ASA防火墙配置笔记.docVIP

ASA防火墙配置笔记 二〇〇六年十月二十七日 序言： Cisco新的防火墙ASA系列已经面市了，将逐步取代PIX防火墙，网上关于ASA配置资料很少，现把我积累的ASA配置技术编写一个文档，供大家参考。如有问题，可发邮件给我。 1. 常用技巧 1 2. 故障倒换 1 3. 配置telnet、ssh及http管理 3 4. vpn常用管理命令 3 5. 配置访问权限 3 6. 配置sitetosite之VPN 4 7. webvpn配置（ssl vpn） 4 8. 远程拨入VPN 5 9. 日志服务器配置 6 10. Snmp网管配置 7 11. ACS配置 7 12. AAA配置 7 13. 升级IOS 8 14. 疑难杂症 8 ? 1.?????? 常用技巧 ? Sh ru ntp查看与ntp有关的 Sh ru crypto 查看与vpn有关的 Sh ru | inc crypto 只是关健字过滤而已 ? 2.?????? 故障倒换 failover failover lan unit primary failover lan interface testint Ethernet0/3 failover link testint Ethernet0/3 failover mac address Ethernet0/1 0018.1900.5000 0018.1900.5001 failover mac address Ethernet0/0 0018.1900.4000 0018.1900.4001 failover mac address Ethernet0/2 0018.1900.6000 0018.1900.6001 failover mac address Management0/0 0018.1900.7000 0018.1900.7001 failover interface ip testint standby 注：最好配置虚拟MAC地址 sh failover显示配置信息 write standby写入到备用的防火墙中 ? failover命令集如下： configure mode commands/options: interface Configure the IP address and mask to be used for failover and/or stateful update information interface-policy Set the policy for failover due to interface failures key Configure the failover shared secret or key lan Specify the unit as primary or secondary or configure the interface and vlan to be used for failover communication link Configure the interface and vlan to be used as a link for stateful update information mac Specify the virtual mac address for a physical interface polltime Configure failover poll interval replication Enable HTTP (port 80) connection replication timeout Specify the failover reconnect timeout value for asymmetrically routed sessions ? sh failover 命令集如下： ? history Show failover switching history interface Show failover command interface information state Show failover internal state information statistics