SNAF 642-524 - Versionshistorie

Freesoft: /* Configure and verify NAT globals, statics, NAT exemption, and Identity NAT using ASDM */

2011-09-02T20:14:33Z

‎Configure and verify NAT globals, statics, NAT exemption, and Identity NAT using ASDM

2011-09-02T20:12:35Z

‎Configure and verify NAT globals, statics, NAT exemption, and Identity NAT using ASDM

2010-06-14T10:51:27Z

‎ASA Links

2010-06-10T10:15:45Z

‎Configure and verify remote access VPNs using ASDM

2010-06-10T07:19:07Z

‎Configure and verify Layer 3 and Layer 4 protocol inspection using ASDM

2010-06-10T07:10:57Z

‎Configure and verify NAT globals, statics, NAT exemption, and Identity NAT using ASDM

2010-06-10T06:54:02Z

‎Configure and verify NAT globals, statics, NAT exemption, and Identity NAT using ASDM

2010-06-10T06:51:06Z

‎Configure and verify NAT globals, statics, NAT exemption, and Identity NAT using ASDM

2010-06-10T06:50:46Z

‎Diverse

2010-06-10T06:49:23Z

‎Configure and verify the virtual firewall feature of the Security Appliance using ASDM

@@ Linje 92: / Linje 92: @@
 Denne oversætter 192.168.1.20 på management til 10.10.10.10 på inside, så 10.10.10.10 server kan tilgås fra management via 192.168.1.20.
 Man kan altså fra management interface tilgå serveren med IP 10.10.10.10 på inside interface ved at skrive 192.168.1.20.
 '''Dynamisk NAT/PAT'''

←Ældre version		Versionen fra 2. sep 2011, 20:12
Linje 91:		Linje 91:

	Denne oversætter 192.168.1.20 på management til 10.10.10.10 på inside, så 10.10.10.10 server kan tilgås fra management via 192.168.1.20.		Denne oversætter 192.168.1.20 på management til 10.10.10.10 på inside, så 10.10.10.10 server kan tilgås fra management via 192.168.1.20.
		+	Man kan altså fra management interface tilgå serveren med IP 10.10.10.10 på inside interface ved at skrive 192.168.1.20.

	'''Dynamisk NAT/PAT'''		'''Dynamisk NAT/PAT'''

@@ Linje 932: / Linje 932: @@
 [http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/conf_gd.html ASA CLI Configuration Guide 8.0]
-https://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b1ee95.shtml
+[https://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b1ee95.shtml ASA 8.3(x) Dynamic PAT with Two Internal Networks and Internet]
 http://www.wr-mem.com/
@@ Linje 938: / Linje 938: @@
 http://www.wr-mem.com/?p=4
-http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml
+[http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml ASA/PIX 8.x: Block Certain Websites (URLs) Using Regular Expressions With MPF]
 https://supportforums.cisco.com/docs/DOC-1268
@@ Linje 963: / Linje 963: @@
 http://www.subnet-calculator.com/

←Ældre version		Versionen fra 10. jun 2010, 10:15
Linje 428:		Linje 428:

	Wizards -> IPsec VPN Wizard -> Remote Access		Wizards -> IPsec VPN Wizard -> Remote Access
		+
		+	"The Cisco Easy VPN client feature can be configured in one of two modes: client mode or network extension mode."

