2
ESX091 1. ping 172.255.255.3 не проходит. Подразумевается что по умолчанию аса пингует через WAN. Задал жестко ping LAN 172.255.255.3 - пинг проходит! Не знаю, считается ли этап 1 таким образом - succeded..
Конфиг асы на site2 под #
[more]
!
ASA Version 8.2(1)
!
hostname <>
domain-name <>
names
!
interface Vlan1
nameif WAN
description WAN
security-level 0
ip address <prov_ip>
!
interface Vlan2
description LAN
nameif LAN
security-level 100
ip address 10.10.101.250 255.255.255.0
!
interface Vlan3
description DMZ
no nameif
security-level 50
no ip address
!
interface Ethernet0/0
description WAN
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
switchport access vlan 2
!
interface Ethernet0/3
switchport access vlan 2
!
interface Ethernet0/4
switchport access vlan 2
!
interface Ethernet0/5
switchport access vlan 2
!
interface Ethernet0/6
switchport access vlan 2
!
interface Ethernet0/7
switchport access vlan 2
!
banner login **** Unauthorised Access is Strictly Forbidden ****
banner login ******* To logon enter appropriate password ******
banner login *********** ALL LOGIN ATTEMPS ARE LOGGED **********
boot system disk0:/asa821-k8.bin
boot config disk0:/runconf.cfg
clock timezone MSK/MSD 3
clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup LAN
dns domain-lookup WAN
dns server-group DefaultDNS
name-server 172.255.255.3
name-server <prov_ip>
domain-name <>
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list NONAT extended permit ip 10.10.101.0 255.255.255.0 172.255.255.0 255.255.255.0
access-list TUNN_O extended permit ip 10.10.101.0 255.255.255.0 172.255.255.0 255.255.255.0
access-list WAN_IN extended permit icmp any any
mtu WAN 1500
mtu LAN 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo WAN
icmp permit any echo-reply WAN
icmp permit any echo LAN
icmp permit any echo-reply LAN
asdm image disk0:/asdm-621.bin
nat-control
global (WAN) 1 interface
nat (LAN) 0 access-list NONAT
nat (LAN) 1 10.10.101.0 255.255.255.0
access-group WAN_IN in interface WAN
route WAN 0.0.0.0 0.0.0.0 <ip_prov> 1
dynamic-access-policy-record DfltAccessPolicy
aaa-server [] protocol nt
aaa-server [] (LAN) host 172.255.255.2
nt-auth-domain-controller 172.255.255.2
aaa-server [] (LAN) host 172.255.255.3
nt-auth-domain-controller 172.255.255.3
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 LAN
http 0.0.0.0 0.0.0.0 WAN
crypto ipsec transform-set VPN-TF-SET esp-3des esp-sha-hmac
crypto map DEF_CMAP 10 match address TUNN_O
crypto map DEF_CMAP 10 set pfs
crypto map DEF_CMAP 10 set peer <peer_ip>
crypto map DEF_CMAP 10 set transform-set VPN-TF-SET
crypto map DEF_CMAP 10 set reverse-route
crypto map DEF_CMAP interface WAN
crypto isakmp identity address
crypto isakmp enable WAN
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 5
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
client-update enable
telnet 0.0.0.0 0.0.0.0 LAN
telnet timeout 30
ssh 0.0.0.0 0.0.0.0 WAN
ssh 0.0.0.0 0.0.0.0 LAN
ssh timeout 30
console timeout 0
management-access LAN
dhcpd lease 1048575
dhcpd domain <>
dhcpd update dns
!
dhcpd address 10.10.101.10-10.10.101.100 LAN
dhcpd dns 172.255.255.3 <prov_ip> interface LAN
dhcpd enable LAN
!
threat-detection basic-threat
threat-detection statistics
ntp server 192.43.244.18 source WAN prefer
tunnel-group <> type ipsec-l2l
tunnel-group <> ipsec-attributes
!
class-map inspection_default
match default-inspection-traffic
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect pptp
!
service-policy global_policy global
prompt hostname context
### END OF MAIN CONFIG ###
### START OPTIONAL CONFIG ###
#START Configuring Additional Options#
sysopt connection reclassify-vpn
priority-queue WAN
tx-ring-limit 256
#END Configuring Additional Options#
#START Configuring QoS Traffic Priority (for branch office with traffic shaping to 3Mb/s in/out + 500Kb burst rate)#
access-list ALL_TRAFFIC extended permit ip any any
class-map VoIP
match dscp ef
class-map DATA
match access-list ALL_TRAFFIC
!
