
10金币
公司有台ASA5512,想用双线接入一台WEB服务器,比喻电信用http://111.111.111.111:8081,联通用http://222.222.222.222:8081访问,给调防火墙的人来好几次没调好,我又是菜鸟。现在问题是电信能访问,联通就不行了。求高手给看看:2 X0 Z& v) B/ S0 `! a# j3 V; z& b3 C& z
ASA Version 9.1(2)
1 F+ @9 s' t1 E' q!
$ n; [/ f U5 B0 u0 Z& xhostname ciscoasa
# ^ [7 ~& g) t6 x4 ldomain-name default.domain.invalid5 i8 k8 t6 T+ C( ^& p! l
enable password 2KFQnbNIdI.2KYOU encrypted
7 B9 G. p/ c3 c1 Sxlate per-session deny tcp any4 any4
5 O6 |9 D' }" V p& {, Nxlate per-session deny tcp any4 any6
. k4 X+ a) X2 F# Yxlate per-session deny tcp any6 any4
2 Z5 G a, V+ m7 N' O1 C" @( `$ Fxlate per-session deny tcp any6 any6
3 b6 X+ ~8 ~( G9 ?' T; Gxlate per-session deny udp any4 any4 eq domain" Q$ |+ C0 T$ G# {3 p8 O
xlate per-session deny udp any4 any6 eq domain* @, T" o8 @% S
xlate per-session deny udp any6 any4 eq domain( |( g) z6 C% V2 ]: a" y8 ?0 c; n
xlate per-session deny udp any6 any6 eq domain' G& g' {7 A- n! C, \
xlate per-session deny tcp any4 any4( Z1 y; D. Y3 a9 F- l4 L
xlate per-session deny tcp any4 any65 @, P6 Q u4 M
xlate per-session deny tcp any6 any4
( {0 j) b9 y9 mxlate per-session deny tcp any6 any6
# V9 C/ E2 V6 X- Mxlate per-session deny udp any4 any4 eq domain( i% {& d4 B/ {, h5 R/ E
xlate per-session deny udp any4 any6 eq domain6 Q- `$ `* g( u
xlate per-session deny udp any6 any4 eq domain
7 h: X+ j* {; ]3 ^( ^, y6 X txlate per-session deny udp any6 any6 eq domain4 L" f$ g2 I, S( _
names8 j* ^- T/ k( Q7 D( j4 v% p4 J
!
& b6 `! ]& M/ einterface GigabitEthernet0/0
7 G3 f' y6 D, N0 E/ r7 Vnameif outside
$ L& E4 H% c' ?; vsecurity-level 0
, ?) f9 {/ N' F [ip address 111.111.111.111 255.255.255.248 -----电信IP
# ~) t+ w+ }, u, B!
+ E' a* K" D! I3 }+ [$ Y: Sinterface GigabitEthernet0/15 s" E" Y- F% L8 @5 x7 t; y
nameif outside1: v3 _$ ^9 {8 ^' ^, K3 X' A
security-level 0
! e! u4 a$ k* `4 n4 H7 @4 }! Dip address 222.222.222.222 255.255.255.248 -----联通IP# I7 g0 E8 X8 H- p
!
6 ]5 l1 A0 H% ]( ~3 e/ d2 K9 finterface GigabitEthernet0/2
- {! S ` C2 L; N: t/ V( O0 cnameif inside- _3 Q3 ]1 T9 V) {
security-level 1009 H! c7 y9 ?# }+ y$ _9 m
ip address 192.168.10.1 255.255.255.0 & H4 S5 ?( Z0 ?( Y {7 r2 ]
!; i$ B5 y; e) F9 y
interface GigabitEthernet0/3' s0 w% R4 x' ?. c0 z/ o9 l, j& X
shutdown ~3 J5 l( p# ^9 n* X7 S3 Y1 {- {
no nameif
- p, u4 o/ o: Z# nno security-level. G4 t% w8 h& u+ O9 D4 c6 r% ?* r
no ip address
, D9 `% t& }9 E' Q3 `$ W!& E" b4 R; K& f8 X: W* ]; h
interface GigabitEthernet0/4
& U- Y3 ]/ X) u' \- {5 z" xshutdown
+ Z$ i3 e* N C) `no nameif
7 s; ?: ~- y% U; M& Y* E+ Fno security-level( I* G! j" G! a, _, s% ?, y
no ip address3 \' F4 x7 c) P+ E
!$ Q, ^: g6 k9 H
interface GigabitEthernet0/5
$ Q* e3 R- W, ^, ?shutdown
: u% t2 B, s2 ]" ~% n- gno nameif
* l6 e' Z' O7 Z/ X- W' N0 A) uno security-level
! Q$ J( N9 }# z1 P# L# Mno ip address. M+ _% v% Z( a0 m6 C d+ a
!+ V; U! ?: x5 A3 _
interface Management0/0
5 ? T' i4 F3 m, Y$ W% Gmanagement-only( |; C; {7 r6 ~! o% Z( n) _
nameif guanli% e) z. K8 g% Z! x8 q) L" Z
security-level 0 T) F6 r$ m" F, y% _* O
ip address 192.168.2.1 255.255.255.0
6 p: s# S3 E9 f( [0 `- d!
