防火墙系列---子接口下的配置

2019/6/25 - - -

此文章是关于配置防火墙的子接口配置初始化状态的一个实验

实验拓扑

实验环境

此前已有ASA相关配置的文章 —> 《ASA的配置》
关于防火墙初始化的文章—> 《初始化状态配置》

实验配置

因为之前有对此文章的介绍，这里直接上配置，可以修改完部分地址与接口后，直接刷进去。

路由与交换所做的优化配置

enable
configure terminal
line console 0
logging synchronous
exec-timeout 0 0
exit
no ip domain-lookup
line vty 0 4
no login
transport input all
exit

交换机的配置

vlan 2
name inside
exit
vlan 3
name DMZ
exit
vlan 6
name outside

exit
interface e0/0
switchport mode access
switchport access vlan 2
exit
interface e0/1
switchport mode access
switchport access vlan 3
exit
interface e0/2
switchport mode access
switchport access vlan 6
exit
interface e1/0
switchport mode access
switchport access vlan 6
exit
do show vlan

interface e0/3
switchport trunk allowed vlan 2,3,6
switchport mode trunk
switchport trunk encapsulation dot1q
exit
do show interface trunk

路由器的配置

inside 配置

hostname inside01
interface e0/0
ip add 192.168.20.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.20.1
do show ip int br
do show ip route

DMZ 配置

hostname DMZ01
interface e0/0
ip add 172.16.30.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 172.16.30.1
do show ip int br
do show ip route

outside 配置

hostname outside01
interface e0/0
ip add 200.6.6.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 200.6.6.1
do show ip int br
do show ip route

防火墙ASA上的配置

interface g0/1
nameif outside
security-level 0
ip add 200.6.6.1 255.255.255.0
no shutdown

exit
interface g0/0
no shutdown
exit

interface g0/0.2
vlan 2
nameif inside
ip add 192.168.20.1 255.255.255.0
no shutdown

exit
interface g0/0.3
vlan 3
nameif dmz
security-level 50
ip add 172.16.30.1 255.255.255.0
no shutdown
exit
exit
show nameif
show route

测试

inside：

telnet 200.6.6.100
telnet 172.16.30.100

DMZ：

telnet 200.6.6.100

可以远程到对方，说明成功

OK，有什么问题，欢迎评论交流O(∩_∩)O~