Tweet
Mình hiện có 1 con ASA 5520 đã cấu hình các dịch vụ, chạy rất ổn. Giờ mình đặt 1 Web server ở vùng DMZ để public cái website. Đã cấu hình NAT, access-list... nhưng hiện giờ chỉ có thể truy cập đến website này ở mạng trong, còn ở ngoài Internet thì không thể truy cập được (mình đã tạo Virtual server trên router TP-LINK TL-WR741ND để Public Web server rồi).
Đây là nội dung cấu hình của con ASA của mình :
Mong mọi người tìm ra nguyên nhân và hướng giải quyết giúp mình.
Trân trọng cảm ơn..
Đây là nội dung cấu hình của con ASA của mình :
Code:
ciscoasa# sh run : Saved ASA Version 8.0(4) hostname ciscoasa enable password .hQOPZWCbWEjkXvF encrypted passwd 2KFQnbNIdI.2KWOU encrypted names ! interface GigabitEthernet0/0 duplex full nameif LAN security-level 100 ip address 10.20.140.1 255.255.255.224 ospf cost 10 ! interface GigabitEthernet0/1 nameif INTERNET security-level 0 ip address 192.168.1.2 255.255.255.0 ospf cost 10 ! interface GigabitEthernet0/2 nameif Trungtam security-level 50 ip address 10.20.16.140 255.255.255.0 ospf cost 10 ! interface GigabitEthernet0/3 nameif Megawan security-level 60 ip address 10.20.141.2 255.255.255.248 ospf cost 10 ! interface Management0/0 nameif DMZ security-level 40 ip address 10.10.10.1 255.255.255.0 ospf cost 10 ! boot system disk0:/asa804-k8.bin boot config disk0:/flash no ftp mode passive clock timezone ICT 7 access-list INTERNET_access_out extended permit tcp any any eq www access-list INTERNET_access_out extended permit tcp any any eq domain access-list INTERNET_access_out extended permit udp any any eq domain access-list INTERNET_access_out extended permit tcp any any range ftp-data ftp access-list INTERNET_access_out extended permit tcp any any eq ftp-data access-list INTERNET_access_out extended permit tcp any any eq https access-list INTERNET_access_out extended permit tcp any any eq pop3 access-list INTERNET_access_out extended permit tcp any any eq smtp access-list INTERNET_access_out extended permit tcp any any eq 8080 access-list INTERNET_access_out extended permit udp any any eq isakmp access-list INTERNET_access_out extended permit udp any any eq 4500 access-list Trungtam_access_out extended permit tcp any any access-list Trungtam_access_out extended permit udp any any access-list Trungtam_access_in extended permit tcp any any eq domain access-list Trungtam_access_in extended permit udp any any eq domain access-list Trungtam_access_in extended permit tcp any any eq https access-list Trungtam_access_in extended permit tcp any any eq www access-list Trungtam_access_in extended permit tcp any any eq ldap access-list INTERNET_access_in extended permit tcp any host 192.168.1.5 eq www access-list split-tunnel standard permit 10.20.140.0 255.255.252.0 access-list Megawan_access_in extended permit tcp any any eq domain access-list Megawan_access_in extended permit udp any any eq domain access-list Megawan_access_in extended permit tcp any any eq www access-list Megawan_access_in extended permit tcp any any eq https access-list Megawan_access_in extended permit tcp any any eq pop3 access-list Megawan_access_in extended permit tcp any any eq smtp access-list Megawan_access_in extended permit tcp any any eq 3389 access-list Megawan_access_in extended permit tcp any any eq 8080 access-list Megawan_access_out extended permit tcp any any access-list Megawan_access_out extended permit udp any any access-list nonat remark Use for SlipTunnel access-list nonat extended permit ip 10.20.140.0 255.255.252.0 192.168.10.0 255.255.255.0 access-list nonat remark Use for SlipTunnel access-list nonat extended permit ip 192.168.10.0 255.255.255.0 10.20.140.0 255 .255.252.0 access-list Trungtam_access_in_1 extended permit tcp any any eq domain access-list Trungtam_access_in_1 extended permit tcp any any eq www access-list Trungtam_access_in_1 extended permit tcp any any eq https access-list Trungtam_access_in_1 extended permit tcp any any eq ftp access-list Trungtam_access_in_1 extended permit tcp any any eq ftp-data access-list Trungtam_access_in_1 extended permit tcp any any eq telnet access-list Trungtam_access_in_1 extended permit udp any any eq domain access-list Trungtam_access_in_1 extended permit tcp any any eq ldap access-list POLICY extended permit tcp any host 192.168.1.5 eq www access-list ACCESS_DMZ extended permit ip 10.20.140.0 