Home | 簡體中文 | 繁體中文 | 雜文 | 打賞(Donations) | ITEYE 博客 | OSChina 博客 | Facebook | Linkedin | 知乎專欄 | Search | Email

13.2. Cisco ASA Firewall

13.2.1. Console 登錄

		
ciscoasa> en
Password:
ciscoasa# show run
: Saved
:
ASA Version 8.2(1)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/1
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 management-only
!
interface GigabitEthernet1/0
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/1
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
pager lines 24
logging asdm informational
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:2ca307ae725244ecf965030aa8ee6a2b
: end
ciscoasa#
		
		

13.2.1.1. 清除配置檔案

ciscoasa# conf t
ciscoasa(config)# clear config all
WARNING: DHCPD bindings cleared on interface 'management', address pool removed
ciscoasa(config)#
			

13.2.2. Management0/0

使用靜態IP地址

ciscoasa(config-if)# no dhcpd address 192.168.1.2-192.168.1.254 management
ciscoasa(config)# no dhcpd enable management
ciscoasa(config)# interface Management0/0
ciscoasa(config-if)# ip address 192.168.3.254 255.255.255.0
Waiting for the earlier webvpn instance to terminate...
Previous instance shut down. Starting a new one.
		

使用DHCP分配IP地址

ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0
Waiting for the earlier webvpn instance to terminate...
Previous instance shut down. Starting a new one.
ciscoasa(config-if)# dhcpd address 192.168.1.2-192.168.1.254 management
ciscoasa(config)# dhcpd enable management
ciscoasa(config)#
		

13.2.3. 介面配置

ciscoasa(config)# interface GigabitEthernet0/0
ciscoasa(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ciscoasa(config-if)# ip address 172.16.0.2 255.255.255.0
ciscoasa(config-if)# no shutdown


ciscoasa(config-if)# interface GigabitEthernet1/0
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ciscoasa(config-if)# ip address 192.168.3.254 255.255.255.0
ciscoasa(config-if)# no shutdown

ciscoasa(config-if)# show ip
System IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
GigabitEthernet0/0       outside                172.16.0.2      255.255.255.0   manual
Management0/0            management             192.168.1.1     255.255.255.0   manual
GigabitEthernet1/0       inside                 192.168.3.254   255.255.255.0   manual
Current IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
GigabitEthernet0/0       outside                172.16.0.2      255.255.255.0   manual
Management0/0            management             192.168.1.1     255.255.255.0   manual
GigabitEthernet1/0       inside                 192.168.3.254   255.255.255.0   manual
		

13.2.3.1. 子介面

interface GigabitEthernet1/0.1
 no vlan
 no nameif
 no security-level
 ip address 172.16.7.254 255.255.255.0
			

13.2.4. route

ciscoasa(config)# route outside 0 0 172.16.0.1
show route
		

13.2.5. ACL

13.2.5.1. Blacklist

黑名單規則

access-list outside extended permit icmp any any
access-list outside deny ip any any
access-list outside extended permit tcp any any eq www
access-list outside extended permit tcp any any eq https
access-list outside extended permit tcp any host 28.6.7.23 eq ftp
access-list outside permit tcp any host 202.96.134.133 eq www
access-list outside permit ip any host 133.11.20.21 eq ftp
access-group outside in interface outside
			

13.2.5.2. Whitelist

白名單規則

access-list outside extended permit ip any any
access-list outside extended permit icmp any any
access-list outside extended permit tcp any any
access-list outside extended permit udp any any
access-list outside deny ip any host 192.168.0.1
access-list outside deny ip any host 192.168.0.2 eq www
access-group outside in interface outside
			

13.2.5.3. object-group

下面是一個簡單的黑白名單實例

object-group network blacklist
 description deny ip to example.com
 network-object 61.191.55.0 255.255.255.0
 network-object host 61.190.10.181
 network-object host 61.190.10.182
 network-object host 61.190.10.183
 network-object host 61.191.55.248
 network-object host 61.190.10.181
 network-object host 61.185.114.87
 network-object host 60.210.111.236
 network-object host 218.64.182.105
 network-object host 210.51.51.157
 network-object host 63.221.138.204
 network-object host 119.188.10.163
  
access-list outside extended deny tcp object-group blacklist host 120.12.14.7

object-group network whitelist
 description deny ip to example.com
 network-object 61.191.50.0 255.255.255.0
 network-object host 61.190.10.18
 network-object host 61.191.55.24
 network-object host 61.190.10.18
 network-object host 61.185.114.8
 network-object host 60.210.111.23
 network-object host 218.64.182.10
 network-object host 210.51.51.15
 network-object host 63.221.138.20
 network-object host 119.188.10.16
access-list outside extended permit tcp object-group whitelist host 120.12.14.7
			

