試驗(yàn)6ASA虛擬防火墻的配置

1、國(guó)家高等職業(yè)教育網(wǎng)絡(luò)技術(shù)專業(yè)教學(xué)資源庫(kù)PIX防火墻PIX防火墻安全典型案例 實(shí)驗(yàn)六 ASA虛擬防火墻的配置實(shí)驗(yàn)六 ASA虛擬防火墻的配置一、 實(shí)驗(yàn)?zāi)康耐ㄟ^(guò)該實(shí)驗(yàn)掌握ASA虛擬防火墻的配置。二、 實(shí)驗(yàn)任務(wù)l 配置ASA虛擬防火墻l 驗(yàn)證實(shí)驗(yàn)結(jié)果三、 實(shí)驗(yàn)設(shè)備ASA5505防火墻兩臺(tái)，CISCO 2950交換機(jī)兩臺(tái)，控制線一根，網(wǎng)絡(luò)連接線若干，PC機(jī)若干，Sniffer軟件一套四、 實(shí)驗(yàn)拓?fù)鋱D及內(nèi)容R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#int f0/0R1(config-if)

2、#no shutR1(config-if)#exitR1(config)#R2>enR2#conf tEnter configuration commands, one per line. End with CNTL/Z.R2(config)#int f0/0R2(config-if)#no shutR2(config-if)#exitR2(config)#*Mar 1 00:00:38.971: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:00:39.971: %LINEPROTO-5-

3、UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up*Mar 1 00:04:33.155: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:04:34.155: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR3>enR3#conf tEnter configuration comm

4、ands, one per line. End with CNTL/Z.R3(config)#int f0/0R3(config-if)#no shutR3(config-if)#endR3#*Mar 1 00:00:46.747: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to upR3#*Mar 1 00:00:46.907: %SYS-5-CONFIG_I: Configured from console by console*Mar 1 00:00:47.747: %LINEPROTO-5-UPDOWN: Line

5、 protocol on Interface FastEthernet0/0, changed state to upR3#pixfirewall# conf tpixfirewall(config)# hostname pixpix(config)# int e 0pix(config-if)# no shutpix(config-if)# int e1pix(config-if)# no shutpix(config-subif)# vlan 2pix(config-subif)# vlan 3pix(config-subif)# exitpix(config)# int e 1pix(c

6、onfig-if)# admin-context adminpix(config)# context adminpix(config-ctx)# allopix(config-ctx)# allocate-interface e1.2 inte1pix(config-ctx)# allocate-interface e0 inte0pix(config-ctx)# config-url flash:/?context mode commands/options:pix(config-ctx)# config-url flash:/adpix(config-ctx)# context depar

7、tmentCreating context 'department'. Done. (2)pix(config-ctx)# allocate-interface e1.3 inte1pix(config-ctx)# allocate-interface e0 inte0pix(config-ctx)# changeto context adminpix/admin(config)# intpix/admin(config)# interface inte1pix/admin(config-if)# nameif insideINFO: Security level for &q

8、uot;inside" set to 100 by default.pix/admin(config-if)# no shutpix/admin(config-if)# intpix/admin(config-if)# interface inte0pix/admin(config-if)# nameif outsideINFO: Security level for "outside" set to 0 by default.pix/admin(config-if)# ip add 192.168.1.1pix/admin(config-if)# no shut

9、pix/admin(config-if)# accpix/admin(config-if)# access-list outside permit icmp any any echo-repix/admin(config-if)# access-list outside permit icmp any any echo-replypix/admin(config)# access-list outside permit tcp any any eq telnetpix/admin(config)#pix/admin(config)# accesspix/admin(config)# acces

10、s-gpix/admin(config)# access-group outside in int outsidepix(config)# changeto context adminpix/admin(config)# access-list outside permit tap any any eq telnet ERROR: % Invalid Hostnamepix/admin(config)# access-list outside permit tcp any any eq telnetpix/admin(config)# access-gropix/admin(config)#

11、access-group outside in int outsidepix/admin(config)#pix/admin(config)# changeto context departmentpix/department(config)# int inte1pix/department(config-if)# nameif insideINFO: Security level for "inside" set to 100 by default.pix/department(config-if)# no shutpix/department(config-if)# i

12、nt inte0pix/department(config-if)# nameif outsideINFO: Security level for "outside" set to 0 by default.pix/department(config-if)# ip add 192.168.1.1pix/department(config-if)# no shutpix/department(config-if)# access-list outside permit icmp any any echo-replypix/department(config)# access-list outside permit tcp any any epix/department(config)# access-list outside permit tcp any any eq telnetpix/department(config)#