255.255.252.0 host 10.10.10.5 pager lines 24 logging asdm informational mtu LAN 1500 mtu INTERNET 1500 mtu Trungtam 1500 mtu Megawan 1500 mtu DMZ 1500 ip local pool vpnpool 192.168.10.1-192.168.10.30 mask 255.255.255.224 ip audit attack action alarm drop no failover icmp unreachable rate-limit 10 burst-size 5 asdm image disk0:/asdm-641.bin no asdm history enable arp timeout 14400 global (LAN) 1 interface global (INTERNET) 1 interface nat (LAN) 0 access-list ACCESS_DMZ nat (LAN) 1 10.20.140.0 255.255.252.0 nat (DMZ) 1 10.10.10.0 255.255.255.0 static (DMZ,INTERNET) tcp 192.168.1.5 www 10.10.10.5 www netmask 255.255.255.255 static (LAN,Trungtam) 10.20.140.0 10.20.140.0 netmask 255.255.252.0 static (LAN,Megawan) 10.20.140.0 10.20.140.0 netmask 255.255.252.0 access-group POLICY in interface INTERNET access-group INTERNET_access_out out interface INTERNET access-group Trungtam_access_in_1 in interface Trungtam access-group Trungtam_access_out out interface Trungtam access-group Megawan_access_in in interface Megawan access-group Megawan_access_out out interface Megawan route INTERNET 0.0.0.0 0.0.0.0 192.168.1.1 1 route Trungtam 10.20.0.0 255.255.0.0 10.20.16.54 1 route LAN 10.20.140.0 255.255.252.0 10.20.140.5 1 route Megawan 10.20.142.0 255.255.255.0 10.20.141.1 1 route Megawan 10.20.143.0 255.255.255.0 10.20.141.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy aaa local authentication attempts max-fail 16 http server enable http 10.20.140.0 255.255.252.0 LAN sysopt noproxyarp LAN sysopt noproxyarp INTERNET sysopt noproxyarp Trungtam sysopt noproxyarp Megawan sysopt noproxyarp DMZ crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map INTERNET_dyn_map 20 set security-association lifetime seconds 28800 crypto dynamic-map INTERNET_dyn_map 20 set security-association lifetime kilobytes 4608000 crypto dynamic-map LAN_dyn_map 20 set security-association lifetime seconds 28800 crypto dynamic-map LAN_dyn_map 20 set security-association lifetime kilobytes 4608000 crypto map LAN_map 65535 set security-association lifetime seconds 28800 crypto map LAN_map 65535 set security-association lifetime kilobytes 4608000 crypto map INTERNET_map 65535 set security-association lifetime seconds 28800 crypto map INTERNET_map 65535 set security-association lifetime kilobytes 4608000 crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 no crypto isakmp nat-traversal telnet 10.20.140.0 255.255.252.0 LAN telnet timeout 5 ssh timeout 5 console timeout 0 no threat-detection basic-threat no threat-detection statistics access-list no threat-detection statistics tcp-intercept tftp-server LAN 10.20.140.10 \TFTPRoot webvpn enable INTERNET svc image disk0:/anyconnect-win-2.3.2016-k9.pkg 1 svc enable tunnel-group-list enable group-policy sslvpn internal group-policy sslvpn attributes dns-server value 10.20.140.11 10.20.140.13 vpn-tunnel-protocol l2tp-ipsec svc split-tunnel-policy tunnelspecified split-tunnel-network-list value split-tunnel default-domain value q4.tphcm.egov.vn address-pools value VpnPool webvpn svc keep-installer installed svc rekey time 30 svc rekey method ssl svc ask none default svc group-policy DfltGrpPolicy attributes vpn-tunnel-protocol l2tp-ipsec group-policy vpngroup internal group-policy vpngroup attributes dns-server value 10.20.140.11 10.20.140.13 vpn-tunnel-protocol IPSec split-tunnel-policy tunnelspecified split-tunnel-network-list value split-tunnel default-domain value abc.vn username uservpn password XCzoAZkRET0tLOg9 encrypted tunnel-group DefaultRAGroup ipsec-attributes pre-shared-key * tunnel-group sslvpn type remote-access tunnel-group sslvpn general-attributes address-pool vpnpool default-group-policy sslvpn tunnel-group sslvpn webvpn-attributes group-alias SSLVPNClient enable tunnel-group vpngroup type remote-access tunnel-group vpngroup general-attributes address-pool vpnpool default-group-policy vpngroup tunnel-group vpngroup ipsec-attributes pre-shared-key * ! class-map class_default match any class-map inspection_default match default-inspection-traffic ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect pptp inspect icmp inspect esmtp inspect http class class-default set connection decrement-ttl ! service-policy global_policy global prompt hostname context Cryptochecksum:573ead4b759bc6f5c3bf47733681e913 : end
Trân trọng cảm ơn..
Comment