ASA单臂路由，同安全等级子接口跨VLAN互通

需求

• 交换机划分为包含R2的ins-vlan2和包含R3的dmz-vlan3
• 交换机只连一根线到asa的端口。
• 启用asa端口的两个子接口作为不同的vlan，并使其具有相同的安全等级，可以互相访问，即R2能和R3互通。

配置命令

交换机

此交换机为GNS3 VM IOU服务器的i86bi-linux-l2-adventerprisek9-15.1a.bin镜像，具体搭建方法请见
[GNS3 1.3疑难杂症]搭建交换机

config t
vlan 2 
    ex
vlan 3
    ex
#asa端的TRUNK
int e0/0
    #此句设置封装类型为dot1q必须加，给数据帧打上VLAN标签，GNS3交换机默认不是dot1q
    switchport trunk encapsulation dot1q 
    #若不加上句，则可能提示“Auto”，不能设置端口模式trunk
    switchport mode trunk
    ex
#路由器R2
int e0/1
    switchport access vlan 2
    exit
#路由器R3
int e0/2
    switchport access vlan 3
    exit
exit
show vlan

ASA 8.4

ena

config t
int g2
    nameif inside-dmz
    no security-level
    no ip address
    no shut
    exit
int g2.2
    vlan 2
    nameif ins
    no shut
    security-level 100
    ip address 10.25.25.5 255.255.255.0
    exit
int g2.3
    vlan 3
    nameif dmz
    no shut
    security-level 100
    ip address 10.35.35.5 255.255.255.0
    exit
#设置访问列表，允许全通过，为了测试方便
access-list acl_Test1 extended permit ip any any     
access-list acl_Test2 extended permit ip any any 
#对进入接口的流量应用规则
access-group acl_Test1 in interface ins   
access-group acl_Test2 in interface dmz
#去环回地址的静态路由 格式：从端口side 要去A/mask 得过对端B
route ins 10.2.2.0 255.255.255.0 10.25.25.2 
route dmz 10.3.3.0 255.255.255.0 10.35.35.3 
#同安全级别的子接口互相访问
same-security-traffic permit inter-interface
ex
show route

Vlan2-R2

config t
int lo 0
    ip add 10.2.2.2 255.255.255.0
    no shut
    exit
int f0/0
    ip add 10.25.25.2 255.255.255.0
    no shut
    exit
ip route 10.3.3.0 255.255.255.0 10.25.25.5
ip route 10.35.35.0 255.255.255.0 10.25.25.5
do show ip route

Vlan3-R3

config t
int lo 0
    ip add 10.3.3.3 255.255.255.0
    no shut
    exit
int f0/0
    ip add 10.35.35.3 255.255.255.0
    no shut
    exit
ip route 10.2.2.0 255.255.255.0 10.35.35.5
ip route 10.25.25.0 255.255.255.0 10.35.35.5
do show ip route

测试结果

R2能ping通R3，即vlan2与vlan3能互相访问