7 Z; I- L6 _- v# u; \ftp mode passive
: G5 \3 Y. K! i2 U2 }* Ldns server-group DefaultDNS
W! Z, E* v0 u }4 ldomain-name default.domain.invalid5 m3 N. X( p% I5 e5 h" L
dns server-group defaultDNS
6 A9 F" y: j1 O7 J8 z$ @dns server-group defaultdns
) |; B- I+ [$ J/ |- wdns server-group enable# Q5 E5 k" |0 R) \0 t" I$ O, g
dns server-group global% b, V( P& g- n S; t8 D. _
object network internet+ R% ?$ u" @% W1 R6 G1 H
subnet 192.168.10.0 255.255.255.0) N. s# E) A* ]. ~* K3 e9 C
object network internet16 f4 D* N# A4 Z2 |; L; e
subnet 192.168.10.0 255.255.255.0
& |8 n1 D: |: C2 e% @# B/ Mobject network Inside11
# Q5 g. M5 j! Phost 192.168.10.2
& \+ A3 U) }/ G- M$ s- N% `object network Inside03
2 _+ `5 p8 a% W1 X1 F4 vhost 192.168.10.3
% ^* }; l$ x/ d4 b' ^4 Cobject network Inside02
8 M0 J8 \2 E& w$ x' Q) P, ihost 192.168.10.2
/ H: y. F, c9 J5 j" o/ c, l" fobject network Inside04
2 n: h" {! v1 f. @. |host 192.168.10.4
% ^7 T- f ^# I* yobject network Inside12
. k9 [' ~; Q/ o' _5 Zhost 192.168.10.2
7 g( V; `3 t2 s Y& p3 T oobject network Inside8081/ v3 g0 d4 \8 r8 e# `
host 192.168.10.2) ]5 J5 K A& J. w- Q0 u: @1 x
access-list 102 extended permit tcp any host 192.168.10.2 eq 8266 ' W3 g2 E8 O+ D8 @ H2 F7 n7 ?
access-list 102 extended permit tcp any host 192.168.10.2 eq 1188
2 _( C& t- A& p; w8 _access-list 104 extended permit tcp any host 192.168.10.2 eq 3389
2 \6 ?% r5 {4 V7 N% y$ x M8 y" x+ Haccess-list 104 extended permit tcp any host 192.168.10.2 eq www
# @5 C9 H8 s( C+ C* F8 eaccess-list 104 extended permit tcp any host 192.168.10.3 eq 3389 $ z S, G) U( ~* R" P2 u
access-list 104 extended permit tcp any host 192.168.10.4 eq 3389
5 u/ V' N- x$ zpager lines 24
. v2 w f3 W% q' xmtu outside 1500
' J/ t' f1 M6 P+ c# Q% ^mtu outside1 1500
5 s5 o }+ X2 k+ Qmtu inside 1500
' {8 n, k0 I; C- Rmtu guanli 1500
: Y) u1 u, J8 @7 _+ Gicmp unreachable rate-limit 1 burst-size 1
3 ]8 W3 X; Y0 w8 s: W0 R) o/ easdm history enable
& `. Y+ f% {; g1 ^, ]8 s3 @arp timeout 14400
+ T% v& Z$ B3 ~no arp permit-nonconnected; Y0 b2 s; I! C6 E3 g! b1 J
! E6 z+ I) v( x' e8 z0 N3 c7 i' u
object network internet
5 l, v( A3 w0 m4 Q `: [6 M- P, onat (inside,outside) dynamic interface dns% s* y$ \0 U7 Y, ?
