现状：

生产网3台服务器，发布4个网站，分别是

MES网站：192.168.1.249:8080

设备管理：192.168.1.249:8081

三维：192.168.1.250

SCADA：192.168.1.19


办公网(10.153.136.x;10.153.137.x......)访问映射：

MES：10.153.136.11:8080

设备管理：10.153.136.11:8081

三维：10.153.136.12

SCADA：10.153.136.23

掩码：255.255.255.192

网点：10.153.136.1


要求：

办公网10段可访问生产网内服务器，且仅可访问生产网服务器，生产网不可访问办公网


后来增加额外的端口映射要求：

办公网：10.153.136.23:2084生产内网：192.168.1.150：2084

10.153.136.23:2080192.168.1.150：2080

10.153.136.23:2085192.168.1.150：2080

10.153.136.23:2078192.168.1.150：2078

10.153.136.23:2082192.168.1.150：2082

办公网：10.153.136.23:3084生产内网：192.168.1.151：2084

10.153.136.23:3080192.168.1.151：2080

10.153.136.23:3085192.168.1.151：2080

10.153.136.23:3078192.168.1.151：2078

10.153.136.23:3082192.168.1.151：2082



CiscoASA5505配置：

conft


interfacevlan2
nameifoutside
securitylevel0
ipaddress10.153.136.21255.255.255.192


interfacevlan1
nameifinside
securitylevel100
ipaddress192.168.1.200255.255.255.0


interfaceethernet0/0
switchportaccessvlan2
noshutdown

interfaceethernet0/1
switchportaccessvlan1
noshutdown

static(inside,outside)10.153.136.11192.168.1.249netmask255.255.255.255
static(inside,outside)10.153.136.12192.168.1.250netmask255.255.255.255
static(inside,outside)tcp10.153.136.2380192.168.1.1980netmask255.255.255.255
static(inside,outside)tcp10.153.136.232084192.168.1.1502084netmask255.255.255.255
static(inside,outside)tcp10.153.136.232080192.168.1.1502080netmask255.255.255.255
static(inside,outside)tcp10.153.136.232085192.168.1.1502085netmask255.255.255.255
static(inside,outside)tcp10.153.136.232078192.168.1.1502078netmask255.255.255.255
static(inside,outside)tcp10.153.136.232082192.168.1.1502082netmask255.255.255.255
static(inside,outside)tcp10.153.136.233084192.168.1.1512084netmask255.255.255.255
static(inside,outside)tcp10.153.136.233080192.168.1.1512080netmask255.255.255.255
static(inside,outside)tcp10.153.136.233085192.168.1.1512085netmask255.255.255.255
static(inside,outside)tcp10.153.136.233078192.168.1.1512078netmask255.255.255.255
static(inside,outside)tcp10.153.136.233082192.168.1.1512082netmask255.255.255.255


access-list101extendedpermiticmpanyany
access-list101extendedpermittcpanyhost10.153.136.11eqwww
access-list101extendedpermittcpanyhost10.153.136.11eq8081
access-list101extendedpermittcpanyhost10.153.136.12eqwww
access-list101extendedpermittcpanyhost10.153.136.23eqwww
access-list101extendedpermittcpanyhost10.153.136.23eq2084
access-list101extendedpermittcpanyhost10.153.136.23eq2080
access-list101extendedpermittcpanyhost10.153.136.23eq2085
access-list101extendedpermittcpanyhost10.153.136.23eq2078
access-list101extendedpermittcpanyhost10.153.136.23eq2082
access-list101extendedpermittcpanyhost10.153.136.23eq3084
access-list101extendedpermittcpanyhost10.153.136.23eq3080
access-list101extendedpermittcpanyhost10.153.136.23eq3085
access-list101extendedpermittcpanyhost10.153.136.23eq3078
access-list101extendedpermittcpanyhost10.153.136.23eq3082


access-group101ininterfaceoutside
routeoutside10.153.0.0255.255.0.010.153.136.11


接线：

interfaceethernet0/0接办公网

interfaceethernet0/1接生产网



服务器设置：

网关设为192.168.1.200