6.3 思科ASA：访问规则：区域间的访问规则Access rules

6.3  思科ASA：访问规则：区域间的访问规则Access rules

需求：允许a区域192.168.1.0/24访问dmz区域192.168.2.200的80端口和8080端口

（1）拓扑图

（2）配置访问规则

配置规则前：

配置访问规则：

配置目标地址

配置服务

命令行配置：

object-group service DM_INLINE_TCP_1 tcp

     group-object TCP8080

     port-object eq www

access-list a_access_in extended permit tcp 192.168.1.0 255.255.255.0 object host-192.168.2.200 object-group DM_INLINE_TCP_1

access-group a_access_in in interface a

（3）测试：PC1已经可以访问了192.168.2.200的8080端口，但是ping不通，ping不通是正常的，因为没有允许icmp的流量。

ciscoasa# show conn  查看防火墙会话

6 in use, 11 most used

TCP dmz  192.168.2.200:8080 a  192.168.1.100:1071, idle 0:00:11, bytes 1, flags UIB

TCP dmz  192.168.2.200:8080 a  192.168.1.100:1069, idle 0:00:11, bytes 1, flags UIB

TCP dmz  192.168.2.200:8080 a  192.168.1.100:1072, idle 0:00:12, bytes 1, flags UIB

TCP dmz  192.168.2.200:8080 a  192.168.1.100:1070, idle 0:00:12, bytes 1, flags UIB

TCP dmz  192.168.2.200:8080 a  192.168.1.100:1068, idle 0:00:11, bytes 8355, flags UIOB

TCP dmz  192.168.2.200:8080 a  192.168.1.100:1074, idle 0:00:08, bytes 46291, flags UIOB

ciscoasa#

思科Cisco ASA防火墙（列表、list、全）asalist、防火墙list
http://www.zh-cjh.com/wenzhangguilei/2594.html
文章归类、所有文章列表、LISTLIST
http://www.zh-cjh.com/wangzhangonggao/2195.html