思科ASA防火墙8.4版本NAT的配置方法(转自新浪 刀光剑影)


  • 思科ASA防火墙8.4版本NAT的配置方法


  •  
    ASA防火墙新版本8.4-工程实用手册
    注意,现在思科ASA防火墙已经升级到8.4,从8.3开始很多配置都有颠覆性的不同,特别是NAT配置很不一样,使用了object /object-group的新方式
    这里为了大家工程实施起来方便,特别总结了如下NAT应用,希望能够帮助大家。
    ASA 8.3 NAT 转化新语法:
    Topology :
     
    L100 200.0.9.10 R1 ---.2----192.168.1.0----.1---ASA----.1----10.10.10.0---.2---R2 L100 100.1.64.1
     
    The order of operations works as configured by each section. In order:
     1. Manual Nat
     2. Auto Nat
     3. After Auto
     
    Dynamic NAT/PAT场景一:
     
    所有内网流量访问外网时都转换为接口的公网地址,此环境适用于仅有一个公网地址的小型办公室。
     
    Object network inside-outside-all
     
    Subnet 0.0.0.0 0.0.0.0
     
    Nat (inside,outside) dynamic interface
     
    原有的语法
    nat (inside) 1 0 0 global (outside) 1 interface
     
    验证:
     
    ciscoasa(config)# show nat detail
     

     
    ciscoasa(config)# show xlate
     

     
    ciscoasa(config)# show conn
     

     
    场景二
     
    所有内网流量访问外网时都转换为特定的公网地址,此环境适用于的小型办公室或分支办公室。
     
    Object network inside-outside-all
     
    Subnet 0.0.0.0 0.0.0.0
     
    Nat (inside,outside) dynamic 10.10.10.3
     
    原有的语法
    nat (inside) 1 0 0
    global (outside) 1 10.10.10.3
     


    场景三
    对于有大量公网地址用户,常应用在运营商或者公司内网

     
    Object network inside-outside-trans
     
    Range 10.10.10.100 10.10.10.200
     
    Object network inside-outside-all
     
    Subnet 0.0.0.0 0.0.0.0
     
    Nat (inside,outside) static inside-outside-trans
     
    原有的语法
     
    nat (inside) 1 0 0
    global (outside) 1 10.10.10.100 10.10.10.200
     

    景四
    对于有大量公网地址用户,常应用在运营商或者公司内网,为防止地址用完可以配置一个PAT和interface (推荐)

     
    Object network inside-outside-trans
     
    Range 10.10.10.100 10.10.10.200
     
    Object network inside-outside-PAT
     
    Host 10.10.10.201
     
    Object-group network nat-pat-grp
     
    Network-object object inside-outside-trans
     
    Network-object object inside-outside-PAT
     
    Object network inside-outside-all
     
    Subnet 0.0.0.0 0.0.0.0
     
    Nat (inside,outside) dynamic nat-pat-grp interface
     
    原有的语法
     
    nat (inside) 1 0 0
    global (outside) 1 10.10.10.100 10.10.10.200
     
    global (outside) 1 interface
     
    验证方法和结果请查看场景三
     
    Static NAT/PAT场景五
    内网有邮件和Web服务器为远程办公用户提供访问,此环境适用于HQ和分支办公室

     
    object network server-static
     
    host 10.10.10.3
     
    object network inside-server
     
    host 200.0.9.10
     
    nat (inside,outside) static server-static
     
     
     
    原有语法
    static (inside,outside) 10.10.10.3 200.0.9.10 netmask 255.255.255.255
     

     
    场景六
    此环境用户的需求比较复杂,客户在低安全区域有很多提供业务服务的小型机,他需要隐藏被访问的服务器地址,同时要求对外网server的访问进行Static方式一对一的映射。