object network internet19 w9 E/ K8 o9 Y% F) w6 ~5 e, ]
nat (inside,outside1) dynamic interface dns ~3 b9 O3 f H& }# z! F
object network Inside118 U$ E( J" o9 _5 I& G9 S3 m2 o
nat (inside,outside) static interface service tcp 3389 33892
& F$ e# W7 _6 s# ]! V; dobject network Inside033 ]& t; b( T' a
nat (inside,outside) static interface service tcp 3389 33893 ' s- [) c/ s/ r6 J$ Z
object network Inside02
! m! N$ P8 N# rnat (inside,outside) static interface service tcp www 8081 - f/ A& ?) \" T1 m: G3 O
object network Inside04- a+ W) S1 Y4 U- a
nat (inside,outside) static interface service tcp 3389 33894
7 U; S ?: p, Oobject network Inside12. q+ m6 q8 {' `& N+ k1 d5 j" M
nat (inside,outside1) static interface service tcp 3389 33892
% @) |; `/ ~ x0 w* ^" ~5 Q& ^object network Inside80811 R# ?+ V& Y* l4 g+ J- s$ `
nat (inside,outside1) static interface service tcp www 8081
9 y2 r6 P6 J& Caccess-group 104 in interface outside
Y3 I0 z8 _* H- t, gaccess-group 104 in interface outside1% g0 o/ }$ v$ y& B5 G
route outside 0.0.0.0 0.0.0.0 111.111.111.110 15 u' K3 {6 |. j8 R% i
route outside1 0.0.0.0 0.0.0.0 222.222.222.220 2) X; C, g; t$ E' w& Z5 Y J& F
timeout xlate 3:00:007 K2 O; u% Y) R( l9 L
timeout pat-xlate 0:00:30- {& W$ z- k4 r6 e8 {7 E
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02! |, K6 }& H; G) F. _
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00- \5 Y7 [ h, U
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
9 d- t5 R: L8 ?- ^" y4 P. Ttimeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute" [. l& y& |1 G( T4 J1 l( z7 Z
timeout tcp-proxy-reassembly 0:01:00# _9 v5 q3 h( L5 z
timeout floating-conn 0:00:00
0 `' i, G+ ^9 U. n$ f/ K" o; kdynamic-access-policy-record DfltAccessPolicy
0 p% F0 F" A: ~0 p& J @. Y. K" yaaa-server LOCAl protocol tacacs+
, S; l0 v( R4 i' O7 |7 yaaa-server Local protocol tacacs+
, c1 z# Z0 Y. |- gaaa-server Local (inside) host aaa-ssh
4 }2 H: A& V4 U; s wuser-identity default-domain LOCAL
" w9 V2 y0 Q0 M6 p7 r% G8 daaa authentication ssh console LOCAL
! }, t" c8 T$ h" N1 R' M. |4 Vhttp server enable
1 Z1 S4 x( T) x9 F( ~http 192.168.2.0 255.255.255.0 guanli
7 q# p. B$ r5 q' ]/ sno snmp-server location0 l1 u& q' V2 f% a' R( E
no snmp-server contact
c3 Y) `) ^" t$ m9 R( psnmp-server enable traps snmp authentication linkup linkdown coldstart warmstart0 q* i+ _4 I8 D9 k1 E. s
crypto ipsec security-association pmtu-aging infinite$ N$ a$ Q' L+ M# ]/ @. Y! V2 | t
crypto ca trustpool policy
: j. B7 R) i$ k! N' stelnet 192.168.10.0 255.255.255.0 inside% t4 o8 K1 N- A J* L& h
telnet timeout 56 o+ |5 K! W% |8 z* ^5 `% r9 [
ssh 0.0.0.0 0.0.0.0 outside
( C4 T- O" t' x, x( |ssh 192.168.10.0 255.255.255.0 inside- k# m/ p2 u* e
ssh timeout 30/ `, T4 X1 n V* K9 D, n
ssh version 21 ~" E0 G$ I( @
ssh key-exchange group dh-group1-sha1
, K0 z9 f6 r. R, c# pconsole timeout 0* I* ^/ W( K* W9 K: {' N. R
dhcpd address 192.168.10.20-192.168.10.200 inside2 F$ e( v9 y! j2 y# s/ ]
dhcpd dns 219.146.1.66 202.102.128.68 interface inside
0 L# i- d6 ` |# B* d" t3 ddhcpd enable inside( L7 R9 {# {& {
!
