首页 > 资讯 > 疑难 > 正文

内网不能通过公网IP访问经ASA5510映射后的服务器完美解决方案

13-07-25 来源：[db:作者]

收藏我要投稿

1、网络概况：

CISCO ASA5510

内网IP：192.168.3.100 255.255.255.0

外网IP：192.168.0.1 255.255.255.0

放在内网(和网内所有PC同处inside)的WEB 服务器：192.168.3.240 255.255.255.0

问题：做正常端口映射后，内网PC用内网IP能正常访问WEB服务器，出差外地的也可以通过公网IP来访问WEB服务器，但在内网的PC不能通过WEB服务器经映射后的公网IP来访问，经过几天的奋战，终于解决问题！

2、配置如下：

ciscoasa# sh run

: Saved

ASA Version 8.0(2)

hostname ciscoasa

enable password 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

nameif inside

security-level 100

ip address 192.168.3.100 255.255.255.0

interface Ethernet0/1

nameif outside

security-level 0

ip address 192.168.0.1 255.255.255.0

interface Ethernet0/2

nameif DMZ

security-level 50

ip address 192.168.9.100 255.255.248.0

interface Ethernet0/3

nameif MK

security-level 50

no ip address

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list 110 extended permit tcp any host 192.168.0.1 eq www

access-list 110 extended permit udp any host 192.168.0.1 eq www

pager lines 24

logging asdm informational

mtu management 1500

mtu inside 1500

mtu DMZ 1500

mtu MK 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-602.bin

asdm history enable

arp timeout 14400

global (inside) 1 interface

global (outside) 101 interface

nat (inside) 101 0.0.0.0 0.0.0.0 dns

alias (inside) 192.168.3.240 192.168.0.1 255.255.255.255

static (inside,outside) tcp interface www 192.168.3.240 www netmask 255.255.255.

255 dns

static (inside,inside) 192.168.0.1 192.168.3.240 netmask 255.255.255.255

access-group 110 in interface outside

route outside 0.0.0.0 0.0.0.0 192.168.0.228 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.0.0 255.255.255.0 outside

http 192.168.3.0 255.255.255.0 inside

http 192.168.1.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

no crypto isakmp nat-traversal

telnet 192.168.3.0 255.255.255.0 inside

telnet 192.168.0.0 255.255.255.0 outside

telnet timeout 5

ssh 192.168.3.0 255.255.255.0 inside

ssh 192.168.0.0 255.255.255.0 outside

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

threat-detection basic-threat

threat-detection statistics access-list

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

prompt hostname context

Cryptochecksum:c34c04c1c2baec36aff1adccb8ec9b9d

: end

ciscoasa#

点击复制链接与好友分享!回本站首页