     
    object network outside-inside-waiguanju-trans69
     
    host 100.1.64.40
     
    object network waihuiju-des-add3
     
    host 197.0.244.3
     
    object network outside-inside-waiguanju-shouzhi-shenbaoxitong
     
    host 100.1.95.1
     
    object network waihuiju-des-add4
     
    host 197.0.244.4
     
    object network outside-inside-waiguanju-trans63
     
    host 100.1.95.2
     
    object network waihuiju-des-add5
     
    host 197.0.244.5
     
    object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz
     
    host 100.1.64.30
     
    object network waihuiju-des-add6
     
    host 197.0.244.6
     
    object network outside-inside-waihuiju-aoyunyingji-fabuwangzhan
     
    host 100.1.248.40
     
    object network waihuiju-des-add7
     
    host 197.0.244.7
     
    object network outside-inside-waihuiju-geren-gouhui
     
    host 100.1.248.20
     
    object network waihuiju-des-add8
     
    host 197.0.244.8
     
    object network outside-inside-waihuiju-jieshouhui-ceshixitong
     
    host 100.1.248.26
     
    object network waihuiju-des-add9
     
    host 197.0.244.9
     
    object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1
     
    host 100.1.64.1
     
    object network waihuiju-des-add10
     
    host 197.0.244.10
     
    object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2
     
    host 100.1.64.21
     
    object network waihuiju-des-add11
     
    host 197.0.244.11
     
    object network outside-inside-waiguanju-trans12
     
    host 100.1.1.1
     
    object network waihuiju-des-add12
     
    host 197.0.244.12
     
    object network outside-inside-waiguanju-jieshouhui-tongjixitong
     
    host 100.1.248.17
     
    object network waihuiju-des-add13
     
    host 197.0.244.13
     
    object network outside-inside-ITSxitongceshi
     
    host 100.1.95.4
     
    object network waihuiju-des-add14
     
    host 197.0.244.14
     
    object network outside-inside-waiguanju-trans91
     
    host 100.1.95.5
     
    object network waihuiju-des-add15
     
    host 197.0.244.15
     
    object network waihuiju-tran-add
     
    host 29.2.7.254
     
    object-group network waihuiju-des-add
     
    network-object object waihuiju-des-add3
     
    network-object object waihuiju-des-add4
     
    network-object object waihuiju-des-add5
     
    network-object object waihuiju-des-add6
     
    network-object object waihuiju-des-add7
     
    network-object object waihuiju-des-add8
     
    network-object object waihuiju-des-add9
     
    network-object object waihuiju-des-add10
     
    network-object object waihuiju-des-add11
     
    network-object object waihuiju-des-add12
     
    network-object object waihuiju-des-add13
     
    network-object object waihuiju-des-add14
     
    network-object object waihuiju-des-add15
     
    object-group network outside-inside-Map
     
    network-object object outside-inside-waiguanju-trans69
     
    network-object object outside-inside-waiguanju-shouzhi-shenbaoxitong
     
    network-object object outside-inside-waiguanju-trans63
     
    network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz
     
    network-object object outside-inside-waihuiju-aoyunyingji-fabuwangzhan
     
    network-object object outside-inside-waihuiju-geren-gouhui
     
    network-object object outside-inside-waihuiju-jieshouhui-ceshixitong
     
    network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1
     
    network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2
     
    network-object object outside-inside-waiguanju-trans12
     
    network-object object outside-inside-waiguanju-jieshouhui-tongjixitong
     
    network-object object outside-inside-ITSxitongceshi
     
    network-object object outside-inside-waiguanju-trans91
     
    nat (inside,outside) source dynamic any waihuiju-tran-add destination static waihuiju-des-add outside-inside-Map
    验证 :
     
    ciscoasa# show xlate
     
    7 in use, 17 most used
     
    Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
     
    NAT from outside:100.1.64.40, 100.1.95.1, 100.1.95.2,
     
       100.1.64.30, 100.1.248.40, 100.1.248.20,
     
       100.1.248.26, 100.1.64.1, 100.1.64.21,
     
       100.1.1.1, 100.1.248.17, 100.1.95.4,
     
       100.1.95.5 to inside:197.0.244.3, 197.0.244.4,
     
       197.0.244.5, 197.0.244.6, 197.0.244.7,
     
       197.0.244.8, 197.0.244.9, 197.0.244.10,
     
       197.0.244.11, 197.0.244.12, 197.0.244.13,
     
       197.0.244.14, 197.0.244.15
     
       flags sT idle 0:10:32 timeout 0:00:00
     
    TCP PAT from inside:192.168.1.2/29060 to outside:29.2.7.254/14832 flags ri idle 0:10:47 timeout 0:00:30
     
    TCP PAT from inside:192.168.1.2/20099 to outside:29.2.7.254/50442 flags ri idle 0:11:02 timeout 0:00:30
     
    TCP PAT from inside:192.168.1.2/32652 to outside:29.2.7.254/19035 flags ri idle 0:11:19 timeout 0:00:30
     
    TCP PAT from inside:192.168.1.2/64367 to outside:29.2.7.254/16920 flags ri idle 0:11:27 timeout 0:00:30
     
    TCP PAT from inside:192.168.1.2/46218 to outside:29.2.7.254/62293 flags ri idle 0:11:34 timeout 0:00:30
     
    TCP PAT from inside:192.168.1.2/33598 to outside:29.2.7.254/58119 flags ri idle 0:11:50 timeout 0:00:30
     
    ciscoasa# show conn
     
    6 in use, 8 most used
     
    TCP outside 197.0.244.6(100.1.64.30):23 inside 192.168.1.2:20099, idle 0:01:02, bytes 139, flags UFRIO
     
    TCP outside 197.0.244.6(100.1.64.30):23 inside 192.168.1.2:32652, idle 0:01:17, bytes 145, flags UFRIO
     
    TCP outside 197.0.244.8(100.1.248.20):23 inside 192.168.1.2:46218, idle 0:01:35, bytes 121, flags UFRIO
     