連接埠實例

object-group network dbhost
 description database 
 network-object 172.16.4.0 255.255.255.0
 network-object 172.16.5.0 255.255.255.0
object-group service dbport tcp
 description database 
 port-object eq 3306
 port-object eq 2521
 port-object eq 5432
object-group network www
 description www
 network-object 172.16.4.0 255.255.255.0
 network-object 172.16.5.0 255.255.255.0
object-group service webport tcp
 description database
 port-object eq www
 port-object range 81 88


access-list outside extended permit tcp object-group dbhost host 172.16.4.10 object-group dbport 
access-list outside extended permit tcp any object-group webport any 
			

13.2.5.4. Example

access-list outside extended permit icmp any any
access-list outside extended permit tcp any any eq www
access-list outside extended permit tcp any any eq ssh
access-list outside extended permit udp any host 120.112.13.20 eq domain
access-list outside extended permit udp any host 120.112.13.23 eq domain
access-list outside extended permit tcp any host 120.112.13.18 eq ssh
access-list outside extended permit tcp any host 120.112.13.7 eq ftp
access-list outside extended permit tcp any host 120.112.13.21 eq www
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.27 eq ssh
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.28 eq ssh
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.11 eq ssh
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.12 eq ssh
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.8 eq ssh
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.9 eq ssh
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.15 eq ssh
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.29 eq ftp
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.10 eq ftp
access-list outside extended permit tcp host 113.106.63.1 host 120.112.13.10 eq ssh
access-list outside deny ip 192.168.0.0 0.255.255.255 any
access-list outside deny ip 127.0.0.0 0.255.255.255 any
access-list outside extended permit tcp any host 120.112.13.33
access-list outside permit ip any any

access-list inside extended permit icmp any any
access-list inside extended permit ip any any
			
ciscoasa(config)# access-list outside permit icmp any any
ciscoasa(config)# access-group outside in interface outside
ciscoasa(config)# show access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list outside; 1 elements; name hash: 0x1a47dec4
access-list outside line 1 extended permit icmp any any (hitcnt=0) 0x390a154c
			

extended關鍵字可能省略 access-list outside permit ip any any,另外我比較喜歡用nameif做acl 名稱,這樣比較直觀如: outside,你也可以使用傳統100,101什麼的

13.2.6. 配置NAT映射

把inside區域的所有地址進行映射,映射為outside連接埠的那個公網IP地址。

globle (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
		

指定其他IP

asa(config)#nat(inside) 1 192.168.1.1 255.255.255.0
asa(config)#global(outside) 1 222.240.254.193 255.255.255.248
		

定義的地址池

asa(config)#nat (inside) 0 192.168.1.1 255.255.255.255     //表示192.168.1.1這個地址不需要轉換。直接轉發出去。
asa(config)#global (outside) 1 133.1.0.1-133.1.0.14      //定義的地址池
asa(config)#nat (inside) 1 0 0                           //0 0表示轉換網段中的所有地址。定義內部網絡地址將要翻譯成的全局地址或地址範圍
		

我的配置

global (outside) 1 interface
nat (inside) 1 172.16.1.0 255.255.255.0 0 0
		

13.2.6.1. IP 映射

static (inside,outside) 222.24.24.2 192.168.1.2
static (inside,outside) 222.24.24.2 192.168.1.2 4096 32
			

後面的4096為限制連接數,32為限制的半開連接數。

asa(config)#static (dmz,outside) 13.1.0.2 10.65.1.102        ;靜態NAT
asa(config)#static (inside,dmz) 10.66.1.20 10.66.1.20        ;靜態NAT
			

