关于防火墙Cisco ASA5520 的一些配置

-----------如何装ASDM WEB HTTPS服务---------------------

asdm image disk0:/asdm-6475.bin
asdm history enable
http 0 0 outside
http 0 0 inside（内网只需这个）
http server enbale 

另外，必须IE8一下浏览器，必须Java装1.4.2版本，太新的没用，到100%就不会动了

-------------------------------------------------ACL规则语句---------------------------------

ASA防火墙要开放80 8080 8088等7个端口，然后有6台服务器开放
这样子是不是每个服务器地址都要做映射

配置是不是应该这样做

static (inside,outside)172.16.2.110 xxx.xxx.xxx.xxx netmask 255.255.255.255
static (inside,outside)172.16.2.130 xxx.xxx.xxx.xxx netmask 255.255.255.255
static (inside,outside)172.16.2.140 xxx.xxx.xxx.xxx netmask 255.255.255.255
static (inside,outside)172.16.2.150 xxx.xxx.xxx.xxx netmask 255.255.255.255
static (inside,outside)172.16.2.211 xxx.xxx.xxx.xxx netmask 255.255.255.255
static (inside,outside)172.16.2.221 xxx.xxx.xxx.xxx netmask 255.255.255.255

access-list 101 extended permit tcp any host 172.16.2.110 eq 80
access-list 101 extended permit tcp any host 172.16.2.110 eq 8080
access-list 101 extended permit tcp any host 172.16.2.110 eq 8088
access-list 101 extended permit tcp any host 172.16.2.110 eq 4050
access-list 101 extended permit tcp any host 172.16.2.110 eq 5050
access-list 101 extended permit tcp any host 172.16.2.110 eq 554
access-list 101 extended permit tcp any host 172.16.2.110 eq 7554

access-list 102 extended permit tcp any host 172.16.2.130 eq 80
access-list 102 extended permit tcp any host 172.16.2.130 eq 8080
access-list 102 extended permit tcp any host 172.16.2.130 eq 8088
access-list 102 extended permit tcp any host 172.16.2.130 eq 4050
access-list 102 extended permit tcp any host 172.16.2.130 eq 5050
access-list 102 extended permit tcp any host 172.16.2.130 eq 554
access-list 102 extended permit tcp any host 172.16.2.130 eq 7554

access-list 103 extended permit tcp any host 172.16.2.140 eq 80
access-list 103 extended permit tcp any host 172.16.2.140 eq 8080
access-list 103 extended permit tcp any host 172.16.2.140 eq 8088
access-list 103 extended permit tcp any host 172.16.2.140 eq 4050
access-list 103 extended permit tcp any host 172.16.2.140 eq 5050
access-list 103 extended permit tcp any host 172.16.2.140 eq 554
access-list 103 extended permit tcp any host 172.16.2.140 eq 7554

access-list 104 extended permit tcp any host 172.16.2.150 eq 80
access-list 104 extended permit tcp any host 172.16.2.150 eq 8080
access-list 104 extended permit tcp any host 172.16.2.150 eq 8088
access-list 104 extended permit tcp any host 172.16.2.150 eq 4050
access-list 104 extended permit tcp any host 172.16.2.150 eq 5050
access-list 104 extended permit tcp any host 172.16.2.150 eq 554
access-list 104 extended permit tcp any host 172.16.2.150 eq 7554

access-list 105 extended permit tcp any host 172.16.2.211 eq 80
access-list 105 extended permit tcp any host 172.16.2.211 eq 8080
access-list 105 extended permit tcp any host 172.16.2.211 eq 8088
access-list 105 extended permit tcp any host 172.16.2.211 eq 4050
access-list 105 extended permit tcp any host 172.16.2.211 eq 5050
access-list 105 extended permit tcp any host 172.16.2.211 eq 554
access-list 105 extended permit tcp any host 172.16.2.211 eq 7554

access-list 106 extended permit tcp any host 172.16.2.221 eq 80
access-list 106 extended permit tcp any host 172.16.2.221 eq 8080
access-list 106 extended permit tcp any host 172.16.2.221 eq 8088
access-list 106 extended permit tcp any host 172.16.2.221 eq 4050
access-list 106 extended permit tcp any host 172.16.2.221 eq 5050
access-list 106 extended permit tcp any host 172.16.2.221 eq 554
access-list 106 extended permit tcp any host 172.16.2.221 eq 7554


int f0/0
access-group 101 in interface outside
access-group 102 in interface outside
access-group 103 in interface outside
access-group 104 in interface outside
access-group 105 in interface outside
access-group 106 in interface outside