思科ASA5520

yihuiwei_2008

公司 双线接入   内有一个rtx服务器 ，目前rtx服务器是在防火墙之前，本来处于
安全考虑，想把rtx挪到防火墙后  并在防火墙里面开通所需要的端口
但是出现问题了，移动到防火墙后，外网联通的可以正常访问，电信的网，访问不了rtx

一下是拓扑和配置  求大神帮忙：


SA Version 7.2(4)
!
firewall transparent
hostname lw-cisco
domain-name default.domain.invalid
enable password Mu/xZbMDPxkMQLaS encrypted
passwd /EEWWAnhRQzSxZxY encrypted
names
!
interface GigabitEthernet0/0
nameif outside
security-level 0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
!
interface Management0/0
no nameif
no security-level
ip address 192.168.20.1 255.255.255.0
management-only
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
object-group service outservice tcp
description outser_tcp
port-object eq www
port-object eq ftp
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8000
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8003
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8009
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8880
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8010
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8013
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8025
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8023
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8006
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 9001

access-list deny211 standard deny 211.101.0.0 255.255.0.0
access-list deny211 standard deny 111.196.0.0 255.255.0.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address 192.168.1.30 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/ASDM-524.BIN
no asdm history enable
arp timeout 14400
access-group out-to-in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat
0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect
0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.168.0.0 255.255.0.0 inside
telnet timeout 10
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
ssh version 1
console timeout 0
username cisco password Yluyx4xy8wDnUR92 encrypted
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:9acb81b2d972a32d68ae5825867d195b
: end
lw-cisco#

李壑彝

你这个就是一台透明防火墙哈，看看路由器的上的配置吧，问题应该在路由器上面

李壑彝

李壑彝

zhurx

这是透明模式的防火墙配置，访问流量受security level 的影响，Inbound 流量需要acl明确放行，outbond 流量默认放行。 （关键配置命令如下）
interface GigabitEthernet0/0
nameif outside
security-level 0
!
interface GigabitEthernet0/1
nameif inside
security-level 100

access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8000
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8003
access-list out-to-in extended permit tcp any host 192.168.1.7 eq 8009
............
............
access-group out-to-in in interface outside

----对于你先前的RTX放置接口端
如果你的配置没改过，acl 有效应用于inbound流量的话，你的RTX服务器应该接在asa5520 Gi0/1 端。
如果你的RTX服务器放在asa5520 Gi0/0 端， acl 即使配置了，access group 也应用在接口了，但是acl也没起作用，默认outbound 流量asa5520会放行。

你最好将asa5520的接口在topo上标注出来，我们会更清晰，再多说会更糊涂。

yihuiwei_2008

李壑彝 发表于 2017-7-7 11:59
你这个就是一台透明防火墙哈，看看路由器的上的配置吧，问题应该在路由器上面

在防火墙前面 没有一点问题联通电信都能上，放在防火墙后面就联通的能上  电信就不行，不是防火墙的事吗？如果是路由器的问题，哪是路由器的哪些配置有可能出错呢？