policy-map VoIP_POLICY
class VoIP
priority
class DATA
police output 3000000 500000
police input 3000000 500000
!
service-policy VoIP_POLICY interface WAN
#END Configuration QoS Traffic Priority#
#START Configuring DOMAIN&FILES&AUDIO Blocking#
regex DOMAINBLOCK1 "\.vkontakte\.ru"
regex DOMAINBLOCK2 "\.mamba\.ru"
regex DOMAINBLOCK3 "\.icq\.com"
regex DOMAINBLOCK4 "\.aol\.com"
regex DOMAINBLOCK5 "\.odnoklassniki\.ru"
regex DOMAINBLOCK6 "\.rapidshare\.de"
regex DOMAINBLOCK7 "\.rapidshare\.com"
regex DOMAINBLOCK8 "\.youtube\.ru"
regex DOMAINBLOCK9 "\.youtube\.com"
regex FILEBLOCK1 ".*\.([Mm][Pp][3]|[Aa][Vv][Ii]|[Mm][Pp][Gg])"
regex FILEBLOCK2 ".*\.([Ee][Xx][Ee]|[Cc][Oo][Mm]|[Bb][Aa][Tt])"
regex AUDIO-MPEG "audio/.*"
regex VIDEO-MPEG "video/.*"
class-map type regex match-any DOMAINBLOCKLIST
match regex DOMAINBLOCK1
match regex DOMAINBLOCK2
match regex DOMAINBLOCK3
match regex DOMAINBLOCK4
match regex DOMAINBLOCK5
match regex DOMAINBLOCK6
match regex DOMAINBLOCK7
match regex DOMAINBLOCK8
match regex DOMAINBLOCK9
class-map type inspect http match-all DOMAINBLOCKCLASS
match request header host regex class DOMAINBLOCKLIST
class-map type regex match-any FILEBLOCKLIST
match regex FILEBLOCK1
match regex FILEBLOCK2
class-map type inspect http match-all FILEBLOCKCLASS
match request uri regex class FILEBLOCKLIST
class-map HTTP_TRAFFIC
match port tcp eq www
!
policy-map type inspect http HTTP_INSPECT_POLICY
parameters
protocol-violation action drop-connection log
match request method connect
drop-connection log
match request header user-agent regex _default_windows-media-player-tunnel
drop-connection log
match response header content-type regex AUDIO-MPEG
drop-connection log
match response header content-type regex VIDEO-MPEG
drop-connection log
class DOMAINBLOCKCLASS
drop-connection log
class FILEBLOCKCLASS
drop-connection log
!
policy-map LAN-policy
class HTTP_TRAFFIC
inspect http HTTP_INSPECT_POLICY
!
service-policy LAN-policy interface LAN
#END Configuration DOMAIN&FILES Blocking#
#START Allow only specified ports#
object-group service ALLOW_TCP tcp
port-object eq daytime
port-object eq domain
port-object eq echo
port-object eq hostname
port-object eq http
port-object eq https
port-object eq ident
port-object eq pptp
port-object eq ssh
port-object eq telnet
port-object eq whois
port-object eq 3389
object-group service ALLOW_UDP udp
port-object eq dnsix
port-object eq domain
port-object eq echo
port-object eq http
port-object eq isakmp
port-object eq nameserver
port-object eq ntp
port-object eq secureid-udp
port-object eq time
port-object eq 3389
access-list LAN_IN extended permit icmp any any
access-list LAN_IN extended permit tcp any any object-group ALLOW_TCP
access-list LAN_IN extended permit udp any any object-group ALLOW_UDP
access-list LAN_IN extended permit ip any 172.255.255.0 255.255.255.0
access-group LAN_IN in interface LAN
#END Allow only specified ports#
#START Deny Internet#
object-group network INET_deny
network-object host 10.10.101.xx
access-list LAN_IN line 1 extended deny ip object-group INET_deny any
access-list LAN_IN line 1 extended deny tcp object-group INET_deny any
#END Deny Internet#
### END OPTIONAL CONFIG ###
: end
[/more]
