ASA安全实验1.docVIP

实验配置步骤参考：1、初始化ASA设备ASA(config)# hostname ASAASA(config)# domain-name ASA(config)#interface e0/0ASA(config-if)#nameif outsideASA(config-if)#sec 0ASA(config-if)#ip address 1 ASA(config-if)#no shutdownASA(config)#interface e0/1ASA(config-if)#nameif insideASA(config-if)#sec 100ASA(config-if)#ip address 54 ASA(config-if)#no shutdownASA(config)#interface e0/2ASA(config-if)#nameif dmzASA(config-if)#ip address ASA(config-if)#sec 50ASA(config-if)#no shutdown2、配置ASA静态路由ASA(config)#route outside 3、配置ASA的telnet、SSH远程管理接入ASA(config)#telnet insideASA(config)#crypto key? generate rsa modulus 1024ASA(config)#ssh 0 0 outside4、配置PAT与Static NATASA(config)#nat (inside) 1 ASA(config)#global (outside) 1 interfaceASA(config)#static (dmz,outside) tcp interface www www5、通过配置ACL放行WWW、ICMP流量ASA(config)#access-list OUT extended permit icmp any anyASA(config)#access-list OUT extended permit tcp any interface outside eq www6、配置日志服务器()ASA(config)# logging enableASA(config)# logging trap informationalASA(config)# logging host inside 7、ASA启用URL过滤ASA(config)# regex url1 \.sohu\.com---.----------------------------------------------------------------------------------ASA(config)# access-list tcp_filter permit tcp any eq wwwASA(config)# class-map tcp_filter_classASA(config-cmap)# match access-list tcp_filter?-------------------------------------------------------------------------ASA(config)# class-map type inspect http http_class--------把字符串划分类ASA(config-cmap)# match request header host regex url1-------------------------------------------------------------------------ASA(config)# policy-map type inspect http http_url_policy-----带http检测类型的策略映射ASA(config-pmap)# class http_classASA(config-pmap-c)# drop-connection log----------------------------------------------------------------------------ASAconfig)# policy-map inside_http_url_policy ---标准的策略映射??ASA(config-pmap)# class tcp_filter_classASA(config-pmap-c)# inspect http http_url_policyASA(con