @' a, Z+ f
dns server-group global
% U7 ^+ `4 ~. `/ T" e6 sobject network internet; B2 h7 m7 h: |
subnet 192.168.10.0 255.255.255.0
7 x9 }$ g6 s8 A) s: e* oobject network internet1. p2 z# G A+ o. h" x9 ?
subnet 192.168.10.0 255.255.255.0/ x! M* U( G( }! B/ K
object network Inside11: F, c" \0 Z: B8 Q/ d7 w
host 192.168.10.2
/ S) ~. ~% P4 ]& Eobject network Inside03
, G% [5 f' L7 Y$ C6 Y2 m* Ihost 192.168.10.3+ s3 r; z! r# A1 s4 h* I1 B
object network Inside02; `- P% ~! g" q
host 192.168.10.2
* X) f8 |2 R4 `& H+ S0 L' Fobject network Inside04
2 w3 l9 f r& w* Vhost 192.168.10.4
- s" M: p4 |/ {- y" o a0 u3 ~object network Inside12
* v# X3 V3 a; U9 O; h; rhost 192.168.10.2
5 z6 N) `7 l! b" G# ?" E) p; xobject network Inside8081
, B& X) n. i! M. l, t# q7 f+ k% Hhost 192.168.10.2
5 E5 ^$ A! L* }access-list 102 extended permit tcp any host 192.168.10.2 eq 8266 4 h, [" v6 N7 C8 x/ u, y
access-list 102 extended permit tcp any host 192.168.10.2 eq 1188 & ^$ @7 k1 o/ H' t2 y9 K5 a* n% T5 D4 u
access-list 104 extended permit tcp any host 192.168.10.2 eq 3389 3 s/ H7 f1 ?9 i7 M$ X, e
access-list 104 extended permit tcp any host 192.168.10.2 eq www / B( k |2 j2 S8 [; u6 E
access-list 104 extended permit tcp any host 192.168.10.3 eq 3389 / q" ^2 m/ r" t& Z+ x; N, [
access-list 104 extended permit tcp any host 192.168.10.4 eq 3389
3 i/ S* F o: I8 @. w& [' M2 spager lines 240 [8 i$ n5 B) @$ d' d% z. `5 n
mtu outside 15004 j/ M' F9 T! ]$ S& x5 V6 n1 s
mtu outside1 1500
9 N. {" Q. M0 y0 S+ |6 a: Fmtu inside 1500
* J: R2 w6 u( }: P% Lmtu guanli 1500
, t' x7 D# k* k2 k, u! d! W& cicmp unreachable rate-limit 1 burst-size 1
- ]9 T w7 M0 A( [; I# A8 q% f/ casdm history enable5 C- Q. _' P- M9 c. \
arp timeout 14400
/ `1 ^( C* J; F! Y# R; E2 {( `8 a- Qno arp permit-nonconnected( q1 j1 y7 t# s0 {3 e) R" a
!2 I ^2 D9 ?* T; F6 G
object network internet
5 ]4 C4 z0 @' i( p% p) z/ Onat (inside,outside) dynamic interface dns
; Y6 G# o( l4 z1 K1 k1 bobject network internet1; R$ J- @, A* s1 c8 _
nat (inside,outside1) dynamic interface dns& ~' ?5 [- A" X+ [: J
object network Inside11
4 u, v; S2 @7 G# R- D' ^nat (inside,outside) static interface service tcp 3389 33892
- |0 u( }( o, _5 V: Fobject network Inside03$ P, `. R( j9 ] ~7 L
nat (inside,outside) static interface service tcp 3389 33893
9 W: \5 {4 Q: Q I$ W* Robject network Inside02; x! D4 A* O; U8 ]% v3 m! [
nat (inside,outside) static interface service tcp www 8081 ( S' N' u! t8 ~
object network Inside047 u# i& {4 {+ f' `+ z; D
nat (inside,outside) static interface service tcp 3389 33894
# Z1 V6 ^. [5 g$ {9 L5 _7 oobject network Inside126 d' A3 g" G' G P& [
nat (inside,outside1) static interface service tcp 3389 33892 6 G+ [( a7 v. G A* h1 m8 k6 r
