廣州網絡維護服務過程中(zhōng)網絡維護配置是必不可少的過程，以下(xià)向大(dà)家介紹cisco-asa防火(huǒ)牆配置的内容

1. 常用技巧
   
    Sh ru ntp查看與ntp有關的
   
    Sh ru crypto 查看與vpn有關的
   
    Sh ru | inc crypto 隻是關健字過濾而已
   
    2. 故障倒換
   
    failover
   
    failover lan unit primary
   
    failover lan interface testint Ethernet0/3
   
    failover link testint Ethernet0/3
   
    failover mac address Ethernet0/1 0018.1900.5000 0018.1900.5001
   
    failover mac address Ethernet0/0 0018.1900.4000 0018.1900.4001
   
    failover mac address Ethernet0/2 0018.1900.6000 0018.1900.6001
   
    failover mac address Management0/0 0018.1900.7000 0018.1900.7001
   
    failover interface ip testint 10.3.3.1 255.255.255.0 standby 10.3.3.2
   
    注：最好配置虛拟MAC地址
   
    sh failover顯示配置信息
   
    write standby寫入到備用的防火(huǒ)牆中(zhōng)
   
    failover命令集如下(xià)：
   
    configure mode commands/options:
   
    interface Configure the IP address and mask to be used for failover
   
    and/or stateful update information
   
    interface-policy Set the policy for failover due to interface failures
   
    key Configure the failover shared secret or key
   
    lan Specify the unit as primary or secondary or configure the
   
    interface and vlan to be used for failover communication
   
    link Configure the interface and vlan to be used as a link for
   
    stateful update information
   
    mac Specify the virtual mac address for a physical interface
   
    polltime Configure failover poll interval
   
    replication Enable HTTP （port 80） connection replication
   
    timeout Specify the failover reconnect timeout value for
   
    asymmetrically routed sessions
   
    sh failover 命令集如下(xià)：
   
    history Show failover switching history
   
    interface Show failover command interface information
   
    state Show failover internal state information
   
    statistics Show failover command interface statistics information
   
    Output modifiers
   
    3. 配置telnet、ssh及http管理
   
    username jiang password Csmep3VzvPQPCbkx encrypted privilege 15
   
    aaa authentication enable console LOCAL
   
    aaa authentication telnet console LOCAL
   
    aaa authentication ssh console LOCAL
   
    aaa authorization command LOCAL
   
    http 192.168.40.0 255.255.255.0 management
   
    ssh 192.168.40.0 255.255.255.0 inside
   
    4. vpn常用管理命令
   
    sh vpn-sessiondb full l2l 顯示site to site 之vpn通道情況
   
    sh ipsec stats 顯示ipsec通道情況
   
    sh vpn-sessiondb summary 顯示vpn彙總信息
   
    sh vpn-sessiondb detail l2l 顯示ipsec詳細信息
   
    sh vpn-sessiondb detail svc 查看ssl client信息
   
    sh vpn-sessiondb detail webvpn 查看webvpn信息
   
    sh vpn-sessiondb detail full l2l 相當于linux下(xià)的ipsec whack ?Cstatus 如果沒有建立連接，則表示ipsec通道還沒有建立起來。
   
    5. 配置訪問權限
   
    可以建立對象組，設定不同的權限，如：
   
    object-group network testgroup
   
    description test
   
    network-object 192.168.100.34 255.255.255.255
   
    access-list inside_access_in line 2 extended permit ip object-group all any
   
    access-group inside_access_in in interface inside
   
    6. 配置sitetosite之VPN
   
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
   
    crypto map outside_map 20 match address outside_cryptomap_20_1
   
    crypto map outside_map 20 set pfs
   
    crypto map outside_map 20 set peer 218.16.105.48
   
    crypto map outside_map 20 set transform-set ESP-3DES-SHA
   
    crypto map outside_map interface outside
   
    isakmp identity address
   
    isakmp enable outside
   
    isakmp policy 10 authentication pre-share
   
    isakmp policy 10 encryption 3des
   
    isakmp policy 10 hash sha
   
    isakmp policy 10 group 2
   
    isakmp policy 10 lifetime 86400
   
    tunnel-group 218.16.105.48 type ipsec-l2l
   
    tunnel-group 218.16.105.48 ipsec-attributes
   
    pre-shared-key *
   
    peer-id-validate nocheck
   
    tunnel-group-map enable rules
7. webvpn配置（ssl vpn）
   
    webvpn
   
    enable outside
   
    character-encoding gb2312
   
    csd image disk0:/securedesktop-asa-3.1.1.16.pkg
   
    svc image disk0:/sslclient-win-1.1.0.154.pkg 1
   
    svc enable
   
    customization customization1
   
    title text TEST WebVPN system
   
    title style background-color:white;color: rgb（51,153,0）；border-bottom:5px groo
   
    ve #669999;font-size:larger;vertical-align:middle;text-align:left;font-weight:bold
   
