Thay va cac ban xem giup minh nhe

[matloi]

Minh dang thu mo hinh Lab nhu sau:
Internet --> Router 2811--> ASA5510-->Core3750 (co 2 vlan 10 va 20)
Nhu cau:

- Cau hinh cho cac user o 2 vlan 10 va 20 cua Core switch co the di ra ngoai internet
Minh da cau hinh roi nhung khong chay minh gui file cau hinh dinh kem mong cac mang chi dan nhe
Thanks

[phamminhtuan]

Chào bạn,

Trên con ASA mình thấy bạn cấu hình NAT sai lớp mạng.


############Trên switch 3750
interface Vlan10
ip address 192.168.10.254 255.255.255.0
interface Vlan20
ip address 192.168.20.254 255.255.255.0


############Trên ASA lại nat cho lớp mạng 192.168.0.0/24 và 192.168.1.0/24
nat (inside) 1 192.168.0.0 255.255.255.0

nat (inside) 1 192.168.1.0 255.255.255.0


Cách giải quyết:
Trên ASA bạn bỏ 2 câu NAT sai đi, thế lại bằng 2 câu
nat (inside) 1 192.168.10.0 255.255.255.0

nat (inside) 1 192.168.20.0 255.255.255.0

Ngoài ra:
+ Trên switch 3750 gõ thêm câu lệnh "ip routing"

+ Trên PC của mỗi vlan trỏ default-gateway về IP của interface vlan tương ứng.

[matloi]

Chao ban logmeinvietnam ban xem giup minh file cau hinh da sua nhung chua chay

Minh da lam theo ban chu dan nhung khong biet con xot phan nao khong nhi:
1. Gateway:
sho run

interface FastEthernet0/0
ip address 192.168.2.2 255.255.255.0
ip nat inside
duplex auto
speed auto

interface FastEthernet0/1
ip address dhcp
ip nat outside
duplex auto
speed auto

ip classless
ip route 192.168.1.0 255.255.255.0 192.168.2.1
ip route 192.168.10.0 255.255.255.0 192.168.1.2

ip http server
ip nat inside source list 1 interface FastEthernet0/1 overload

access-list 1 permit 192.168.2.0 0.0.0.255
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.10.0 0.0.0.255


2. ASA_FW
SHO RUN

: Saved

:

ASA Version 7.1(2) hostname ASA-FW
interface Ethernet0/0

nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0

interface Ethernet0/1

nameif outside security-level 0 ip address 192.168.2.1 255.255.255.0
access-list PING extended permit icmp any any echo-reply
access-group PING in interface outside
global (outside) 1 interface
nat (inside) 1 192.168.10.0 255.255.255.0
nat (inside) 1 192.168.20.0 255.255.255.0

access-group PING in interface outside


route outside 0.0.0.0 0.0.0.0 192.168.2.2 1


ASA-FW#

3. Core

Building configuration...


!ip routing

interface GigabitEthernet2/0/1
no switchport
ip address 192.168.1.2 255.255.255.0
no shut


interface GigabitEthernet2/0/9
switchport access vlan 10
spanning-tree portfast

-

interface Vlan1
no ip address
shutdown
interface Vlan10
ip address 192.168.10.254 255.255.255.0

interface Vlan20
ip address 192.168.20.254 255.255.255.0

ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip http server
ip http secure-server

CORE#