cisco版本8.4以上+基本上网+端口映射+SSH.docx.docx

基本上网+端口映射+SSHsh run: Saved:ASA Version 8.4(4)1 !hostname ciscoasaenable password 2KFQnbNIdI.2KYOU encrypted正常加密配置！enable密码passwd 2KFQnbNIdI.2KYOU encryptednames!interface Ethernet0/0 正常配置！ nameif outside security-level 0 ip address X.X.X.X !interface Ethernet0/1 正常配置！ nameif inside security-level 100 ip address !interface Ethernet0/2 shutdown no nameif no security-level no ip address!interface Ethernet0/3 shutdown no nameif no security-level no ip address!interface Management0/0 shutdown no nameif no security-level no ip address management-only!ftp mode passiveobject network inside-outside引入object，上网的地址段 subnet 上网子网，可以写 object network server端口映射的服务器地址 host 54不写掩码object network server-outside外网ip，多个公网ip一对一映射用 host X.X.X.Xobject network pc host object network server63888 服务器4个端口映射 host 54object network server5900 host 54object network server5901 host 54object network server11034 host 54access-list 110 extended permit ip any any 正常配置！access-list 110 extended permit icmp any any pager lines 24mtu outside 1500mtu inside 1500icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400!object network inside-outside NAT配置 nat (inside,outside) dynamic interface只有一个公网ip配置，nat (inside,outside) dynamic X.X.X.X 写特定公网ip，多个公网ip配置方法1多个公网ip配置方法2举例：对于有大量公网地址用户，常应用在运营商或者公司内网Object network outsideRange 0Object network insideSubnet Nat (inside,outside) static outsideobject network server 端口映射！4个端口 nat (inside,outside) static interface service tcp 5903 5903 object network server5900 nat (inside,outside) static interface service tcp 5900 5900 object network server5901 nat (inside,outside) static interface service tcp 5901 5901 object network server11034 nat (inside,outside) static interface service tcp 11034 11034 access-group 110 in interface outside正常配置！access-group 110 in interface insideroute outside Y.Y.Y.Y 1默认路由正常配置！timeout xlate 3:00:00timeout pat-xlate 0:00:30timeout conn 1:00:00 half-c