2019/6/25 - - -
此文章是关于配置防火墙的子接口配置初始化状态的一个实验
实验拓扑
实验环境
此前已有ASA相关配置的文章 —> 《ASA的配置》
关于防火墙初始化的文章—> 《初始化状态配置》
实验配置
因为之前有对此文章的介绍，这里直接上配置，可以修改完部分地址与接口后，直接刷进去。
路由与交换所做的优化配置
enable
configure terminal
line console 0
logging synchronous
exec-timeout 0 0
exit
no ip domain-lookup
line vty 0 4
no login
transport input all
exit
交换机的配置
vlan 2
name inside
exit
vlan 3
name DMZ
exit
vlan 6
name outside
exit
interface e0/0
switchport mode access
switchport access vlan 2
exit
interface e0/1
switchport mode access
switchport access vlan 3
exit
interface e0/2
switchport mode access
switchport access vlan 6
exit
interface e1/0
switchport mode access
switchport access vlan 6
exit
do show vlan
interface e0/3
switchport trunk allowed vlan 2,3,6
switchport mode trunk
switchport trunk encapsulation dot1q
exit
do show interface trunk
路由器的配置
inside 配置
hostname inside01
interface e0/0
ip add 192.168.20.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.20.1
do show ip int br
do show ip route
DMZ 配置
hostname DMZ01
interface e0/0
ip add 172.16.30.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 172.16.30.1
do show ip int br
do show ip route
outside 配置
hostname outside01
interface e0/0
ip add 200.6.6.100 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 200.6.6.1
do show ip int br
do show ip route
防火墙ASA上的配置
interface g0/1
nameif outside
security-level 0
ip add 200.6.6.1 255.255.255.0
no shutdown
exit
interface g0/0
no shutdown
exit
interface g0/0.2
vlan 2
nameif inside
ip add 192.168.20.1 255.255.255.0
no shutdown
exit
interface g0/0.3
vlan 3
nameif dmz
security-level 50
ip add 172.16.30.1 255.255.255.0
no shutdown
exit
exit
show nameif
show route
测试
inside：
telnet 200.6.6.100
telnet 172.16.30.100
DMZ：
telnet 200.6.6.100
可以远程到对方，说明成功
OK，有什么问题，欢迎评论交流O(∩_∩)O~