本帖最后由 宅男女神 于 2016-11-28 22:59 编辑 ; y3 Z) \6 c1 b3 |" K/ g
% H5 Y" ~0 g9 D: A问大家一个防火墙的问题：asa9.4版应该是支持PBR的，但是为啥不生效呢
: U+ S% ]. c: b; N4 W
问大家一个防火墙的问题：asa9.4版应该是支持PBR的，但是为啥不生效呢
% P* v3 g( o2 m: E* ^$ Y4 ^
目前好像如果单独使用其中任何一个ISP，上网都没有问题，但是只要双线路启用就会有问题
& E- n/ G$ f# I5 X" V0 l: ]6 Z G2 e. G* k8 Q2 y
; l) f, l' i+ ]. ?" D: m, D9 y
, _( h" ~ b, C2 P# y就是分别对两个内网网段做了动态NAT啊
* L* C2 X$ \7 w' V8 r5 A# G! ~* _6 i+ l( `& _& D! Z: k
4 h) y2 I$ b Q: F% f
另外一个网段不能上网
9 A1 i: x0 }' x+ D4 K) T: o0 ?/ g6 ]
我在那个访问规则匹配值是看到了2 ?+ y% X- z4 M- g& e
' |+ Q% P) i* `有数据的，那就应该是走那个策略路由出去了
; e z3 S: f& L# Z
! ^% l7 W% j1 X! S) y- o- _- }% o7 J
本问题来自群 2258097
% N8 I( E# ~2 {, B
0 ?( G! H i, ^% }6 Y/ {配置如下
7 D1 Y, R( I/ O6 O9 p; T
/ n$ B/ T8 ?6 g. Q/ d) ^ciscoasa# show running-config ) s) ~/ h% U8 r: S
: Saved2 X4 r& O8 b# q, M& O% @% A0 I% F
8 N/ H8 }$ v3 ]7 p! ?! h
: : Y2 @, \6 n' g
: Serial Number: 9AN3CME1SPN7 o9 A0 @6 Z, R9 Q
: Hardware: ASAv, 2048 MB RAM, CPU Xeon 5500 series 1496 MHz" L8 f5 |7 y' `' y7 A* l
:
1 f3 {! Y3 }8 lASA Version 9.4(1) * h2 F5 j3 w* O+ ~, e, y% p
!& y* e/ u+ F2 c& r
hostname ciscoasa
I9 U# d) P5 Renable password 8Ry2YjIyt7RRXU24 encrypted, g0 `0 `! H8 {+ @% s l7 b3 @2 s# [+ Y
names
4 e" b, k8 ^ h6 \8 ]; U3 k8 |$ e!
# [. s3 O* ~$ R% r- r1 n- K3 Hinterface GigabitEthernet0/0; p7 V" `) \6 O3 x: V
nameif inside8 a, n. v8 S! [
security-level 100
* o. e% D1 x6 m, s' y, k ip address 172.16.1.1 255.255.255.0 ! {6 t! V( I0 V% e* h
policy-route route-map lan; Q" d7 m2 z( C# T$ ^( K' `9 {% r
!
0 N( j# _; A7 l4 d! e' |interface GigabitEthernet0/1
8 e/ D) s" _( n. V nameif server$ e9 H7 { f4 o2 D0 O( {! Y
security-level 100
- J' n- F8 e" f, }; |0 F0 F ip address 172.16.2.1 255.255.255.0 4 [, E' d3 H/ n+ T9 o, q$ [" }
