ASA8.3(包含8.3)以后和ASA8.3以前NAT和ACL执行顺序
实验目的:
验证ASA8.3(包含8.3)以后和ASA8.3以前NAT和ACL执行顺序。
拓扑:
一 8.3以前
配置:
access-list acl-outside extended permit tcp any host 202.1.1.10 eq telnet
access-list acl-outside extended permit icmp any any
nat-control
static (inside,outside) 202.1.1.10 192.168.1.1 netmask 255.255.255.255
access-group acl-outside in interface outside
使用的是转化以后的IP(202.1.1.10)
验证:
二 8.3以后
配置
access-list acl-outside extended permit tcp any host 192.168.1.1 eq telnet
access-list acl-outside extended permit icmp any any
object network Static-Outside-Address
host 202.1.1.10
object network Static-Inside-Address
host 192.168.1.1
object network Static-Inside-Address
nat (Inside,Outside) static Static-Outside-Address
access-group acl-outside in interface outside
验证
结论:
ASA8.3(包含8.3)以后是NAT后ACL和ASA8.3以前是先ACL后NAT。
本文出自 “网络工程师” 博客,请务必保留此出处http://692344.blog.51cto.com/682344/1177843
转载于:https://blog.51cto.com/ljl2013/1346568