51CTO下载-防火墙配置.doc

ASA5510配置一例 2008-03-26 22:36 ASA Version 7.0(7) !hostname ciscoasa //配置防火墙的名字domain-name enable password 8U5h3kUMbdwQ8/f1 encrypted //配置登陆到特权模式密码//namesdns-guard!interface Ethernet0/0?? //设置外网IP//description outsidenameif outsidesecurity-level 0ip address 218.X.X.154 48 !interface Ethernet0/1 //设置内网IP//nameif insidesecurity-level 100ip address 53 !interface Ethernet0/2shutdownnameif DMZsecurity-level 30ip address 54 !interface Management0/0nameif managementsecurity-level 100no ip addressmanagement-only!passwd 8U5h3kUMbdwQ8/f1 encryptedftp mode passiveaccess-list 100 extended permit tcp any host 218.X.X.155 eq www?? //配置外网访问内部服务器指定端口//access-list 100 extended permit tcp any host 218.X.X.155 eq 8080 access-list 100 extended permit tcp any host 218.X.X.155 eq https access-list 100 extended permit udp any host 218.X.X.155 eq domain access-list 100 extended permit tcp any host 218.X.X.155 eq pop3 access-list 100 extended permit tcp any host 218.X.X.155 eq smtp access-list 100 extended permit tcp any host 218.X.X.155 eq ftp access-list 100 extended permit tcp any host 218.X.X.155 eq telnet access-list 100 extended permit tcp any host 218.X.X.155 eq 2121 access-list 100 extended permit udp any host 218.X.X.155 eq 2121 access-list 100 extended permit icmp any host 218.X.X.155 echo access-list 100 extended permit icmp any host 218.X.X.155 echo-reply access-list 100 extended permit tcp any host 218.X.X.155 eq ssh access-list 110 extended permit ip any???? //指定内部网络可以访问外部网络,匹配NAT//access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip any access-list 110 extended permit ip