policy-route route-map server
" e& I% u5 ]" K!, S8 Y, i& E) ?. y4 Q
interface GigabitEthernet0/2
; b2 s4 _1 r, m( D# f1 L5 z5 ~- K nameif outside4 v* A! D; J/ @. K& y
security-level 09 u2 i& b! z' a0 D& j
ip address 192.168.1.1 255.255.255.0 : ?; J. H* v2 M( O1 [+ h( S
!0 E& I* U3 J' X0 \) ~
interface GigabitEthernet0/3* b" t0 q) U4 k+ T( k
nameif outbackup1 Z# S) t! H+ X& Z+ W2 p3 P O
security-level 0 {* a* p3 ]3 e2 N: d5 F
ip address 192.168.13.250 255.255.255.0 2 A5 g) P# K5 a( o; p
!2 x7 T% Y* k- c$ y" C3 k
interface Management0/0* [9 Q9 |3 x6 w2 E1 m) O" w
management-only
: B. N& t, b- N4 y% Q! y! H shutdown* D% L$ L' S+ J1 w6 U
no nameif7 E9 s" Q9 e7 L: H, d, w9 m- n
no security-level3 T0 B' I' Q- w/ c- d( q) H& I
no ip address
3 Z0 |/ `+ d) X+ O! z% Z& \ G!
4 s _* ~7 [# N, t- Pftp mode passive
2 g8 a G, @+ X, ]% @+ n5 @object network lan0 h6 K- t8 u) d) r7 Y; z+ F- Q
subnet 172.16.1.0 255.255.255.01 y2 z4 j$ A" l6 Q! ?& _
object network server
5 i, \4 L+ Q1 H/ a/ ` subnet 172.16.2.0 255.255.255.0
5 W5 h' g% f9 P" e& l4 jaccess-list lan extended permit ip 172.16.1.0 255.255.255.0 any
* N8 _9 P* ` C/ u: X% E3 t8 Oaccess-list server extended permit ip 172.16.2.0 255.255.255.0 any 5 N$ s. M2 [6 B G* Z
pager lines 23
9 e' I/ E, ~7 d; N. ?mtu inside 1500+ {; J! O' V5 p) l+ S) x
mtu server 1500
% S5 ?% Y( S9 g6 G+ i9 ?mtu outside 1500
9 i) j6 ^3 o7 w8 omtu outbackup 1500 o9 G1 k7 S# D' N) L$ B
no failover% s l# a# S4 K1 {
no monitor-interface service-module " T; s+ c5 `4 ^9 o5 a' n
icmp unreachable rate-limit 1 burst-size 1
2 U4 k2 m7 G8 cno asdm history enable* P3 h5 Q; _& c1 I9 Z( I/ q# Y/ p
arp timeout 14400
! @4 O: U7 z( @ g% ]no arp permit-nonconnected
4 J' z( H& g+ ]( J& Rnat (inside,outside) source dynamic lan interface8 r' p' V# m8 c
nat (inside,outbackup) source dynamic server interface/ i; A( j4 u5 L% s8 T
!
6 P5 |. _. Z3 S2 r- kroute-map server permit 10
8 v% c7 K S3 x E. S match ip address server
5 `" B8 r, P3 l* \& F5 J set ip next-hop 192.168.13.29 [, Y- o( a9 v
" J5 ~9 \; [( x- T4 P* C( ]
!' U8 w* v, L2 G! B- a' P5 z
route-map lan permit 10+ K, T0 ?8 G! x- ^) s
match ip address lan+ z5 O! r" G! @( J1 r
set ip next-hop 192.168.1.2
3 X% U4 o) e$ W1 m$ Y- t, [
& e* @: ? m9 b( V, d" R1 N* @4 Y) e!2 Z v4 L$ E C+ F) K m9 X. v
timeout xlate 3:00:004 K0 d5 ~1 `& X7 e
timeout pat-xlate 0:00:309 ~, Q2 T* a' x9 p* f5 R! {) U
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
+ w5 o6 Q$ ]- U# d8 ctimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:008 s5 k7 r/ d: Y: g( q- k* N
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
/ V' v( U/ ~% U1 `timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute+ Y, O* O3 J; K Z# o9 c, T# b
timeout tcp-proxy-reassembly 0:01:00
* j/ c$ }" t. p, Etimeout floating-conn 0:00:00( D* n. ^* l. |) r; ~0 t
user-identity default-domain LOCAL! z5 H/ u9 @- j
no snmp-server location
2 a R+ n# G7 T" q3 c B- rno snmp-server contact
# N! }; a5 V2 R$ T8 ?* Rcrypto ipsec security-association pmtu-aging infinite2 {: d, R8 k& a2 V( m
crypto ca trustpoint _SmartCallHome_ServerCA) T' K1 F' y/ u
no validation-usage
, v- z8 X; S: c8 U crl configure: ~" C. J" } x z
crypto ca trustpool policy& B* ^3 o! i+ N3 F
crypto ca certificate chain _SmartCallHome_ServerCA
( Y; V) i& E" Q+ M certificate ca 6ecc7aa5a7032009b8cebcf4e952d491/ [3 H7 `, _ W1 ]. u
308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
% T- c+ S: v) t2 Y% R 0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
& o6 \+ ~8 h5 S 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
7 ~4 T+ L" {4 y# Q% ^; ^3 l 13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
8 o9 f g" H7 M 0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
3 l) u8 E/ H0 c 20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
