asa防火墙启用nat控制与豁免

RI:配ip指路

 

 

 

R2:配ip指路

R3: 配ip指路：R3(config)#int f0/0

R3(config-if)#ip add 10.1.1.2 255.0.0.0

R3(config-if)#no sh

R3(config-if)#exit

R3(config)#int f1/0

R3(config-if)#ip add 20.1.1.2 255.0.0.0

R3(config-if)#no sh

R3(config-if)#int f2/0

R3(config-if)#ip add 30.1.1.1 255.0.0.0

R3(config-if)#no sh

ip route 0.0.0.0 0.0.0.0 30.1.1.2

Asa：ciscoasa> en

Password:

ciscoasa# conf t

ciscoasa(config)# int e0/0

ciscoasa(config-if)# ip add 30.1.1.2 255.0.0.0

ciscoasa(config-if)# no sh

ciscoasa(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ciscoasa(config-if)# exit

ciscoasa(config)# int e0/1

ciscoasa(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

ciscoasa(config-if)# ip add 40.1.1.1 255.0.0.0

ciscoasa(config-if)# no sh

ciscoasa(config-if)# exit

ciscoasa(config)# route inside 0.0.0.0 0.0.0.0 30.1.1.1

ciscoasa(config)# nat (inside) 1 10.0.0.0 255.0.0.0

ciscoasa(config)# global (outside) 1 interface

INFO: outside interface address added to PAT pool

R4：R4(config)#int f0/0

R4(config-if)#ip add 40.1.1.2 255.0.0.0

R4(config-if)#no sh

R4(config)#line vty 0 4

R4(config-line)#pas

R4(config-line)#password 123

R4(config-line)#login

R4(config-line)#exit

R4(config)#ip default-gateway 40.1.1.1

Asa：（nat控制和豁免）： ciscoasa(config)# nat-control

ciscoasa(config)# ACCess-LISt 100 Permit IP 40.0.0.0 255.0.0.0.0 20.0.0.0 255.0.0.0

ciscoasa(config)# nat (inside) 0 access-list 100

ciscoasa(config)# ACCess-LISt 100 Permit IP 40.0.0.0 255.0.0.0 20.0.0.0 255.0.0.0

ciscoasa(config)# ACCess-Group 100 IN INT OUtside