! }6 o. l+ _$ `! C# X: cthreat-detection basic-threat
% L: U7 d3 N9 b+ _threat-detection statistics access-list1 [. {9 E1 g7 H
no threat-detection statistics tcp-intercept. `* ?$ @2 F1 W( x& P6 @
username admin password izZCkX0.j7FlRkeS encrypted+ [5 \. |/ D, ?$ H
username cisco password miNpFG.9QSZNEuyO encrypted
4 ?9 E; ]7 O) W1 \8 R9 R, M4 y7 f!( J: Q+ Q; p( s* D
class-map inspection_default! c" Q7 T( ~' h, l' a9 }# |8 t3 B1 b
match default-inspection-traffic% z- {$ V+ Y" W( U
!
6 p6 W2 D2 M$ t, _4 r- p!" e- X7 u n; t6 G, T6 S3 s
policy-map type inspect dns preset_dns_map
8 E0 e; p V# t6 Y1 A3 iparameters, ?& `1 Z# A* _) [% T X
message-length maximum client auto0 n6 b- Q' V7 J
message-length maximum 5122 e4 Y. P6 y& c% \1 L
policy-map global_policy
4 {$ u' w. L5 B2 H1 L( s' M& y8 Nclass inspection_default8 j' ~4 w4 }7 F0 s' K0 C, Y, |5 g
inspect dns preset_dns_map 4 ]6 G5 v# D' L0 O
inspect ftp
, \2 e8 a: m( T- x& N+ t3 ] inspect h323 h225
* K: V4 `. r( c/ {! D$ c% n$ ^ S inspect h323 ras ' r/ `3 Y& I) n6 G$ Q1 A
inspect ip-options
; ]% ^& M$ V6 X inspect netbios
, f4 W% m0 o1 R* Z9 L5 I inspect rsh
+ u0 D* ~8 f( B) `" W3 O inspect rtsp
7 y" s: m& |! o) S inspect skinny
, Z. h, d& ?5 j! s5 x+ ~" X7 v inspect esmtp / @4 `" A% a" C
inspect sqlnet . p7 z% [ a) ^+ ~/ k! G
inspect sunrpc ; ~* t, [7 [; {/ X/ y
inspect tftp 3 S- x6 B, V* D, r4 U
inspect sip & \( z! _7 E9 }. R2 S
inspect xdmcp
$ M2 L, G" R" @!% g# r6 ~" I0 Q& e# g" ^
service-policy global_policy global
7 m5 ~& g3 o! P/ s' [9 v- Rprompt hostname context
) D; w) L( s( m w! hno call-home reporting anonymous
* `* I3 O+ U5 Q# S) ucall-home' t3 }9 y6 S% m
profile CiscoTAC-1 }8 U; ?1 |9 q, o% [( @; X
no active! g8 v6 `% x+ v9 i/ c d
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
. X$ b7 D' ~# }/ ^4 t0 f destination address email callhome@cisco.com- v: k: r2 V; \7 l
destination transport-method http) Y% J1 D3 \& u- M8 b
subscribe-to-alert-group diagnostic
% ], |8 m' \+ d- ?6 ? subscribe-to-alert-group environment( _0 W# i: O5 F# x$ T) W/ b. o: }
subscribe-to-alert-group inventory periodic monthly 22
/ @' `! [! Z$ I8 }' q& ~ subscribe-to-alert-group configuration periodic monthly 22' k. n( m. y0 T! q4 Y
subscribe-to-alert-group telemetry periodic daily% S+ R% C* Q1 D4 c: o% p D
Cryptochecksum:6487eeef6ad7a7a17fb12f33dddb2638
- L. _0 Q- e2 H' I: end
* Y) y7 l6 r! P" ^% q3 k% f7 b! D0 {: R
8 e' x" X! _* W. P( i. p
3 `5 J S( X D9 I |
|