	Opsætning af remote VPN:		Opsætning af remote VPN:

@@ Linje 358: / Linje 358: @@
 Conf -> Firewall -> Service Policy Rules
+http://img813.imageshack.us/img813/3690/ftpstrict.png
-http://img203.imageshack.us/img203/8135/mpfprotocolinspect.png
 ==== Configure and verify Modular Policy Framework using ASDM ====

@@ Linje 104: / Linje 104: @@
 '''NAT exemption'''
-Skal ikke NAT'es
+Skal ikke NAT'es, virker både ind og ud.
-<pre>
+ (config)# access-list EXEMPT-NAT extended permit ip 10.10.1.0 255.255.255.0 172.16.10.0 255.255.255.0
-ciscoasa(config)# access-list NAT_EXEMPT extended permit ip 10.0.0.0 255.255.255.0 172.16.1.0 255.255.255.0
+ (config)# nat (inside) 0 access-list EXEMPT-NAT
-−
-ciscoasa(config)# nat (inside) 0 access-list NAT_EXEMPT
-</pre>
 '''Identity NAT'''
 Dynamic Identity NAT:
-Static Identity NAT:
+Kun forbindelser inde fra og ud bliver oversat.
-Assuming the ACL allows it, connections from the inside or outside can use this translation.
-  ciscoasa(config)# static (inside,outside) 10.0.0.0 10.0.0.0 netmask 255.255.255.0
+  (config)# nat (inside) 0 10.10.1.0 255.255.255.0
 '''NAT rækkefølge:'''

←Ældre version		Versionen fra 10. jun 2010, 06:54
Linje 101:		Linje 101:

	http://img824.imageshack.us/img824/5731/natconnsettings.png		http://img824.imageshack.us/img824/5731/natconnsettings.png
		+
		+	'''NAT exemption'''
		+
		+	Skal ikke NAT'es
		+
		+	<pre>
		+	ciscoasa(config)# access-list NAT_EXEMPT extended permit ip 10.0.0.0 255.255.255.0 172.16.1.0 255.255.255.0
		+
		+	ciscoasa(config)# nat (inside) 0 access-list NAT_EXEMPT
		+	</pre>
		+
		+	'''Identity NAT'''
		+
		+	Dynamic Identity NAT:
		+	Only connections from the inside to elsewhere are translated.
		+
		+	ciscoasa(config)# nat (inside) 0 10.0.0.0 255.255.255.0
		+
		+	Static Identity NAT:
		+	Assuming the ACL allows it, connections from the inside or outside can use this translation.
		+
		+	ciscoasa(config)# static (inside,outside) 10.0.0.0 10.0.0.0 netmask 255.255.255.0

	'''NAT rækkefølge:'''		'''NAT rækkefølge:'''

@@ Linje 111: / Linje 111: @@
 *7. regular dynamic NAT
 *8. If NAT control enabled, and no match through above, drop packet.
 ==== Configure and verify access-lists with or without object groups using ASDM ====

←Ældre version		Versionen fra 10. jun 2010, 06:50
Linje 893:		Linje 893:

	The SAST keys can be seen via the ''show crypto key mypubkey rsa'' command.		The SAST keys can be seen via the ''show crypto key mypubkey rsa'' command.
−
−	"
−	Note: If you remove a static command, current connections that use the translation are not affected. In order to remove these connections, enter the clear local-host command. You cannot clear static translations from the translation table with the clear xlate command; you must remove the static command instead. Only dynamic translations created by the nat and global commands can be removed with the clear xlate command.
−	"
−
−	"
−	~~NOTE If you don’t configure the nat-control command, then address translation is optional.~~
−	~~The appliance will use any address translation policies you’ve configured, and if a packet doesn’t~~
−	~~match a translation policy, it isn’t translated, but forwarded as is.~~
−	"

	=== ASA Links ===		=== ASA Links ===

@@ Linje 764: / Linje 764: @@
 For at klassificere pakker til forskellige contexts bruger ASAen:
 *Unikke interfaces, hver context egen interface
-*MAC adresser, samme interface, forskellig MAC pr. context
+*MAC adresser, samme interface, forskellig MAC pr. context (som en switch)
 *NAT opsætning (IP adresse), kigger i dest IP, må kende subnets bagved.
-Hvis du ikke har unikke interfaces til hver context anbefales det ar bruge MAC.
+Hvis du ikke har unikke interfaces til hver context anbefales det at bruge MAC adr.
 *Routed mode tillader delte interfaces.