    TCP outside 197.0.244.10(100.1.64.1):23 inside 192.168.1.2:33598, idle 0:01:51, bytes 121, flags UFRIO
     
    TCP outside 197.0.244.3(100.1.64.40):23 inside 192.168.1.2:29060, idle 0:00:48, bytes 121, flags UFRIO
     
    TCP outside 197.0.244.7(100.1.248.40):23 inside 192.168.1.2:64367, idle 0:01:28, bytes 132, flags UFRIO
     
    ciscoasa# show nat detail
     
    ciscoasa# show nat detail
     
    Manual NAT Policies (Section 1)
     
    1 (inside) to (outside) source dynamic any waihuiju-tran-add destination static waihuiju-des-add outside-inside-Map
     
       translate_hits = 8, untranslate_hits = 8
     
       Source - Origin: 0.0.0.0/0, Translated: 29.2.7.254/32
     
       Destination - Origin: 197.0.244.3/32, 197.0.244.4/32, 197.0.244.5/32, 197.0.244.6/32
     
       197.0.244.7/32, 197.0.244.8/32, 197.0.244.9/32, 197.0.244.10/32
     
       197.0.244.11/32, 197.0.244.12/32, 197.0.244.13/32, 197.0.244.14/32
     
       197.0.244.15/32, Translated: 100.1.64.40/32, 100.1.95.1/32, 100.1.95.2/32, 100.1.64.30/32
     
       100.1.248.40/32, 100.1.248.20/32, 100.1.248.26/32, 100.1.64.1/32
     
       100.1.64.21/32, 100.1.1.1/32, 100.1.248.17/32, 100.1.95.4/32
     
       100.1.95.5/32
     
    场景七
    对通过防火墙的业务流量,不更改源地址,也就是将源地址NAT自己,我们称为identity NAT。

     
    object network inside-nonat
     
    host 192.168.1.2
     
    nat (inside,outside) static 192.168.1.2
     
    验证:
     
    ciscoasa(config)# show xlate     
     
    1 in use, 17 most used
     
    Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
     
    NAT from inside:192.168.1.2 to outside:192.168.1.2
     
       flags sI idle 0:02:09 timeout 0:00:00
     
    ciscoasa(config)# show conn
     
    1 in use, 8 most used
     
    TCP outside 100.1.64.1:23 inside 192.168.1.2:65450, idle 0:00:12, bytes 115, flags UIO
     
    ciscoasa(config)# show nat detail
     
    Auto NAT Policies (Section 2)
     
    1 (inside) to (outside) source static inside-nonat 192.168.1.2
     
       translate_hits = 3, untranslate_hits = 0
     
       Source - Origin: 192.168.1.2/32, Translated: 192.168.1.2/32
     
    Router# who
     
       Line      User      Host(s)             Idle      Location
     
    * 0 con 0               idle                00:00:00  
     
      6 vty 0               idle                00:00:07 192.168.1.2
     
    注意:
    Nat-control 不在使用
     
    如果要开启需要使用下面的语法:
     object network obj_any  subnet 0.0.0.0 0.0.0.0
      nat (inside,outside) dynamic obj-0.0.0.0
    object network obj-0.0.0.0
      host 0.0.0.0
    object network obj_any-01
      subnet 0.0.0.0 0.0.0.0
      nat (inside,mgmt) dynamic obj-0.0.0.0
    object network obj_any-02
      subnet 0.0.0.0 0.0.0.0
      nat (inside,dmz) dynamic obj-0.0.0.0
    object network obj_any-03
      subnet 0.0.0.0 0.0.0.0
      nat (mgmt,outside) dynamic obj-0.0.0.0
    object network obj_any-04
      subnet 0.0.0.0 0.0.0.0
      nat (dmz,outside) dynamic obj-0.0.0.0
    object network obj_any-05
      subnet 0.0.0.0 0.0.0.0
      nat (dmz,mgmt) dynamic obj-0.0.0.0
     
    ASA 8.3 后需要使用真实IP 作为ACL 条目.
    ASA 8.3 NAT need real ip address on access-list .Please refer to new migrate on ASA 8.3 NAT commands. For example:
     
    Old Configuration
    static (inside,outside) 172.23.57.1 10.50.50.50 netmask 255.255.255.255
     
    access-list 1 permit ip any host 172.23.57.1
    access-group 1 in interface outside
     
    Migrated Configuration
     
    access-list 1 permit ip any host 10.50.50.50
    access-group 1 in interface outside
    注意事项:
    更新ASA 8.3 NAT 新注意事项 如果做多公网IP 对 一个内网IP的时候SNAT 请大家打开inspect icmp. 切记
     
    常用排错命令:
    show run nat
    show run object-network
    show run object-group
    show nat detail
    show xlate
    show conn
    show nat pool
    debug nat 255


你可能感兴趣的:(思科ASA防火墙8.4版本NAT的配置方法(转自新浪 刀光剑影))