ASA NAT ASA防火墻

技術分享圖片
說明:
OUTSIDE模擬外網:e/0接口IP:200.200.200.200/24,lo0:8.8.8.8/32,lo10:114.114.114.114/32
INSIDE模擬內網:vlan 10:10.10.10.1/24,vlan 20:10.10.20.1/24,vlan 30:10.10.30.1/24;默認路由指向ASA防火墻-10.10.10.2。
ASA防火墻默認路由指向OUTSIDE-200.200.200.200,10.0.0.0/8下一跳指向INSIDE-10.10.10.1。

需求:INSIDE-10.10.10.0/24需要訪問外網(8.8.8.8)
方法一:動態NAT
1.新建network object
2.在object下做NAT(使用外網接口地址做轉換)

object network INSIDE-10.10.10.0
subnet 10.10.10.0 255.255.255.0
nat (inside,outside) dynamic interface
exit

access-list OUT-TO-INSIDE extended permit ip any 10.10.10.0 255.255.255.0 //模擬器需要作此策略,真實設備不需要
access-group OUT-TO-INSIDE in interface outside //模擬器需要作此策略,真實設備不需要

測試
INSIDE#ping 8.8.8.8 source vlan 10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

查看ASA防火墻的NAT轉換:
ASA(config)# show xlate
1 in use, 3 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
s - static, T - twice, N - net-to-net

ICMP PAT from inside:10.10.10.1/22 to outside:200.200.200.1/22 flags ri idle 0:00:01 timeout 0:00:30

方法二:動態NAT
1.新建network object
2.在object下做NAT(使用單獨的外網IP做轉換)

object network INSIDE-10.10.10.0
subnet 10.10.10.0 255.255.255.0
nat (inside,outside) dynamic 200.200.200.10
exit

access-list OUT-TO-INSIDE extended permit ip any 10.10.10.0 255.255.255.0 //模擬器需要作此策略,真實設備不需要
access-group OUT-TO-INSIDE in interface outside //模擬器需要作此策略,真實設備不需要

測試:
INSIDE#ping 8.8.8.8 source vlan 10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/7 ms

ASA# show xlate
1 in use, 4 most used
Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,
s - static, T - twice, N - net-to-net

ICMP PAT from inside:10.10.10.1/27 to outside:200.200.200.10/27 flags ri idle 0:00:00 timeout 0:00:30

ASA防火墻Dynamic NAT配置