試驗6ASA虛擬防火墻的配置

1、國家高等職業(yè)教育網(wǎng)絡技術專業(yè)教學資源庫PIX防火墻PIX防火墻安全典型案例 實驗六 ASA虛擬防火墻的配置實驗六 ASA虛擬防火墻的配置一、 實驗目的通過該實驗掌握ASA虛擬防火墻的配置。二、 實驗任務l 配置ASA虛擬防火墻l 驗證實驗結果三、 實驗設備ASA5505防火墻兩臺，CISCO 2950交換機兩臺，控制線一根，網(wǎng)絡連接線若干，PC機若干，Sniffer軟件一套四、 實驗拓撲圖及內容R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#int f0/0R1(config-if)

2、#no shutR1(config-if)#exitR1(config)#R2>enR2#conf tEnter configuration commands, one per line. End with CNTL/Z.R2(config)#int f0/0R2(config-if)#no shutR2(config-if)#exitR2(config)#*Mar 1 00:00:38.971: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:00:39.971: %LINEPROTO-5-

3、UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up*Mar 1 00:04:33.155: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Mar 1 00:04:34.155: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR3>enR3#conf tEnter configuration comm

4、ands, one per line. End with CNTL/Z.R3(config)#int f0/0R3(config-if)#no shutR3(config-if)#endR3#*Mar 1 00:00:46.747: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to upR3#*Mar 1 00:00:46.907: %SYS-5-CONFIG_I: Configured from console by console*Mar 1 00:00:47.747: %LINEPROTO-5-UPDOWN: Line

5、 protocol on Interface FastEthernet0/0, changed state to upR3#pixfirewall# conf tpixfirewall(config)# hostname pixpix(config)# int e 0pix(config-if)# no shutpix(config-if)# int e1pix(config-if)# no shutpix(config-subif)# vlan 2pix(config-subif)# vlan 3pix(config-subif)# exitpix(config)# int e 1pix(c

6、onfig-if)# admin-context adminpix(config)# context adminpix(config-ctx)# allopix(config-ctx)# allocate-interface e1.2 inte1pix(config-ctx)# allocate-interface e0 inte0pix(config-ctx)# config-url flash:/?context mode commands/options:pix(config-ctx)# config-url flash:/adpix(config-ctx)# context depar

7、tmentCreating context 'department'. Done. (2)pix(config-ctx)# allocate-interface e1.3 inte1pix(config-ctx)# allocate-interface e0 inte0pix(config-ctx)# changeto context adminpix/admin(config)# intpix/admin(config)# interface inte1pix/admin(config-if)# nameif insideINFO: Security level for &q

8、uot;inside" set to 100 by default.pix/admin(config-if)# no shutpix/admin(config-if)# intpix/admin(config-if)# interface inte0pix/admin(config-if)# nameif outsideINFO: Security level for "outside" set to 0 by default.pix/admin(config-if)# ip add 192.168.1.1pix/admin(config-if)# no shut

9、pix/admin(config-if)# accpix/admin(config-if)# access-list outside permit icmp any any echo-repix/admin(config-if)# access-list outside permit icmp any any echo-replypix/admin(config)# access-list outside permit tcp any any eq telnetpix/admin(config)#pix/admin(config)# accesspix/admin(config)# acces

10、s-gpix/admin(config)# access-group outside in int outsidepix(config)# changeto context adminpix/admin(config)# access-list outside permit tap any any eq telnet ERROR: % Invalid Hostnamepix/admin(config)# access-list outside permit tcp any any eq telnetpix/admin(config)# access-gropix/admin(config)#

11、access-group outside in int outsidepix/admin(config)#pix/admin(config)# changeto context departmentpix/department(config)# int inte1pix/department(config-if)# nameif insideINFO: Security level for "inside" set to 100 by default.pix/department(config-if)# no shutpix/department(config-if)# i

12、nt inte0pix/department(config-if)# nameif outsideINFO: Security level for "outside" set to 0 by default.pix/department(config-if)# ip add 192.168.1.1pix/department(config-if)# no shutpix/department(config-if)# access-list outside permit icmp any any echo-replypix/department(config)# access-list outside permit tcp any any epix/department(config)# access-list outside permit tcp any any eq telnetpix/department(config)#