ASA防火墙新版本8.4-工程实用手册.docx

ASA防火墙新版本8.4-工程实用手册
注意，现在思科ASA防火墙已经升级到8.4，从8.3开始很多配置都有颠覆性的不同，特别是NAT配置很不一样，使用了object /object-group的新方式
这里为了大家工程实施起来方便，特别总结了如下NAT应用，希望能够帮助大家。

ASA 8.3 NAT 转化新语法：
Topology ：

L100 200.0.9.10 R1 ---.2----192.168.1.0----.1---ASA----.1----10.10.10.0---.2---R2 L100 100.1.64.1

The order of operations works as configured by each section. In order:
1. Manual Nat
2. Auto Nat
3. After Auto

Dynamic NAT/PAT场景一：

所有内网流量访问外网时都转换为接口的公网地址，此环境适用于仅有一个公网地址的小型办公室。

Object network inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) dynamic interface

原有的语法
nat (inside) 1 0 0 global (outside) 1 interface

验证：

ciscoasa(config)# show nat detail

Auto NAT Policies (Section 2)

1 (inside) to (outside) source dynamic inside-outside-all interface

translate_hits = 1, untranslate_hits = 0

Source - Origin: 0.0.0.0/0, Translated: 10.10.10.1/24

ciscoasaconfig)# show xlate

1 in use, 4 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

TCP PAT from inside:192.168.1.2/18523 to outside:10.10.10.1/18124 flags ri idle 0:00:20 timeout 0:00:30

ciscoasa(config)# show conn

1 in use, 1 most used

TCP outside 100.1.64.1:23 inside 192.168.1.2:18523, idle 0:00:00, bytes 117, flags UIO

场景二

所有内网流量访问外网时都转换为特定的公网地址，此环境适用于的小型办公室或分支办公室。

Object network inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) dynamic 10.10.10.3

原有的语法
nat (inside) 1 0 0
global (outside) 1 10.10.103

验证

ciscoasa(config)# show nat detail

Auto NAT Policies (Section 2)

1 (inside) to (outside) source dynamic inside-outside-all 10.10.10.3

translate_hits = 3, untranslate_hits = 0

Source - Origin: 0.0.0.0/0, Translated: 10.10.10.3/32

ciscoasa(config)# show xlate

2 in use, 4 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

TCP PAT from inside:192.168.1.2/33470 to outside:10.10.10.3/46897 flags ri idle 0:00:10 timeout 0:00:30

ICMP PAT from inside:192.168.1.2/33 to outside:10.10.10.3/50079 flags ri idle 0:00:15 timeout 0:0030

ciscoasa(config)# show conn

1 in use, 1 most used

TCP outside 100.1.64.1:23 inside 192.168.1.2:33470, idle 0:00:12, bytes 99, flags UIO

场景三
对于有大量公网地址用户，常应用在运营商或者公司内网

Object network inside-outside-trans

Range 10.10.10.100 10.10.10.200

Object network inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) static inside-outside-trans

原有的语法

nat (inside) 1 0 0
global (outside) 1 10.10.10.100 10.10.10.200

验证

ciscoasa(config)# show nat detail

Auto NAT Policies (Section 2)

1 (inside) to (outside) source static inside-outside-all inside-outside-trans

translate_hits = 1, untranslate_hits = 0

Source - Origin: 0.0.0.0/0, Translated: 10.10.10.100-10.10.10.200

ciscoasa(config)# show xlate

1 in use, 4 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

NAT from inside:0.0.0.0/0 to outside:10.10.10.100/30, 10.10.10.104/29,

10.10.10.112/28, 10.10.10.128/26, 10.10.10.192/29,

10.10.10.200

flags s idle 0:00:54 timeout 0:00:00

ciscoasa(config)# show conn

1 in use, 1 most used

TCP outside 100.1.64.1:23 inside 192.168.1.2:51245, idle 0:00:07, bytes 100, flags UIO

场景四
对于有大量公网地址用户，常应用在运营商或者公司内网，为防止地址用完可以配置一个PAT和interface (推荐)

Object network inside-outside-trans

Range 10.10.10.100 10.10.10.200

Object network inside-outside-PAT

Host 10.10.10.201

Object-group network nat-pat-grp

Network-object object inside-outside-trans

Network-object object inside-outside-PAT

Object network inside-outside-all

Subnet 0.0.0.0 0.0.0.0

Nat (inside,outside) dynamic nat-pat-grp interface

原有的语法

nat (inside) 1 0 0
global (outside) 1 10.10.10.100 10.10.10.200

global (outside) 1 interface

验证方法和结果请查看场景三

Static NAT/PAT场景五
内网有邮件和Web服务器为远程办公用户提供访问，此环境适用于HQ和分支办公室

object network server-static

host 10.10.10.3

object network inside-server

host 200.0.9.10

nat (inside,outside) static server-static

原有语法
static (inside,outside) 10.10.10.3 200.0.9.10 netmask 255.255.255.255

验证：

Ciscoasa(config)# show xlate

1 in use, 17 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

NAT from inside:200.0.9.10 to outside:10.10.10.3

flags s idle 0:13:41 timeout 0:00:00

ciscoasa(config)# show conn

1 in use, 8 most used

TCP outside 10.10.10.2:57990 inside 200.0.9.10:23, idle 0:00:10, bytes 234, flags UIOB

ciscoasa(config)# show nat de

ciscoasa(config)# show nat detail

Auto NAT Policies (Section 2)