# O0 \6 ?# K7 c4 k$ ? 65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
8 ~% P( S/ {8 d1 c4 ^; H 65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31 7 r% a8 q7 P6 i* Y2 O7 V
30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
+ e8 D) D% R7 q- {( s# n 30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
4 G. K4 q) i+ x/ f' w 496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
- p5 b( ~ K& Y 74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420 ( [6 Q$ p* V& z( O1 |2 e
68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329 % {5 X- ?: ~' f- C6 X: f5 g" Y. C7 Q
3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
6 E* b, O+ {" ?, ~' I; z/ O 63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
9 E& A5 E+ I! T7 j* [ 0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597 & P5 F* P; P$ X3 E: l
a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10 8 a3 k" C' D# H
9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc v" E6 a8 ^: j5 \
7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
0 {; x0 K9 Z/ `' @8 R$ `/ D 15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
; F6 ^; s/ I+ Z/ P 63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
2 o7 i+ _+ p0 g# J/ J7 m1 S% w p 18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
2 P7 t+ i; g( W7 Q. Q 4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
( Q- V$ ]- \& M/ d+ Z. q9 ] 81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
/ E$ Z! Q/ W7 d/ c db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868 : p6 ~# e; U6 ?8 [8 j+ P
7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
8 E! k( p1 I8 S7 q# x ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
" z' v" O" w! l, r2 W, @2 Z 45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
5 e; c2 S) \5 W* }# Q 2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a / E, p0 O- e9 s) H( y. Z: \+ Q; `
1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406 2 ~/ G; X# A* W* }- [( \8 ?/ ~
03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973 , N" \6 h! `2 ?$ B2 u
69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
& z K+ J3 `( ~ 02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
2 w. f" c9 o0 G+ Z @- U 6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b M* _' P; }0 e0 X# @
c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
9 h- s' B# h+ r. J' x 69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30 $ _- M. z. Y3 i! T4 }# h9 a$ b% P
1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603 5 g! P% n$ Q# r' F! Y
551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 . q, @" Y4 h* o6 `
1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609 + G% i9 N# y- }$ N# y
2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
8 U4 G$ _- R, m/ q 4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e " ]% G' C s+ G0 R) `
b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a 5 K- H7 Z1 [1 T+ s( t5 N+ }
6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
" O0 \# d- I* N# |: { 481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16 % z, ^, N9 w3 Z' b7 a# j( {1 S* x
b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0 $ Y& ]4 ?5 |8 a: k# V: }1 V! D
5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
5 m: F3 k( r* I" M' L# ` 6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28 - @% k% f! q5 Q3 [" e
6c2527b9 deb78458 c61f381e a4c4cb66
1 \3 w! w* z4 w# B8 G1 U quit
' w* B3 U: @! j, ]5 C( A9 Ctelnet timeout 5' i! u' s! B9 z' D! a5 T7 g, r
ssh stricthostkeycheck
7 c* d: _8 T$ b8 Issh timeout 51 t9 j: Q1 R" h3 t1 L- l5 a
ssh key-exchange group dh-group1-sha1
2 S! q6 ?1 s& q, U9 @console timeout 0
3 [- j3 }# V; n' W: w# Gthreat-detection basic-threat
0 a# x. \! _) h$ S. ~- \" Cthreat-detection statistics access-list
# T" o( ?; B7 b; v; x& I3 }! fno threat-detection statistics tcp-intercept( T; k; x3 }7 @- K T
dynamic-access-policy-record DfltAccessPolicy7 D# D5 W" I4 L& r+ V+ V' j. A
!