13.2.6.2. 連接埠映射

static (inside,outside) tcp 61.144.203.40 80 192.168.0.116 80 netmask 255.255.255.255 0 0
static (inside,outside) tcp 61.144.203.40 20 192.168.0.116 20 netmask 255.255.255.255 0 0
static (inside,outside) 221.221.147.195 192.168.0.10 netmask 255.255.255.255 tcp 8089 0
			

13.2.7. timeout

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
		

13.2.8. DHCP

13.2.8.1. management

dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
			

13.2.8.2. inside

dhcpd address 192.168.1.100-192.168.1.199 inside 					設置DHCP伺服器地址池
dhcpd dns 208.67.222.222 208.67.220.220 interface inside 			設置DNS伺服器到內網連接埠
dhcpd enable inside 												設置DHCP應用到內網連接埠
			

13.2.9. SNMP

snmp-server host inside 172.16.1.2
snmp-server location GuangDong
snmp-server contact neo.chen@example.com
snmp-server community public
		

13.2.10. 用戶登錄

創建用戶

username cisco password cisco									#明文密碼
username cisco password 3USUcOPFUiMCO4Jk encrypted				#加密密碼
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 #不需要enable密碼
		

匹配地址 172.16.0.1 255.255.255.255

匹配網段 172.16.0.0 255.255.255.0

所有地址 0.0.0.0 0.0.0.0

13.2.10.1. Telnet

username cisco password cisco
aaa authentication telnet console LOCAL
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
			

13.2.10.2. SSH

1) username xxxx password xxxx
2) passwd xxxxx
3) ssh x.x.x.x x.x.x.x {inside/outside}
4) crypto key generate rsa modulus {512/768/1024/2048}
5) aaa authentication ssh console LOCAL
			
username cisco password cisco
passwd cisco
ssh 172.16.0.1 255.255.255.255 outside
crypto key generate rsa modulus 2048
aaa authentication ssh console LOCAL
			

13.2.11. VPN

13.2.11.1. site to site

13.2.11.2. webvpn

13.2.12. service-policy

ciscoasa(config)# access-list TEST200K permit ip host x.x.x.x any
ciscoasa(config)# class-map internet
ciscoasa(config-cmap)# match access-list TEST200K

ciscoasa(config)# policy-map out-police
ciscoasa(config-pmap)# class internet

ciscoasa(config-pmap-c)# police output 200000 1000 conform-action transmit exceed-action drop

ciscoasa(config)# service-policy out-police interface outside
		

使用NAT映射後應該配置到inside介面上

access-list 200k extended permit ip any host x.x.x.x
access-list 500k extended permit ip any host x.x.x.x

class-map 200k
    match access-list 200k
policy-map limit200k
    class 200k
        police input 2096000 1048
        police output 2096000 1048
service-policy limit200k interface inside

class-map 500k
    match access-list 500k
policy-map limit500k
    class 500k
        police input 2096000 1048
        police output 2096000 1048
service-policy limit500k interface inside
		

13.2.13. failover

interface GigabitEthernet1/1
!
interface GigabitEthernet1/1.1
 description STATE Failover Interface
 vlan 2
!
interface GigabitEthernet1/1.2
 description LAN Failover Interface
 vlan 3
!

failover
failover lan unit primary
failover lan interface failover GigabitEthernet1/1.2
failover link state GigabitEthernet1/1.1
failover interface ip failover 172.16.10.1 255.255.255.248 standby 172.16.10.2
failover interface ip state 172.16.10.9 255.255.255.248 standby 172.16.10.10
		
ciscoasa# show failover state

               State          Last Failure Reason      Date/Time
This host  -   Primary
               Active         Ifc Failure              14:49:44 UTC Oct 26 2011
                              outside: No Link
Other host -   Secondary
               Standby Ready  Comm Failure             16:27:18 UTC Oct 26 2011

