一.拓扑图:
二.接口配置：
A.PC1：
eth0:202.1.1.1/24
B.ASA:
ciscoasa(config-if)# int g0
ciscoasa(config-if)# ip add 10.1.1.10 255.255.255.0
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ciscoasa(config-if)# no sh
ciscoasa(config)# int gigabitEthernet 1
ciscoasa(config-if)# ip add 202.1.1.10 255.255.255.0
ciscoasa(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ciscoasa(config-if)# no sh
C.R1:
R1(config)#int f0/0
R1(config-if)#ip add 10.1.1.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int f0/1
R1(config-if)#ip add 20.1.1.1 255.255.255.0
R1(config-if)#no sh
D.R2:
R2(config)#int f0/0
R2(config-if)#ip add 10.1.1.2 255.255.255.0
R2(config-if)#no sh
E.R3:
R3(config)#int f0/0
R3(config-if)#ip add 20.1.1.3 255.255.255.0
R3(config-if)#no sh
三.路由配置：
ASA(config)# route inside 20.1.1.0 255.255.255.0 10.1.1.1
R1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.10
R2(config-if)#ip route 0.0.0.0 0.0.0.0 10.1.1.10
R3(config-if)#ip route 0.0.0.0 0.0.0.0 20.1.1.1
四.防火墙NAT及策略配置：
ciscoasa(config)# object network inside-network1
ciscoasa(config-network-object)# subnet 10.1.1.0 255.255.255.0
ciscoasa(config-network-object)# nat (inside,outside) dynamic interface
ciscoasa(config-network-object)# exit exit
ciscoasa(config)# object network inside-network2
ciscoasa(config-network-object)# subnet 20.1.1.0 255.255.255.0
ciscoasa(config-network-object)# nat (inside,outside) dynamic interface
ciscoasa(config-network-object)# exit
ASA(config)# access-list outside permit icmp any object inside-work1 echo-reply
ASA(config)# access-list outside permit icmp any object inside-work2 echo-reply
ASA(config)# access-group outside in interface outside
五.公网访问测试：
R1#ping 202.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/28/52 ms
R2#ping 202.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/29/68 ms
R3#ping 202.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/52/72 ms
六.配置R2和R3互访：
A.R2 ping R3，防火墙有如下日志：
%ASA-3-106014: Deny inbound icmp src inside:10.1.1.2 dst inside:20.1.1.3 (type 8, code 0)
%ASA-3-106014: Deny inbound icmp src inside:10.1.1.2 dst inside:20.1.1.3 (type 8, code 0)
%ASA-3-106014: Deny inbound icmp src inside:10.1.1.2 dst inside:20.1.1.3 (type 8, code 0)
B.防火墙开启相同区域互访：
ASA(config)# same-security-traffic permit intra-interface
R2#ping 20.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 20.1.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/52/96 ms
R3#ping 10.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/51/96 ms
-----相对于pix 8.0，不用配置NAT免除。
七.验证tcp连接
A.R2 TELNET R3
R2#telnet 20.1.1.3
Trying 20.1.1.3 ...
% Connection timed out; remote host not responding
R2#
防火墙日志如下:
%ASA-7-609001: Built local-host inside:10.1.1.2
%ASA-7-609001: Built local-host inside:20.1.1.3
%ASA-6-302013: Built inbound TCP connection 43 for inside:10.1.1.2/23957 (10.1.1.2/23957) to inside:20.1.1.3/23 (20.1.1.3/23)
%ASA-6-302014: Teardown TCP connection 43 for inside:10.1.1.2/23957 to inside:20.1.1.3/23 duration 0:00:00 bytes 0 TCP Reset-O
%ASA-7-609002: Teardown local-host inside:10.1.1.2 duration 0:00:00
%ASA-7-609002: Teardown local-host inside:20.1.1.3 duration 0:00:00
%ASA-7-609001: Built local-host inside:10.1.1.2
%ASA-7-609001: Built local-host inside:20.1.1.3
%ASA-6-302013: Built inbound TCP connection 44 for inside:10.1.1.2/23957 (10.1.1.2/23957) to inside:20.1.1.3/23 (20.1.1.3/23)
%ASA-6-302014: Teardown TCP connection 44 for inside:10.1.1.2/23957 to inside:20.1.1.3/23 duration 0:00:00 bytes 0 TCP Reset-O
%ASA-7-609002: Teardown local-host inside:10.1.1.2 duration 0:00:00
%ASA-7-609002: Teardown local-host inside:20.1.1.3 duration 0:00:00
%ASA-7-609001: Built local-host inside:10.1.1.2
%ASA-7-609001: Built local-host inside:20.1.1.3
%ASA-6-106015: Deny TCP (no connection) from 10.1.1.2/23957 to 20.1.1.3/23 flags RST on interface inside
%ASA-7-609002: Teardown local-host inside:10.1.1.2 duration 0:00:00
%ASA-7-609002: Teardown local-host inside:20.1.1.3 duration 0:00:00
B.R3 TELNET R2
R3#telnet 10.1.1.2
Trying 10.1.1.2 ...