    tunnel-group-list enable
   
    注：也可通過ASDM圖形界面進行配置
   
    登錄後，可訪問内部資(zī)源，如下(xià)例：（客戶端首先要安裝Java插件jre-1_5_0-windows-i586.exe,并打開(kāi)浏覽器的ActiveX）
   
    1） 輸入用戶名和密碼
   
    2） 出現工(gōng)具條
   
    3） 在Enter Web Address内輸入192.168.40.8即可訪問内部網站
   
    4）在browse network輸入192.168.40.8即可訪問共享文件
   
    5）點擊application access，即可查看端口轉發設置，如使用putty訪問本機的2023端口，則即可通過ssh登錄192.168.40.8
   
    8. 遠程撥入VPN
   
    相關的ASA配置命令如下(xià)：
   
    access-list inside_access_in extended permit ip object-group remotegroup any
   
    access-list inside_access_in extended permit icmp object-group remotegroup any
   
    access-list remotevpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
   
    access-list vpnclient_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
   
    ip local pool dialuserIP 192.168.101.1-192.168.101.254 mask 255.255.255.0
   
    group-policy remotevpn attributes
   
    dns-server value 202.96.128.68 192.168.40.16
   
    default-domain value test.com.cn
   
    username jiang password Csmep3VzvPQPCbkx encrypted privilege 15
   
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
   
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
   
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
   
    crypto dynamic-map outside_dyn_map 20 set pfs
   
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
   
    crypto dynamic-map outside_dyn_map 20 set reverse-route
   
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
   
    crypto map outside_map interface outside
   
    tunnel-group remotevpn type ipsec-ra
   
    tunnel-group remotevpn general-attributes
   
    address-pool dialuserIP
   
    default-group-policy remotevpn
   
    tunnel-group remotevpn ipsec-attributes
   
    pre-shared-key *
   
    客戶端設置如下(xià)：
   
    9. 日志(zhì)服務器配置
   
    logging enable
   
    logging timestamp
   
    logging emblem
   
    logging trap informational
   
    logging asdm warnings
   
    logging host inside 192.168.40.115 format emblem
   
    logging permit-hostdown
   
    vpn-simultaneous-logins 3
   
    10. Snmp網管配置
   
    snmp-server host inside 192.168.40.47 community testsnmp
   
    snmp-server location DG-GTEST
   
    snmp-server contact jiangdaoyou:6162
   
    snmp-server community testsnmp
   
    snmp-server enable traps snmp authentication linkup linkdown coldstart
   
    注：指定主機後，192.168.40.47才可能進行管理
   
    11. ACS配置
   
    安裝後管理：http://ip:2002 通過ACS可以進行授權、認證等等很多功能
   
    因内容太多，暫省略
   
    12. AAA配置
   
    Aaa服務器配置：
   
    aaa-server radius_dg host dc03.xxxx.com
   
    key dfdfdfdf146**U
   
    authentication-port 1812
   
    accounting-port 1813
   
    radius-common-pw dfdfdfdf146**U
   
    對于撥入vpn的配置
   
    tunnel-group vg_testerp general-attributes
   
    address-pool ciscovpnuser
   
    authentication-server-group radius_dg
   
    default-group-policy vg_testerp
   
    13. 升級IOS
   
    copy tftp://192.168.40.180/asa/asa721-k8.bin disk0:/asa721-k8.bin
   
    boot system disk0:/asa721-k8.bin （多個Image時使用）
   
    14. 疑難雜(zá)症
   
    1） 在遠程子網不能ping通過對方的網關，如在無錫格蘭不能ping 192.168.40.251
   
    輸入命令：management-access inside （通過ASDM不能設置這一(yī)項）
   
    2） NAT有時不能快速啓作用
   
    使用命令：clear xlate即可

鄭州易科計算機服務有限公司