object network Inside8081! F7 q' g! A& H. W1 o, W$ a
nat (inside,outside1) static interface service tcp www 8081 2 o+ s- t3 x; |3 y6 F: {
access-group 104 in interface outside7 P5 [! u/ P' j) |* N1 Z
access-group 104 in interface outside19 R+ [* ]+ B9 @2 o- d6 m3 Z
route outside 0.0.0.0 0.0.0.0 111.111.111.110 16 z4 h r* ^: m! e. N1 n
route outside1 0.0.0.0 0.0.0.0 222.222.222.220 2
5 v# r" Q- R; ctimeout xlate 3:00:00- u( q" A& B. Y9 q6 f( b
timeout pat-xlate 0:00:30! K, _+ u+ C; p6 q9 f1 n
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:027 N" A: l" ^* q5 z, J. n+ |
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
! \9 t2 |6 j' I- T/ H/ w0 wtimeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
7 Y- y/ y; V/ G H; Ytimeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute* I( u- t5 P+ f# ?3 H4 I5 F* f
timeout tcp-proxy-reassembly 0:01:00
# R( @8 X9 A% z/ ~+ ^8 Vtimeout floating-conn 0:00:000 }' p7 q6 r3 n
dynamic-access-policy-record DfltAccessPolicy' D; K& Y1 n2 E1 O) T9 i
aaa-server LOCAl protocol tacacs+
4 J4 _% m4 L0 Q: P8 `0 D" l% |aaa-server Local protocol tacacs+
/ q0 d) w3 p9 S3 N8 @, Laaa-server Local (inside) host aaa-ssh
+ @! C9 d" z% A; K2 x# v3 quser-identity default-domain LOCAL
7 P& F$ ?) {+ W' b1 x; xaaa authentication ssh console LOCAL % ]# c, o0 g+ b
http server enable3 P. j8 D( m, T+ e2 W
http 192.168.2.0 255.255.255.0 guanli
. l4 o6 @. B; |! ^/ _5 Gno snmp-server location
U) \) A8 v! B' h0 C( vno snmp-server contact
/ ]1 b& a1 f2 dsnmp-server enable traps snmp authentication linkup linkdown coldstart warmstart3 Q5 Y+ b* e3 {' P4 \4 `
crypto ipsec security-association pmtu-aging infinite$ t, A8 m! Y7 A) z
crypto ca trustpool policy
+ W& y) v( P* [% E0 d9 w1 stelnet 192.168.10.0 255.255.255.0 inside
1 m+ S/ o" @0 G0 C9 ~! t6 }! Qtelnet timeout 5
4 H! |* \1 E! _2 ~7 i a0 |ssh 0.0.0.0 0.0.0.0 outside
2 T! C3 A0 O) I. ^! fssh 192.168.10.0 255.255.255.0 inside/ E; l* I5 w) R e
ssh timeout 30
) z- w# G- K# @& dssh version 2
7 G2 v% w$ P4 `! y+ Kssh key-exchange group dh-group1-sha1
2 B. c' W, P1 l% B4 v4 G0 J5 lconsole timeout 0" J3 p* ?3 g% ~* G. m/ v# W
dhcpd address 192.168.10.20-192.168.10.200 inside
6 \1 _+ u- w/ Bdhcpd dns 219.146.1.66 202.102.128.68 interface inside
+ ^$ v: r5 M8 b V; ^" Ddhcpd enable inside* W- S" f! M) Q: x' P5 k2 U; p9 N
!2 C1 ^& x3 s; O
threat-detection basic-threat+ E) t' S- P% T' o7 ~+ y
threat-detection statistics access-list! {4 h, c& G. d
no threat-detection statistics tcp-intercept
W! i: s9 J3 I, Yusername admin password izZCkX0.j7FlRkeS encrypted
3 h0 b$ D4 ?- m. ausername cisco password miNpFG.9QSZNEuyO encrypted% r( d4 O) q" g* `' f$ }# C
!
