思科防火墙asa官方nat实验配置.docx

Insidednsserver:192.168.0.53/24员工：192.168.0.125/24Gw(asa)：192.168.0.1dmzwebserver:192.168.1.100gw(asa):192.168.1.1Outsideisp:198.51.100.130防火墙：198.51.100.100/24Isp边界router连接公司：G0/0198.51.100.130/24连接Internet用户：gl200.1.1.1/24互联网PC用户200.1.1.5/24ASA:ConftNoipdomain-1interfacegl/1nameifoutsidesecurity-levelOipaddress198.51.100.100255.255.255.0noshut!interfacegl/2nameifinsidesecurity-level100ipaddress192.168.0.1255.255.255.0noshutIinterfacegl/3nameifdmzsecurity-level50ipaddress192.168.1.1255.255.255.0noshut!routeoutside0.0.0.00.0.0.0198.51.100.11步-将NAT配置为允许主机连接到互联网nat:objectnetworkinside-subnetsubnet192.168.0.0255.255.255.0nat(inside,outside)dynamicinterfaceIobjectnetworkdmz-subnetsubnet192.168.1.0255.255.255.0nat(dmz,outside)dynamicinterface第2步将NAT配置为从互联网访问Web服务器:objectnetworkwebserver-external-iphost198.51.100.101objectnetworkwebserverhost192.168.1.100nat(dmz,outside)static198.51.100.10第3步-配置ACL：access-listoutside_aclextendedpermittcpanyobjectwebservereqwwwIaccess-groupoutside_aclininterfaceoutsideobjectnetworkdns-serverhost192.168.0.53Iaccess-listdmz_aclextendedpermitudpanyobjectdns-servereqdomainaccess-listdmz_aclextendeddenyipanyobjectinside-subnetaccess-listdmz_aclextendedpermitipanyanyIaccess-groupdmz_aclininterfacedmz第4步-使用PacketTracer功能测试配置packet-tracerinputinsidetcp192.168.0.12512345203.0.113.180packet-tracerinputoutsidetcp192.0.2.12312345198.51.100.10180isp边界routerenconfthostISP-DIANXINNOipdomina-lIntg00Ipad198.51.100.130255.255.255.0NoshutIntglIpad200.1.1.1255.255.255.0Noshut