% Connection timed out; remote host not responding
R3#
防火墙对应日志如下：
%ASA-7-609001: Built local-host inside:10.1.1.2
%ASA-7-609001: Built local-host inside:20.1.1.3
%ASA-6-106015: Deny TCP (no connection) from 10.1.1.2/23 to 20.1.1.3/21221 flags SYN ACK on interface inside
%ASA-7-609002: Teardown local-host inside:10.1.1.2 duration 0:00:00
%ASA-7-609002: Teardown local-host inside:20.1.1.3 duration 0:00:00
%ASA-7-609001: Built local-host inside:10.1.1.2
%ASA-7-609001: Built local-host inside:20.1.1.3
%ASA-6-106015: Deny TCP (no connection) from 10.1.1.2/23 to 20.1.1.3/21221 flags ACK on interface inside
%ASA-7-609002: Teardown local-host inside:10.1.1.2 duration 0:00:00
%ASA-7-609002: Teardown local-host inside:20.1.1.3 duration 0:00:00
%ASA-7-609001: Built local-host inside:10.1.1.2
%ASA-7-609001: Built local-host inside:20.1.1.3
%ASA-6-106015: Deny TCP (no connection) from 10.1.1.2/23 to 20.1.1.3/21221 flags SYN ACK on interface inside
%ASA-7-609002: Teardown local-host inside:10.1.1.2 duration 0:00:00
%ASA-7-609002: Teardown local-host inside:20.1.1.3 duration 0:00:00
C.分析不通的原因
①R2 TELNET R3
tcp三次握手，R2发出SYN包经过防火墙inside接口转发，送给R1，到达R3，
R3回复的SYN-ACK到达R1后，R1直接给了R2，
R2收到了SYN-ACK包后，回复ACK包，但是包送给了防火墙，防火墙更改ACK值后转给R1，最终到达R3并被其丢弃。
----------备注：在模拟器中抓包时发现奇怪的现象，R3回复的SYN-ACK包从R1的接口出来是ACK=1，但是到达R2后ACK=666538828,从而被R2拒绝。
②配置MPF:
ciscoasa(config)# access-list inside-inside permit ip object inside-network1 object insdie-network2
ciscoasa(config)# access-list inside-inside permit ip object inside-network2 object insdie-network1
ciscoasa(config)# class-map inside
ciscoasa(config-cmap)# match access-list inside-inside
ciscoasa(config)# policy-map inside
ciscoasa(config-pmap)# class inside
ciscoasa(config-pmap-c)# set connection random-sequence-number disable
③telnet出现了变化，出现open：
R2#telnet 20.1.1.3
Trying 20.1.1.3 ... Open
lll
lll
^C
^Z
^^^C^C^C^C^C^C
^^^^^^^^^^^
quit
[Connection to 20.1.1.3 closed by foreign host]
--------通过抓包发现三次握手成功建立，但是后续的会话无法双向进行，所以停留在连接状态，需要手工输入quit才会退出。
④.R3 TELNET R2
tcp三次握手，R3发出的SYN包到底R1后，R1直接给了R2，但是R2回复SYN-ACK包时给了防火墙，被防火墙丢弃，从而TCP三次握手无法建立。
7. 两种解决方式：
A.来回的数据包都不经过防火墙
R2上添加去往20.1.1.0的路由器走R1
R2(config)#ip route 20.1.1.0 255.255.255.0 10.1.1.1
----TELNET测试正常
R3# telnet 10.1.1.2
Trying 10.1.1.2 ... Open
User Access Verification
Password:
B.来回的数据包都经过防火墙
①R1设定策略路由,指定下一跳为防火墙接口
R1(config)#ip access-list extended inside
R1(config-ext-nacl)#permit ip any 10.1.1.0 0.0.0.255
R1(config-ext-nacl)#exit
R1(config)#route-map inside permit 10
R1(config-route-map)#match ip address inside
R1(config-route-map)#set ip next-hop 10.1.1.10
R1(config-route-map)#exit
R1(config)#interface f0/1
R1(config-if)#ip policy rout
R1(config-if)#ip policy route-map inside
R1(config-if)#exit
----TELNET测试正常
R2#telnet 20.1.1.3
Trying 20.1.1.3 ... Open
User Access Verification
Password:
R3#telnet 10.1.1.2
Trying 10.1.1.2 ... Open
User Access Verification
Password:
②R1上添加主机路由，指向防火墙
R1(config)#ip route 10.1.1.2 255.255.255.255 10.1.1.10
----TELNET测试正常
R3#telnet 10.1.1.2
Trying 10.1.1.2 ... Open
User Access Verification
Password:
③R1上设定101.1.2的mac地址为防火墙inside接口的mac地址
ASA# show interface e0
Interface Ethernet0 "inside", is up, line protocol is up
Hardware is i82559, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
MAC address 00ab.bffb.c400, MTU 1500
IP address 10.1.1.10, subnet mask 255.255.255.0
R1(config)#arp 10.1.1.2 00ab.bffb.c400 arpa
R2#telnet 20.1.1.3
Trying 20.1.1.3 ... Open
User Access Verification
Password:
8.总结：
A.ASA8.42 从同一接口进又从该接口出的流量不会撞击NAT,因此不需配置NAT免除
-----我的理解，因为object中配置NAT时已经指定了区域的原因，这是新NAT与传统NAT配置的优势，一个语句就搞定。
B.ASA8.3之后的NAT跟以前版本的NAT配置方式有很大的不同
本文转自 碧云天 51CTO博客，原文链接：http://blog.51cto.com/333234/859180，如需转载请自行联系原作者
