1.基本配置及配置內外網接口
conf t hostname ASAFW #設置主機名 enable secret pass123 #設置特權密碼 clock timezone GMT 8 #設置時區 dns domain-lookup inside dns server-group DefaultDNS name-server 114.114.114.114 name-server 223.5.5.5 name-server 223.6.6.6 interface GigabitEthernet0/0 nameif outside security-level 0 ip address 118.25.235.100 255.255.255.0 #我的外網IP是118.25.235.100 interface GigabitEthernet0/1 nameif inside security-level 100 ip address 192.168.2.1 255.255.255.0 #我的內網網段是192.168.2.0/24
2.配置外網路由
route outside 0.0.0.0 0.0.0.0 118.25.235.1 1 # route outside 0.0.0.0 0.0.0.0 外網網關 1
3.配置內網NAT上網配置
nat-control global (outside) 1 interface nat (inside) 1 192.168.2.0 255.255.255.0
4.配置DHCP服務器
dhcpd lease 14400 dhcpd address 192.168.2.2-192.168.2.254 inside #設置DHCP的IP地址池 dhcpd dns 114.114.114.114 223.5.5.5 interface inside dhcpd enable inside
5.配置端口映射(因爲我外網只有一個IP因此，設置的時候就是interface,一定要先設置外網IP再來設置端口映射)
static (inside,outside) tcp interface 80 192.168.2.2 80 netmask 255.255.255.255 static (inside,outside) tcp interface 443 192.168.2.242 tcp netmask 255.255.255.255 如果存在多個外網IP，如何設置端口映射呢？ static (inside,outside) tcp 118.25.235.101 80 192.168.2.2 80 netmask 255.255.255.255 static (inside,outside) tcp 118.25.235.101 443 192.168.2.242 tcp netmask 255.255.255.255 直接將IP寫上，注意如果只有一個IP，只能寫interface
6.ACL及內外網策略
access-list outside extended permit ip any any access-list outside extended deny icmp any any access-list inside extended permit icmp any any access-list inside extended permit ip any any access-group outside in interface outside access-group inside in interface inside
7.配置ssh登錄
crypto key generate rsa modulus 1024 aaa authentication ssh console LOCAL username user1 password xxxx //配置ssh用戶名密碼 ssh version 1 ssh 0.0.0.0 0.0.0.0 inside //配置SSH內網可以登錄及訪問 #ssh 0.0.0.0 0.0.0.0 outside //配置SSH外網可登錄,一般我不打開外網登錄，因爲只能使用ssh version 1
8.設置ASA系統時間及SNMP
clock set 13:14:00 2 feb 2012 snmp-server host inside 192.168.2.2 community public version 2c snmp-server enable traps
9.IP限時限速
定義在上班時間段(09:00-18:00)內IP進行限速
#設置時段 time-range rate_limit periodic daily 9:00 to 18:00 #設置IP,需要設置上傳或下載速度 access-list rate_limit20 extended permit ip host 192.168.2.20 any time-range rate_limit access-list rate_limit20 extended permit ip any host 192.168.2.20 time-range rate_limit #限速 class-map map20 match access-list rate_limit20 policy-map rate_limit class map20 police input 10240000 5120 #最多1M的下載速度 police output 10240000 5120 #最多1M的上傳速度 service-policy rate_limit interface inside
如果需要定義一段IP呢，比如我要定義從192.168.2.20-192.168.2.199這個ip段內IP的速度怎麼處理呢，因爲一個policy-map裏最多含64個class map,那怎麼處理呢
注意一下這種策略是IP段所有IP速度之和不大於1M，這樣限速沒有意義:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ 以下限速的是整個IP段的速度之和進行限制 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ time-range rate_limit periodic daily 09:00 to 18:00 object-group network rate_limit network-object 192.168.2.0 255.255.255.0 access-list rate_limit extended permit ip object-group rate_limit any time-range rate_limit access-list rate_limit extended permit ip any object-group rate_limit time-range rate_limit class-map map1 match access-list rate_limit policy-map map2 class map1 police input 10240000 5120 police output 10240000 5120 service-policy map2 interface inside
如何配置呢，找一個折中點:我們把每10個IP作爲一組，這樣即便是能下載但是也隻影響10個人的網速
