初始化ASA

拓扑图：

防火墙实验拓扑

配置：

Outside:

interface Loopback0

ip address 1.1.1.1 255.255.255.0

interface FastEthernet0/0

ip add 202.100.1.1 255.255.255.0

no sh

exit

ip route 0.0.0.0 0.0.0.0 202.100.1.10

line vty 0 15

password cisco

exit

Inside:

interface Loopback0

ip address 2.2.2.2 255.255.255.0

interface FastEthernet0/0

ip add 10.1.1.1 255.255.255.0

no sh

exit

ip route 0.0.0.0 0.0.0.0 10.1.1.10

line vty 0 15

password cisco

exit

DMZ:

interface Loopback0

ip address 3.3.3.3 255.255.255.0

ip ospf network point-to-point

interface FastEthernet0/0

ip add 192.168.1.1 255.255.255.0

no sh

exit

router ospf 110

network 3.3.3.0 0.0.0.255 area 0

network 192.168.1.0 0.0.0.255 area 0

exit

ip route 0.0.0.0 0.0.0.0 192.168.1.10

line vty 0 15

password cisco

exit

ASA:

interface GigabitEthernet0

nameif outside

ip address 202.100.1.10 255.255.255.0

no sh

interface GigabitEthernet1

nameif inside

ip address 10.1.1.10 255.255.255.0

no sh

interface GigabitEthernet2

nameif dmz

security-level 50

ip address 192.168.1.10 255.255.255.0

no sh

exit

router ospf 110

network 192.168.1.0 255.255.255.0 area 0

exit

route outside 0.0.0.0 0.0.0.0 202.100.1.1 1

route inside 2.2.2.0 255.255.255.0 10.1.1.1 1

存在问题：

ASA和router通过一台switch（3600 router模拟）连接时，switch上面划分3个VLAN，ASA使用子接口（单臂路由），目前在ASA上面无法ping通router上面的直连地址。