CISCO5520配置手册2完整版.doc

CD-ASA5520#showrun

:Saved

:

ASAVersion7.2(2)

!

hostnameCD-ASA5520????????????????????????????//定义工作域??

enablepassword9jNfZuG3TC5tCVH0encrypted??//进入特权模式的密码

names

dns-guard

!

interfaceGigabitEthernet0/0????????//内网接口：

duplexfull????????????????????//接口作工模式：全双工，半双，自适应??????

nameifinside????????????????//为端口命名：内部接口inside

security-level100??????????????????//设置本端口的IP地址

!

interfaceGigabitEthernet0/1????????//外网接口

nameifoutside????????????????//为外部端口命名：外部接口outside

security-level0

ipaddress22//IP地址配置

!

interfaceGigabitEthernet0/2

nameifdmz

security-level50

ipaddress

!????????

interfaceGigabitEthernet0/3

shutdown

nonameif

nosecurity-level

noipaddress

!

interfaceManagement0/0??????????//防火墙管理地址

shutdown

nonameif

nosecurity-level

noipaddress

!

passwd2KFQnbNIdI.2KYOUencrypted

passive??????

clocktimezoneCST8

dnsserver-groupDefaultDNS

domain-namedefault.domain.invalid

access-listoutside_permitextendedpermittcpanyinterfaceoutsideeq3389??

//访问控制列表

access-listoutside_permitextendedpermittcpanyinterfaceoutsiderange3000030010

//允许外部任何用户可以访问outside接口的30000-30010的端口。

pagerlines24

loggingenable????????//启动日志功能

loggingasdminformational

mtuinside1500????????内部最大传输单元为1500字节

mtuoutside1500

mtudmz1500

iplocalpoolvpnclient-00mask

//定义一个命名为vpnclient的IP地址池,为remote用户分配IP地址

nofailover

icmpunreachablerate-limit1burst-size1

asdmimagedisk0:/asdm-522.bin

noasdmhistoryenable

arptimeout14400??????//arp空闲时间为14400秒

global(outside)1interface//由于没有配置NAT故这里是不允许内部用户上INTERNET

static(dmz,outside)tcpinterface3000030000netmask55

//端口映射可以解决内部要公布的效劳太多，而申请公网IP少问题。

static(dmz,outside)tcpinterface3000130001netmask55

//把dmz区30002映射给外部30002端口上。

static(dmz,outside)tcpinterface3000230002netmask55

static(dmz,outside)tcpinterface3000330003netmask55

static(dmz,outside)tcpinterface30004300