object-group network rate_limit20 network-object 192.168.2.20 255.255.255.255 network-object 192.168.2.21 255.255.255.255 network-object 192.168.2.22 255.255.255.255 network-object 192.168.2.23 255.255.255.255 network-object 192.168.2.24 255.255.255.255 network-object 192.168.2.25 255.255.255.255 network-object 192.168.2.26 255.255.255.255 network-object 192.168.2.27 255.255.255.255 network-object 192.168.2.28 255.255.255.255 network-object 192.168.2.29 255.255.255.255 object-group network rate_limit30 network-object 192.168.2.30 255.255.255.255 network-object 192.168.2.31 255.255.255.255 network-object 192.168.2.32 255.255.255.255 network-object 192.168.2.33 255.255.255.255 network-object 192.168.2.34 255.255.255.255 network-object 192.168.2.35 255.255.255.255 network-object 192.168.2.36 255.255.255.255 network-object 192.168.2.37 255.255.255.255 network-object 192.168.2.38 255.255.255.255 network-object 192.168.2.39 255.255.255.255 object-group network rate_limit40 network-object 192.168.2.40 255.255.255.255 network-object 192.168.2.41 255.255.255.255 network-object 192.168.2.42 255.255.255.255 network-object 192.168.2.43 255.255.255.255 network-object 192.168.2.44 255.255.255.255 network-object 192.168.2.45 255.255.255.255 network-object 192.168.2.46 255.255.255.255 network-object 192.168.2.47 255.255.255.255 network-object 192.168.2.48 255.255.255.255 network-object 192.168.2.49 255.255.255.255 access-list rate_limit20 extended permit ip object-group rate_limit20 any time-range rate_limit access-list rate_limit20 extended permit ip any object-group rate_limit20 time-range rate_limit access-list rate_limit30 extended permit ip object-group rate_limit30 any time-range rate_limit access-list rate_limit30 extended permit ip any object-group rate_limit30 time-range rate_limit access-list rate_limit40 extended permit ip object-group rate_limit40 any time-range rate_limit access-list rate_limit40 extended permit ip any object-group rate_limit40 time-range rate_limit class-map map20 match access-list rate_limit20 class-map map30 match access-list rate_limit30 class-map map40 match access-list rate_limit40 policy-map rate_limit class map20 police input 10240000 5120 police output 10240000 5120 class map30 police input 10240000 5120 police output 10240000 5120 class map40 police input 10240000 5120 police output 10240000 5120 service-policy rate_limit interface inside
9.開啓ASDM圖形化管理
web*** username admin password admin http server enable 或者http server enable 8080(端口號) http 0.0.0.0 0.0.0.0 inside asdm image disk0:/asdm-722.bin
10.如何保存配置
copy running-config startup-config
11.備份配置及操作系統
show flash --#-- --length-- -----date/time------ path 3 4096 Aug 16 2017 12:25:12 log 8 4096 Aug 16 2017 12:25:24 crypto_archive 9 4096 Aug 16 2017 12:25:26 coredumpinfo 10 43 Aug 16 2017 12:25:26 coredumpinfo/coredump.cfg 78 15261696 Aug 16 2017 12:36:40 asa824-k8.bin 79 24047892 Aug 16 2017 12:39:12 asdm-722.bin copy asa824-k8.bin t copy asdm-722.bin t copy running-config tftp://192.168.2.3
12.記錄ASA日誌
logging enable logging timestamp logging trap informational logging asdm informational logging facility 17 logging host inside 192.168.2.25 #192.168.2.25爲開啓了遠程記錄的syslog日誌服務器
13.如何做failover
主機
failover failover lan unit primary failover lan interface HA GigabitEthernet0/3 failover interface ip HA 10.254.254.1 255.255.255.252 standby 10.254.254.2 interface GigabitEthernet0/3 description LAN Failover Interface no shutdown #另外如果要減少主備切換後數據報文的丟失，以及避免重建會話，就需要利用一條單獨的鏈路用於同步狀態數據庫 interface GigabitEthernet0/2 no shutdown failover link state GigabitEthernet0/2 failover interface ip state 11.0.0.1 255.255.255.0 standby 11.0.0.2
備機
failover failover lan unit secondary failover lan interface HA GigabitEthernet0/3 failover interface ip HA 10.254.254.1 255.255.255.252 standby 10.254.254.2
14.開啓netflow啓用流量分析
flow-export destination inside 192.168.2.26 2055 #netflow分析服務器及端口 flow-export delay flow-create 30 flow-export template timeout-rate 1 access-list netflow-hosts extended permit ip any any class-map netflow-traffic match access-list netflow-hosts policy-map global_policy class inspection_default class netflow-traffic flow-export event-type all destination 192.168.2.26 service-policy global_policy global
我們使用SolarWinds網絡分析套件，因此就是2055端口
SolarWinds-OrionNPM-v10-SLX
SolarWinds-Orion-NTA-v3.5-Full-SLX