1 W- b4 f& m+ I3 q% \$ \1 jclass-map inspection_default
' y( U6 Z0 C$ u: p6 r match default-inspection-traffic. o6 c* k9 I1 S+ Q6 `4 C
!1 P: v8 S0 V2 t+ V j
!
+ n+ e6 s8 B1 N) a: f% U, ]2 Kpolicy-map type inspect dns preset_dns_map
( v) w) Y/ Q7 @) @$ x6 _ parameters$ V: x8 B6 b" V3 v& `1 @
message-length maximum client auto) ?# e$ ]2 C$ H8 K2 i
message-length maximum 512
0 J* Z6 q+ _4 b7 ^8 Upolicy-map global_policy6 J! A! G4 o# V1 r# ]
class inspection_default1 o$ k% }3 O# N$ t8 v2 L
inspect rtsp
; e. i/ P9 N- ~- s' r f inspect sunrpc
. A9 X5 A' R% I8 x9 [1 _ inspect xdmcp
1 V) g2 ?$ k' o2 I. ] inspect netbios
# ?3 z1 L9 ^- K2 Z4 M inspect tftp % Q3 V! F; x$ d9 f9 ?: Q% K
inspect ip-options * C7 Q; [/ a3 d
inspect dns preset_dns_map 7 \$ g' ~) v8 U2 G+ v' J+ `
inspect ftp
, N/ C# @# A3 c) s5 A inspect h323 h225 4 ?& {0 T( U' _! R# }) P
inspect h323 ras {3 X1 [9 w: b) c% L
inspect rsh " h) S$ X5 G' k5 _0 B$ [! ?
inspect esmtp W" w" U. L3 v: Z$ y: _. U
inspect sqlnet & y: w* e/ D) ?; |2 R, R
inspect sip
" A: P; _# U6 k: d1 b( z/ d( n inspect skinny
4 h; S# q; u+ s2 @$ L/ ^1 x, @% I!# E8 ?3 u- N j8 e. Z3 K
service-policy global_policy global: T% h3 v3 H" S; a0 s: E
prompt hostname context
2 {3 k8 x# F& Uno call-home reporting anonymous
; D' X% e2 J: ^- @8 J7 [call-home
7 a; ~9 \8 z( _" p8 `- d. N2 ]% X$ I profile CiscoTAC-16 |) z2 x/ v' T% @8 Q/ K: r% S% T; I
no active# R$ P0 U( P1 j# n$ [* Q$ e& p4 F
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
M8 i0 \' G4 `& V; b. F2 N destination address email callhome@cisco.com
9 ]: S" v" }" w destination transport-method http5 Y: E3 n' E) j( _5 A
subscribe-to-alert-group diagnostic
9 i9 |3 E4 `4 {4 P subscribe-to-alert-group environment: e2 b% ?- Z' ^
subscribe-to-alert-group inventory periodic monthly 27- v9 `1 V2 ?! n/ s& N" X* {
subscribe-to-alert-group configuration periodic monthly 27# P9 V K5 n* L# q" E$ A( ?9 _
subscribe-to-alert-group telemetry periodic daily! w; L+ |1 g6 h, i4 e7 l4 e
profile License
$ O4 Q1 R& Q2 a" y4 a$ V destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
+ ?# K$ Y8 ^; }# d! x. ^$ v destination transport-method http
( Q" Y& N( t% I, p1 C, ICryptochecksum:367d7bcd02decad6d2fe819ab124d263! V, J% F( _. g
: end0 K8 H5 T* @ [' O2 C5 h5 m4 `+ J
8 N2 @7 }! R$ e- R1 R |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
先考虑路由问题吧，这明显不是9.0，是8.4以前的版本，考虑这种NAT和策略路由能否共存。。。。。