1 (inside) to (outside) source static inside-server server-static

translate_hits = 0, untranslate_hits = 11

Source - Origin: 200.0.9.10/32, Translated: 10.10.10.3/32

场景六
此环境用户的需求比较复杂，客户在低安全区域有很多提供业务服务的小型机，他需要隐藏被访问的服务器地址，同时要求对外网server的访问进行Static方式一对一的映射。

object network outside-inside-waiguanju-trans69

host 100.1.64.40

object network waihuiju-des-add3

host 197.0.244.3

object network outside-inside-waiguanju-shouzhi-shenbaoxitong

host 100.1.95.1

object network waihuiju-des-add4

host 197.0.244.4

object network outside-inside-waiguanju-trans63

host 100.1.95.2

object network waihuiju-des-add5

host 197.0.244.5

object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz

host 100.1.64.30

object network waihuiju-des-add6

host 197.0.244.6

object network outside-inside-waihuiju-aoyunyingji-fabuwangzhan

host 100.1.248.40

object network waihuiju-des-add7

host 197.0.244.7

object network outside-inside-waihuiju-geren-gouhui

host 100.1.248.20

object network waihuiju-des-add8

host 197.0.244.8

object network outside-inside-waihuiju-jieshouhui-ceshixitong

host 100.1.248.26

object network waihuiju-des-add9

host 197.0.244.9

object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1

host 100.1.64.1

object network waihuiju-des-add10

host 197.0.244.10

object network outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2

host 100.1.64.21

object network waihuiju-des-add11

host 197.0.244.11

object network outside-inside-waiguanju-trans12

host 100.1.1.1

object network waihuiju-des-add12

host 197.0.244.12

object network outside-inside-waiguanju-jieshouhui-tongjixitong

host 100.1.248.17

object network waihuiju-des-add13

host 197.0.244.13

object network outside-inside-ITSxitongceshi

host 100.1.95.4

object network waihuiju-des-add14

host 197.0.244.14

object network outside-inside-waiguanju-trans91

host 100.1.95.5

object network waihuiju-des-add15

host 197.0.244.15

object network waihuiju-tran-add

host 29.2.7.254

object-group network waihuiju-des-add

network-object object waihuiju-des-add3

network-object object waihuiju-des-add4

network-object object waihuiju-des-add5

network-object object waihuiju-des-add6

network-object object waihuiju-des-add7

network-object object waihuiju-des-add8

network-object object waihuiju-des-add9

network-object object waihuiju-des-add10

network-object object waihuiju-des-add11

network-object object waihuiju-des-add12

network-object object waihuiju-des-add13

network-object object waihuiju-des-add14

network-object object waihuiju-des-add15

object-group network outside-inside-Map

network-object object outside-inside-waiguanju-trans69

network-object object outside-inside-waiguanju-shouzhi-shenbaoxitong

network-object object outside-inside-waiguanju-trans63

network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong-hz

network-object object outside-inside-waihuiju-aoyunyingji-fabuwangzhan

network-object object outside-inside-waihuiju-geren-gouhui

network-object object outside-inside-waihuiju-jieshouhui-ceshixitong

network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong1

network-object object outside-inside-waihuiju-zhijietouzi-waihuiyewu-xinxixitong2

network-object object outside-inside-waiguanju-trans12

network-object object outside-inside-waiguanju-jieshouhui-tongjixitong

network-object object outside-inside-ITSxitongceshi

network-object object outside-inside-waiguanju-trans91

nat (inside,outside) source dynamic any waihuiju-tran-add destination static waihuiju-des-add outside-inside-Map

验证 ：

ciscoasa# show xlate

7 in use, 17 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

NAT from outside:100.1.64.40, 100.1.95.1, 100.1.95.2,

100.1.64.30, 100.1.248.40, 100.1.248.20,

100.1.248.26, 100.1.64.1, 100.1.64.21,

100.1.1.1, 100.1.248.17, 100.1.95.4,

100.1.95.5 to inside:197.0.244.3, 197.0.244.4,

197.0.244.5, 197.0.244.6, 197.0.244.7,

197.0.244.8, 197.0.244.9, 197.0.244.10,

197.0.244.11, 197.0.244.12, 197.0.244.13,

197.0.244.14, 197.0.244.15

flags sT idle 0:10:32 timeout 0:00:00

TCP PAT from inside:192.168.1.2/29060 to outside:29.2.7.254/14832 flags ri idle 0:10:47 timeout 0:00:30

TCP PAT from inside:192.168.1.2/20099 to outside:29.2.7.254/50442 flags ri idle 0:11:02 timeout 0:00:30

TCP PAT from inside:192.168.1.2/32652 to outside:29.2.7.254/19035 flags ri idle 0:11:19 timeout 0:00:30

TCP PAT from inside:192.168.1.2/64367 to outside:29.2.7.254/16920 flags ri idle 0:11:27 timeout 0:00:30

