ASA防火墙配置命令-王军.doc

ASA防火墙配置命令（v1.0）作者王军审核分类网络子类防火墙时间2020年3月16日版本说明版本日期内容编写人V1.02010-3-14创建文档王军目 录1. 常用技巧32. 故障倒换33. 配置telnet、ssh及http管理54. vpn常用管理命令55. 配置访问权限66. 配置sitetosite之VPN67. webvpn配置（ssl vpn）78. 远程拨入VPN89. 日志服务器配置1010. Snmp网管配置1111. ACS配置1112. AAA配置1113. 升级IOS1214. 疑难杂症121. 常用技巧Sh ru ntp查看与ntp有关的Sh ru crypto 查看与vpn有关的Sh ru | inc crypto 只是关健字过滤而已2. 故障倒换failoverfailover lan unit primaryfailover lan interface testint Ethernet0/3failover link testint Ethernet0/3failover mac address Ethernet0/1 0018.1900.5000 0018.1900.5001failover mac address Ethernet0/0 0018.1900.4000 0018.1900.4001failover mac address Ethernet0/2 0018.1900.6000 0018.1900.6001failover mac address Management0/0 0018.1900.7000 0018.1900.7001failover interface ip testint 10.3.3.1 255.255.255.0 standby 10.3.3.2注：最好配置虚拟MAC地址sh failover显示配置信息write standby写入到备用的防火墙中failover命令集如下：configure mode commands/options: interface Configure the IP address and mask to be used for failover and/or stateful update information interface-policy Set the policy for failover due to interface failures key Configure the failover shared secret or key lan Specify the unit as primary or secondary or configure the interface and vlan to be used for failover communication link Configure the interface and vlan to be used as a link for stateful update information mac Specify the virtual mac address for a physical interface polltime Configure failover poll interval replication Enable HTTP (port 80) connection replication timeout Specify the failover reconnect timeout value for asymmetrically routed sessionssh failover 命令集如下： history Show failover switching history interface Show failover command interface information state Show failover internal state information statistics Show failover command interface statistics information | Output modifiers 3. 配置telnet、ssh及http管理username jiang password Csmep3VzvPQPCbkx encrypted privilege 15aaa authentication enable console LOCALaaa authentication telnet console LOCALaaa authentication ssh console LOCALaaa authorization command LOCAL http 192.168.40.0 255.255.255.0 management ssh 192.168.40.0 255.255.255.0 inside4. vpn常用管理命令sh vpn-sessiondb full l2l 显示site to site 之vpn通道情况sh ipsec stats 显示ipsec通道情况sh vpn-sessiondb summary 显示vpn汇总信息sh vpn-sessiondb detail l2l 显示ipsec详细信息sh vpn-sessiondb detail svc 查看ssl client信息sh vpn-sessiondb detail webvpn 查看webvpn信息sh vpn-sessiondb detail full l2l 相当于linux下的ipsec whack status 如果没有建立连接，则表示ipsec通道还没有建立起来。5. 配置访问权限可以建立对象组，设定不同的权限，如： object-group network testgroup description test network-object 192.168.100.34 255.255.255.255 access-list inside_access_in line 2 extended permit ip object-group all any access-group inside_access_in in interface inside6. 配置sitetosite之VPNcrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmaccrypto map outside_map 20 match address outside_cryptomap_20_1crypto map outside_map 20 set pfscrypto map outside_map 20 set peer 218.16.105.48crypto map outside_map 20 set transform-set ESP-3DES-SHAcrypto map outside_map interface outsideisakmp identity addressisakmp enable outsideisakmp policy 10 authentication pre-shareisakmp policy 10 encryption 3desisakmp policy 10 hash shaisakmp policy 10 group 2isakmp policy 10 lifetime 86400tunnel-group 218.16.105.48 type ipsec-l2ltunnel-group 218.16.105.48 ipsec-attributespre-shared-key *peer-id-validate nochecktunnel-group-map enable rules注：打打PFS并设定以IP地址作为peer名，一个接口只能有一个加密图7. webvpn配置（ssl vpn）webvpnenable outsidecharacter-encoding gb2312csd image disk0:/securedesktop-asa-3.1.1.16.pkgsvc image disk0:/sslclient-win-1.1.0.154.pkg 1svc enablecustomization customization1 title text TEST WebVPN system title style background-color:white;color: rgb(51,153,0);border-bottom:5px groove #669999;font-size:larger;vertical-align:middle;text-align:left;font-weight:boldtunnel-group-list enable注：也可通过ASDM图形界面进行配置登录后，可访问内部资源，如下例：（客户端首先要安装Java插件jre-1_5_0-windows-i586.exe,并打开浏览器的ActiveX）1) https:/sslvpn.test.com.cn 输入用户名和密码2) 出现工具条3) 在Enter Web Address内输入192.168.40.8即可访问内部网站4）在browse network输入192.168.40.8即可访问共享文件5)点击application access，即可查看端口转发设置，如使用putty访问本机的2023端口，则即可通过ssh登录192.168.40.88. 远程拨入VPN相关的ASA配置命令如下：access-list inside_access_in extended permit ip object-group remotegroup anyaccess-list inside_access_in extended permit icmp object-group remotegroup anyaccess-list remotevpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0access-list vpnclient_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0ip local pool dialuserIP 192.168.101.1-192.168.101.254 mask 255.255.255.0group-policy remotevpn attributesdns-server value 202.96.128.68 192.168.40.16default-domain value test.com.cnusername jiang password Csmep3VzvPQPCbkx encrypted privilege 15crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmaccrypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmaccrypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmaccrypto dynamic-map outside_dyn_map 20 set pfscrypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHAcrypto dynamic-map outside_dyn_map 20 set reverse-routecrypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_mapcrypto map outside_map interface outsidetunnel-group remotevpn type ipsec-ratunnel-group remotevpn general-attributesaddress-pool dialuserIPdefault-group-policy remotevpntunnel-group remotevpn ipsec-attributespre-shared-key *客户端设置如下：9. 日志服务器配置logging enablelogging timestamplogging emblemlogging trap informationallogging asdm warningslogging host inside 192.168.40.115 format emblemlogging permit-hostdownvpn-simultaneous-logins 310. Snmp网管配置snmp-server host inside 192.168.40.47 community testsnmpsnmp-server location DG-GTESTsnmp-server contact jiangdaoyou:6162snmp-server community testsnmpsnmp-server enable traps snmp authentication linkup linkdown coldstart注：指定主机后，192.168.40.47才可能进行管理11. ACS配置 安装后管理：http:/ip:2002 通过ACS可以进行授权、认证等等很多功能 因内容太多，暂省略12. AAA配置Aaa服务器配置：aaa-server radius_dg host dc03.xxxx.comkey dfdfdfdf146*Uauthentication-port 1812accounting-port 1813radius-common-pw dfdfdfdf146*U对于拨入vpn的配置tunnel-group vg_testerp general-attributesaddress-pool ciscovpnuserauthentication-server-group radius_dgdefault-group-policy vg_testerp13. 升级IOScopy tftp:/192.168.40.180/asa/asa721-k8.bin disk0:/asa721-k8.bin boot system disk0:/asa721-k8.bin （多个Image时使用）14. 疑难杂症1) 在远程子网不能ping通过对方的网关，如在无锡格兰不能ping 192.168.40.251输入命令：management-access inside （通过ASDM不能设置这一项）2) NAT有时不能快速启作用使用命令：clear xlate即可