Cisco ASA 5512 Config 예제

Cisco VPN 장비인 ASA 5512 모델의 Configuration 예제입니다.

참고용으로 올립니다.

ASA OS Version : 8.0(4)

*. 참고로 8.2 버전 전후로 Config의 변화가 많습니다..(특히 NAT 관련)

ASA-MPLS# sh run

: Saved

:

ASA Version 8.0(4) 

!

hostname ASA-MPLS

enable password fA/Asjda/FNOQVx6 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

 nameif outside

 security-level 0

 ip address 10.10.31.191 255.255.255.0 

!

interface Ethernet0/1

 nameif inside

 security-level 100

 ip address 192.168.1.130 255.255.255.128 

!

interface Ethernet0/2

 nameif dmz

 security-level 50

 ip address 192.168.1.1 255.255.255.128 

!

interface Ethernet0/3

 shutdown     

 no nameif

 no security-level

 no ip address

!

interface Management0/0

 shutdown

 no nameif

 no security-level

 no ip address

!

ftp mode passive

clock timezone kst 9

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group network DM_INLINE_NETWORK_1

 network-object 192.168.1.128 255.255.255.128

 network-object 192.168.6.0 255.255.255.0

object-group network DM_INLINE_NETWORK_3

 network-object 192.168.1.128 255.255.255.128

 network-object 192.168.6.0 255.255.255.0

access-list outside_access_in extended permit ip host 10.10.54.43 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.54.44 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.54.45 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.54.46 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.48.20 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.48.21 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.155.19 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.155.20 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.20.54.19 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip host 10.10.31.250 host 10.10.31.191 

access-list outside_access_in extended permit ip host 10.10.75.250 192.168.1.0 255.255.255.128 

access-list outside_access_in extended permit ip any any 

access-list inside_access_in extended permit ip host 192.168.6.131 192.168.1.0 255.255.255.128 

access-list inside_access_in extended permit ip host 192.168.6.132 192.168.1.0 255.255.255.128 

access-list inside_access_in extended permit ip host 192.168.6.133 192.168.1.0 255.255.255.128 

access-list inside_access_in extended permit ip any any 

access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.128 object-group DM_INLINE_NETWORK_3 

access-list inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_1 192.168.1.0 255.255.255.128 

access-list dmz_access_in extended permit ip any any 

access-list guest_list standard permit 192.168.1.128 255.255.255.128 

access-list guest_list standard permit host 192.168.6.131 

access-list guest_list standard permit host 192.168.6.132 

access-list guest_list standard permit host 192.168.6.133 

pager lines 24

logging enable

logging timestamp

logging monitor warnings

logging trap warnings

logging asdm informational

logging host outside 10.10.31.250

mtu outside 1500

mtu inside 1500

mtu dmz 1500

ip local pool mpls_pool 192.168.1.201-192.168.1.250 mask 255.255.255.128

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-613.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

static (dmz,outside) 10.10.31.237 192.168.1.6 netmask 255.255.255.255 

static (dmz,outside) 10.10.31.238 192.168.1.5 netmask 255.255.255.255 

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

access-group dmz_access_in in interface dmz

route inside 0.0.0.0 0.0.0.0 192.168.1.129 1

route outside 10.20.0.0 255.252.0.0 10.10.31.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

aaa authentication http console LOCAL 

aaa authentication serial console LOCAL 

aaa authentication ssh console LOCAL 

aaa authentication telnet console LOCAL 

http server enable

http 0.0.0.0 0.0.0.0 inside

http 0.0.0.0 0.0.0.0 outside

snmp-server host inside 10.10.31.250 community string!! udp-port 161

snmp-server host outside 168.168..66.225 community string!! udp-port 161

no snmp-server location

no snmp-server contact

snmp-server community string!!

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 65535

 authentication pre-share

 encryption 3des

 hash sha

 group 2

 lifetime 86400

telnet 0.0.0.0 0.0.0.0 outside

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 5

console timeout 0

management-access inside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

group-policy guest_ipsec internal

group-policy guest_ipsec attributes

 vpn-tunnel-protocol IPSec l2tp-ipsec 

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value guest_list

 address-pools value mpls_pool

username kimjh008 password 8.iq6MiBUXOuHFbX encrypted

username kimjh008 attributes

 vpn-group-policy guest_ipsec

username admin password uoC0GnD71po8fYdF encrypted privilege 15

username semy002 password yNfhdeME0Q3c7yq/ encrypted

username semy002 attributes

 vpn-group-policy guest_ipsec

username ohmj006 password PO7lweRwSpC3prPp encrypted

username ohmj006 attributes

 vpn-group-policy guest_ipsec

username kangcg005 password DtsZvAdo6ALONeb4 encrypted

username kangcg005 attributes

 vpn-group-policy guest_ipsec

username cheons003 password fkva2VUc0TEjtFxh encrypted

username cheons003 attributes

 vpn-group-policy guest_ipsec

username jangih004 password wzsjpOzXEBQ45M31 encrypted

username jangih004 attributes

 vpn-group-policy guest_ipsec

username guest02 password sg4aNchAFQrQ7uH6 encrypted

username guest02 attributes

 vpn-group-policy guest_ipsec

username guest03 password 6Ugm4ITXWzpfcpl6 encrypted

username guest03 attributes

 vpn-group-policy guest_ipsec

username guest01 password K0w6HCu6x9FqzZDn encrypted

username guest01 attributes

 vpn-group-policy guest_ipsec

username songys001 password /ONgX5QKtwm0aH3J encrypted

username songys001 attributes

 vpn-group-policy guest_ipsec

username jeonch007 password crMUWikB2UELfcQJ encrypted

username jeonch007 attributes

 vpn-group-policy guest_ipsec

tunnel-group guest_ipsec type remote-access

tunnel-group guest_ipsec general-attributes

 address-pool mpls_pool

 default-group-policy guest_ipsec

tunnel-group guest_ipsec ipsec-attributes

 pre-shared-key *

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns migrated_dns_map_1

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns migrated_dns_map_1 

  inspect ftp 

  inspect h323 h225 

  inspect h323 ras 

  inspect netbios 

  inspect rsh 

  inspect rtsp 

  inspect skinny  

  inspect esmtp 

  inspect sqlnet 

  inspect sunrpc 

  inspect tftp 

  inspect sip  

  inspect xdmcp 

!

service-policy global_policy global

prompt hostname context 

: end