防火墙基础小实验（1）

实

验任务 实验需求：配置路由器和ASA的接口，实现网络互通配置路由验证R1可以 Telnet到R2和R3，R3可以Telnet到R2但是不能Telnet R1，R2不能Telnet到R1和R3使用命令show conn detail 查看Conn表分别查看ASA和RR的路由表配置ACL禁止在R3上Telnet 到R2实验拓扑：

思

路及实验步骤 第一步：配置ASA防火墙对应端口的IP并设置端口名与优先级enabletedu.cnconfiguration terminalhostname ASA enable password 123passwd 123 （远程密码）clear configure allinterface gigabitEthernet 0nameif inside (端口名内部)security-level 100 （优先级最高）no shutdownip address 10.1.1.254 255.255.255.0exitinterface gigabitEthernet 1nameif outside(端口名外部)security-level 0（优先级最低）no shutdownip address 172.16.1.254 255.255.255.0exitinterface gigabitEthernet 2nameif dmz(端口名隔离区)security-level 50（优先级比outside要高比inside的要低）no shutdownip address 192.168.1.254 255.255.255.0exit

第二步：配置R1 R3 R2 各对应端口的IP地址关闭路由关闭 RR配置

对应端口的IP地址开启路由功能，并验证网络是否互通R1：enableconfiguration terminalhostname R1interface fastEthernet 0/0no shutdownip address 10.1.1.1 255.255.255.0exitno ip routing （关闭路由功能）ip default-gateway 10.1.1.254（设置网关）endping 10.1.1.254 (验证到网关是否互通)

R3：

enableconfiguration terminalhostname R3interface fastEthernet 0/0no shutdownip address 192.168.1.1 255.255.255.0exitno ip routing （关闭路由功能）ip default-gateway 192.168.1.254（设置网关）endping 192.168.1.254 (验证到网关是否互通)

RR：

enableconfiguration terminal hostname RRip routing （开启路由功能）interface fastEthernet 0/0no shutdownip address 4.4.4.254 255.255.255.0exitinterface fastEthernet 1/0no shutdownip address 172.16.1.1 255.255.255.0endping 172.16.1.254 （验证到网关是否互通)

R2：

enableconfiguration terminalhostname R2interface fastEthernet 0/0no shutdownip address 4.4.4.1 255.255.255.0exitno ip routing （关闭路由功能）ip default-gateway 4.4.4.254（设置网关）endping 4.4.4.254 (验证到网关是否互通)

第三步：

（1）因为ASA上没有4.4.4.0 的路由，因此要添加一个默认路由route outside 0.0.0.0 0.0.0.0 172.16.1.1 （按流量走向配置 指定端口为outside）（2）因为RR上没有R1的路由，因此要添加一个more路由ip route 0.0.0.0 0.0.0.0 172.16.1.254

第四步：在R1 R2 R3 配置远程功能及密码

R1：

enableconfiguration terminalenable password 123line vty 0 password 123end

R2：

enableconfiguration terminalenable password 123line vty 0 password 123end

R3：

enableconfiguration terminalenable password 123line vty 0 password 123end

第五步：验证在R1上远程R2 R3 ，R3远程R1 R2 ，R2远程R1 R3

R1：telnet 4.4.4.1 Trying 4.4.4.1 ... Open

User Access Verification

Password:

R2>exit

telnet 192.168.1.1

Trying 192.168.1.1 ... Open

User Access Verification

Password:

R3>exit

R2：

telnet 10.1.1.1Connection timed out; remote host not responding（连接 超时;远程主机没有响应）【因为接口的安全级别高的可以访问低的 而低级别的不可以访问高级别的】telnet 192.168.1.1Connection timed out; remote host not responding（连接 超时;远程主机没有响应）

R3：

telnet 4.4.4.1 Trying 4.4.4.1 ... Open

User Access Verification

Password:

R2>exit

telnet 10.1.1.1

Connection timed out; remote host not responding（连接 超时;远程主机没有响应）

第五步：因为ASA防火墙在流量访问时先看conn表然后再看acl表然

后再看优先级所以需要配置ACL禁止R3远程访问R2在ASA上配置enableconfiguration terminalaccess-list 333 deny tcp host 192.168.1.1 host 4.4.4.1 eq telnet （拒绝192.168.1.1远程访问4.4.4.1）access-group 333 in interface dmz（配置在对应的接口）

结

果验证 验证与测试第一步：在R3远程R2R3：telnet 4.4.4.1 Connection refused by remote host（拒绝由远程主机连接）

第二步在R1远程R2时，在ASA查看conn表

show conn detail

1 in use, 1 most used

Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,B - initial SYN from outside, b - TCP state- bypass or nailed, C - CTIQBE media,D - DNS, d - dump, E - outside back connection, F

• outside FIN, f - inside FIN,
  G - group, g - MGCP, H - H.323, h - H.225.0, I -
  inbound data,
  i - incomplete, J - GTP, j - GTP data, K - GTP
  t3-response
  k - Skinny media, M - SMTP data, m - SIP media, n
• GUP
  O - outbound data, P - inside back connection, p
• Phone-proxy TFTP connection,
  q - SQL*Net data, R - outside acknowledged FIN,
  R - UDP SUNRPC, r - inside acknowledged FIN, S -
  awaiting inside SYN,
  s - awaiting outside SYN, T - SIP, t - SIP
  transient, U - up,
  V - ××× orphan, W - WAAS,
  X - inspected by service module
  TCP outside:4.4.4.1/23 inside:10.1.1.1/46179,
  flags UIO, idle 2s, uptime 2s, timeout 1h0m, bytes
  90

第三步在ASA与RR上查看路由表

ASA路由表：show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M -

mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level- 2, ia - IS-IS inter area

• • candidate default, U - per-user static route,
    o - ODR
    P - periodic downloaded static route

Gateway of last resort is 172.16.1.1 to network 0.0.0.0

C 172.16.1.0 255.255.255.0 is directly connected,

outsideC 10.1.1.0 255.255.255.0 is directly connected, insideC 192.168.1.0 255.255.255.0 is directly connected, dmzS* 0.0.0.0 0.0.0.0 [1/0] via 172.16.1.1, outside

在RR上查看路由表

show ip routeCodes: C - connected, S - static, R - RIP, M - mobile, B

• BGP
  D - EIGRP, EX - EIGRP external, O - OSPF, IA -
  OSPF inter area
  N1 - OSPF NSSA external type 1, N2 - OSPF NSSA
  external type 2
  E1 - OSPF external type 1, E2 - OSPF external
  type 2
  i - IS-IS, su - IS-IS summary, L1 - IS-IS level-
  1, L2 - IS-IS level-2
  ia - IS-IS inter area, * - candidate default, U -
  per-user static route
  o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.16.1.254 to network

0.0.0.0

4.0.0.0/24 is subnetted, 1 subnets

C 4.4.4.0 is directly connected, FastEthernet0/0

172.16.0.0/24 is subnetted, 1 subnetsC 172.16.1.0 is directly connected, FastEthernet1/0S* 0.0.0.0/0 [1/0] via 172.16.1.254

问

题及分析 ICMP在默认情况下是不能允许通过的优先级小的不能直接访问优先级大的ASA先检查conn表再检查acl表再检查优先级