TCP PAT from inside:192.168.1.2/46218 to outside:29.2.7.254/62293 flags ri idle 0:11:34 timeout 0:00:30

TCP PAT from inside:192.168.1.2/33598 to outside:29.2.7.254/58119 flags ri idle 0:11:50 timeout 0:00:30

ciscoasa# show conn

6 in use, 8 most used

TCP outside 197.0.244.6(100.1.64.30):23 inside 192.168.1.2:20099, idle 0:01:02, bytes 139, flags UFRIO

TCP outside 197.0.244.6(100.1.64.30):23 inside 192.168.1.2:32652, idle 0:01:17, bytes 145, flags UFRIO

TCP outside 197.0.244.8(100.1.248.20):23 inside 192.168.1.2:46218, idle 0:01:35, bytes 121, flags UFRIO

TCP outside 197.0.244.10(100.1.64.1):23 inside 192.168.1.2:33598, idle 0:01:51, bytes 121, flags UFRIO

TCP outside 197.0.244.3(100.1.64.40):23 inside 192.168.1.2:29060, idle 0:00:48, bytes 121, flags UFRIO

TCP outside 197.0.244.7(100.1.248.40):23 inside 192.168.1.2:64367, idle 0:01:28, bytes 132, flags UFRIO

ciscoasa# show nat detail

ciscoasa# show nat detail

Manual NAT Policies (Section 1)

1 (inside) to (outside) source dynamic any waihuiju-tran-add destination static waihuiju-des-add outside-inside-Map

translate_hits = 8, untranslate_hits = 8

Source - Origin: 0.0.0.0/0, Translated: 29.2.7.254/32

Destination - Origin: 197.0.244.3/32, 197.0.244.4/32, 197.0.244.5/32, 197.0.244.6/32

197.0.244.7/32, 197.0.244.8/32, 197.0.244.9/32, 197.0.244.10/32

197.0.244.11/32, 197.0.244.12/32, 197.0.244.13/32, 197.0.244.14/32

197.0.244.15/32, Translated: 100.1.64.40/32, 100.1.95.1/32, 100.1.95.2/32, 100.1.64.30/32

100.1.248.40/32, 100.1.248.20/32, 100.1.248.26/32, 100.1.64.1/32

100.1.64.21/32, 100.1.1.1/32, 100.1.248.17/32, 100.1.95.4/32

100.1.95.5/32

场景七
对通过防火墙的业务流量，不更改源地址，也就是将源地址NAT自己，我们称为identity NAT。

object network inside-nonat

host 192.168.1.2

nat (inside,outside) static 192.168.1.2

验证：

ciscoasa(config)# show xlate

1 in use, 17 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

NAT from inside:192.168.1.2 to outside:192.168.1.2

flags sI idle 0:02:09 timeout 0:00:00

ciscoasa(config)# show conn

1 in use, 8 most used

TCP outside 100.1.64.1:23 inside 192.168.1.2:65450, idle 0:00:12, bytes 115, flags UIO

ciscoasa(config)# show nat detail

Auto NAT Policies (Section 2)

1 (inside) to (outside) source static inside-nonat 192.168.1.2

translate_hits = 3, untranslate_hits = 0

Source - Origin: 192.168.1.2/32, Translated: 192.168.1.2/32

Router# who

Line User Host(s) Idle Location

* 0 con 0 idle 00:00:00

6 vty 0 idle 00:00:07 192.168.1.2

注意：
Nat-control 不在使用

如果要开启需要使用下面的语法：
object network obj_any subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic obj-0.0.0.0
object network obj-0.0.0.0
host 0.0.0.0
object network obj_any-01
subnet 0.0.0.0 0.0.0.0
nat (inside,mgmt) dynamic obj-0.0.0.0
object network obj_any-02
subnet 0.0.0.0 0.0.0.0
nat (inside,dmz) dynamic obj-0.0.0.0
object network obj_any-03
subnet 0.0.0.0 0.0.0.0
nat (mgmt,outside) dynamic obj-0.0.0.0
object network obj_any-04
subnet 0.0.0.0 0.0.0.0
nat (dmz,outside) dynamic obj-0.0.0.0
object network obj_any-05
subnet 0.0.0.0 0.0.0.0
nat (dmz,mgmt) dynamic obj-0.0.0.0

ASA 8.3 后需要使用真实IP 作为ACL 条目.
ASA 8.3 NAT need real ip address on access-list .Please refer to new migrate on ASA 8.3 NAT commands. For example:

Old Configuration
static (inside,outside) 172.23.57.1 10.50.50.50 netmask 255.255.255.255

access-list 1 permit ip any host 172.23.57.1
access-group 1 in interface outside

Migrated Configuration

access-list 1 permit ip any host 10.50.50.50
access-group 1 in interface outside
注意事项:
更新ASA 8.3 NAT 新注意事项 如果做多公网IP 对 一个内网 IP的时候SNAT 请大家打开inspect icmp. 切记

常用排错命令：
show run nat
show run object-network
show run object-group
show nat detail
show xlate
show conn
show nat pool
debug nat 255