====Configuration State===
	Sync Done
====Communication State===
	Mac set
		

13.2.14. 透明防火牆(transparent)

ciscoasa(config)# firewall transparent
ciscoasa(config)# show firewall
Firewall mode: Transparent
		
interface GigabitEthernet0/0
 nameif outside
 security-level 0
!
interface GigabitEthernet1/0
 nameif inside
 security-level 100
!
access-list outside extended permit icmp any any
access-list outside extended permit ip any any
access-list outside extended permit udp any any
access-list outside extended permit tcp any any

access-group outside in interface outside

ip address 192.168.0.247 255.255.255.0
route outside 0.0.0.0 0.0.0.0 192.168.0.254

asdm image disk0:/asdm-645.bin

http server enable
http 0.0.0.0 0.0.0.0 inside
		

例 13.1. firewall transparent

ciscoasa(config)# sh run
: Saved
:
ASA Version 8.2(5)
!
firewall transparent
hostname ciscoasa
enable password zXKclT3IcSf6EDMe encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
!
interface GigabitEthernet0/1
 shutdown
 no nameif
 no security-level
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 management-only
!
interface GigabitEthernet1/0
 nameif inside
 security-level 100
!
interface GigabitEthernet1/1
 shutdown
 no nameif
 no security-level
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
!
ftp mode passive
access-list outside extended permit icmp any any
access-list outside extended permit ip any any
access-list outside extended permit udp any any
access-list outside extended permit tcp any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address 192.168.0.6 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.0.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:30eb28a5a6b73fb3638eb279d27086c1
: end
			

13.2.15. logging

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/monitor_syslog.html

logging enable 
logging timestamp 
logging trap warnings 
logging host inside 172.16.1.9
logging facility local0 
		
		

ciscoasa(config)# logging trap ?

 

configure mode commands/options:

  <0-7>          Enter syslog level (0 - 7)

  WORD           Specify the name of logging list

  alerts         Immediate action needed           (severity=1)

  critical       Critical conditions               (severity=2)

  debugging      Debugging messages                (severity=7)

  emergencies    System is unusable                (severity=0)

  errors         Error conditions                  (severity=3)

  informational  Informational messages            (severity=6)

  notifications  Normal but significant conditions (severity=5)

  warnings       Warning conditions                (severity=4)

ciscoasa(config)# logging trap informational

ciscoasa(config)# logging trap notifications
		
		

13.2.16. ntp

		
ciscoasa(config)# ntp server 172.16.0.5

ciscoasa(config)# clock timezone GMT +8

ciscoasa(config)# clock timezone EST +8

ciscoasa(config)# sh clock detail

18:47:06.931 EST Fri Jan 6 2012

Time source is NTP

UTC time is: 10:47:06 UTC Fri Jan 6 2012

 

ciscoasa(config)# sh ntp status

Clock is synchronized, stratum 4, reference is 172.16.3.52

nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6

reference time is d2b14f98.93025c85 (18:46:48.574 EST Fri Jan 6 2012)

clock offset is -11.4445 msec, root delay is 309.22 msec

root dispersion is 497.94 msec, peer dispersion is 391.02 msec

 

ciscoasa(config)# clock timezone UTC +8

ciscoasa(config)# sh ntp status

Clock is synchronized, stratum 4, reference is 172.16.3.52

nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6

reference time is d2b15000.8fce7067 (18:48:32.561 UTC Fri Jan 6 2012)

clock offset is -10.7866 msec, root delay is 309.19 msec

root dispersion is 124.11 msec, peer dispersion is 16.31 msec

 

ciscoasa(config)# clock timezone CST 8

ciscoasa(config)# sh ntp status

Clock is synchronized, stratum 4, reference is 172.16.3.52

nominal freq is 99.9984 Hz, actual freq is 99.9985 Hz, precision is 2**6

reference time is d2b15040.8f989fe3 (18:49:36.560 CST Fri Jan 6 2012)

clock offset is -17.1219 msec, root delay is 309.23 msec

root dispersion is 136.72 msec, peer dispersion is 21.61 msec
		
		

13.2.17. asdm

asdm image disk0:/asdm-645.bin
		

13.2.18. 備份配置檔案

我建議你放棄tftp,目前主流設備都支持很多協議。我比較喜歡使用ftp

ciscoasa# copy running-config ftp://test:your_pasword@172.16.0.2

Source filename [running-config]?

Address or name of remote host [172.16.1.2]?

Destination username [test]?

Destination password [******]?

Destination filename [running-config]?
Cryptochecksum: e5bb0305 02196b08 59efc7e5 9b4e1132
!!!!!!
19447 bytes copied in 3.900 secs (6482 bytes/sec)