6 I' j* K: E/ h2 ?( Q) @1 t% Cclass-map inspection_default
1 l/ J" B* m1 g: F% ^5 a5 j% Fmatch default-inspection-traffic9 H @ K( x6 N$ l3 A
!
/ b& i" M' ^$ ]8 L+ N' c!0 y6 l" d# i& s/ p7 |
policy-map type inspect dns preset_dns_map
, u" `, f/ F: u& q0 s+ G8 b5 U9 }parameters+ P! E2 I, h4 S6 w% B
message-length maximum client auto
, X: [" g) d7 j( O% a; z- A message-length maximum 5122 x& x3 E) `6 G" L5 {2 ]' V
policy-map global_policy8 u; \$ P3 ~% D0 n, ]" S7 b
class inspection_default
3 q$ \2 k& V/ G8 H8 G6 `! D0 S inspect dns preset_dns_map
$ M$ [$ X4 l( S H8 Q" N7 ^: z inspect ftp 8 D) o# p6 x) Q. B# M! }- z
inspect h323 h225 ! X1 _! `9 i- u3 v
inspect h323 ras ) Q3 r) T+ _$ S3 R
inspect ip-options
, Q8 | T! M5 k% D/ B inspect netbios 3 _5 F. H. V. \% j# h r9 a
inspect rsh
9 Q5 o, y# v- e* r3 a d5 d0 K inspect rtsp ; R2 s% o5 b+ o; f( |
inspect skinny l% u5 [# M; N+ x x
inspect esmtp
+ r+ t- M0 I. ^6 {& {1 @" l* G inspect sqlnet
- w; o+ H1 h) x! ~5 s0 M inspect sunrpc
0 O- w+ f# D# l6 d7 k$ n inspect tftp
. o7 {, k8 v4 h' b inspect sip 8 n% |8 g- h$ u% M; T
inspect xdmcp
- Z+ p+ x3 z% E+ P!
/ Q2 h* X& v, T9 t" g# S7 |' ?service-policy global_policy global* a% r. V u; O) ^) S' X
prompt hostname context , @/ ~& N2 z* j: Z* y
no call-home reporting anonymous
( Z- O6 L& m. R. s; D, fcall-home
0 P! I3 i2 F$ Y& L. W" v6 o8 v+ gprofile CiscoTAC-1+ U" J! b; A( p2 F- L$ K
no active
! a! ?+ z h: U3 F2 ~ destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
; Y# V+ H1 }: d S# a; E# G destination address email callhome@cisco.com
8 R' k7 n! {. C& l4 R destination transport-method http& t+ q7 |0 ?* }5 L5 ?# _1 B' N- }
subscribe-to-alert-group diagnostic1 l7 D& i4 g' n$ y6 w
subscribe-to-alert-group environment* e; y4 e+ M [2 p" @6 W) r
subscribe-to-alert-group inventory periodic monthly 22
! J% @! c4 k9 C4 T/ G; N subscribe-to-alert-group configuration periodic monthly 22
+ \' o3 e' O2 G z" e9 m8 O, O subscribe-to-alert-group telemetry periodic daily
+ ~% X" b( Q8 p ^Cryptochecksum:6487eeef6ad7a7a17fb12f33dddb2638
3 r# |# ^# s* C4 L' E5 I8 @ r: end
+ D" S! C$ G$ n8 k: ?3 F4 a
4 V y; l% w- N% V7 k+ m9 g$ V' Z. B# L
" L2 |% Z! [1 [0 Y" Z0 @ |
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
