配置ASA的防火墙，测试有点问题

梦幻天崖

配置ASA的防火墙后，内网应该是能ping通外网的吧，可是pc机ping不通外网，防火墙又不能配置路由协议，外网倒是能ping通dmz，还有SSH的验证命令是怎样的（不是配置），真心求教

careline

静态出去写缺省，静态回包写汇总明细；
SECURITY-LEVEL高的可以访问SECURITY-LEVEL低的；

梦幻天崖

careline 发表于 2015-4-22 16:22
静态出去写缺省，静态回包写汇总明细；
SECURITY-LEVEL高的可以访问SECURITY-LEVEL低的；

我内网是100，外网为0，dmz为70，照理来说应该ping的通外网，我PCping10.2.2.2都ping不通，在所有的三层设备上我都配置了0.0.0.0 0.0.0.0 加下一跳ip，而且我的外网是能ping通dmz的。ASA配置：!


interface Vlan1
nameif inside
security-level 100
ip address 10.2.2.2 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 202.1.1.1 255.255.255.0
!
interface Vlan3
no forward interface Vlan1
nameif dmz
security-level 70
ip address 192.168.1.1 255.255.255.0
!
object network dmz-server
host 192.168.1.0
object network inside-net
subnet 10.0.0.0 255.0.0.0
!
route outside 0.0.0.0 0.0.0.0 202.1.1.2 1
route inside 0.0.0.0 0.0.0.0 10.2.2.1 1
route inside 0.0.0.0 0.0.0.0 10.2.2.3 1


access-list OUTSIDE-DMZ extended permit icmp any host 192.168.1.2
access-list OUTSIDE-DMZ extended permit tcp any host 192.168.1.2 eq www
!
!
access-group OUTSIDE-DMZ in interface outside
object network dmz-server
nat (dmz,outside) static 209.165.200.227
object network inside-net
nat (inside,outside) dynamic interface
!
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
!
!
username admin password 4IncP7vTjpaba2aF encrypted
!
class-map inspection_default
match default-inspection-traffic
!
policy-map global_policy
class inspection_default
  inspect icmp
!

梦幻天崖

careline 发表于 2015-4-22 16:22
静态出去写缺省，静态回包写汇总明细；
SECURITY-LEVEL高的可以访问SECURITY-LEVEL低的；

防火墙的回包写汇总明细怎么写