Cisco ASA5506-X Switchport 사용 방법

 

 

 

Cisco asa 5505 의 경우 SOHO 용으로 나와서 L2스위치 기능까지 가지고 있었죠.

그런데, 후속 모델이라고 내놓은 5506-X 에서 Switchport 기능을 지원하지 않아 많은 사람들이 적잖이 실망을 했나 봅니다.

 

그래서 Cisco 에서는 ASA OS 9.7(1) 부터 Bridge-Group 이라는 명령을 통해 해당 기능을 구현했네요.

일반적으로 ASA 장비에서 내부 Network 연결을 위해 inside Network 를 여러 물리적 포트에 적용하기 위한 방법이구요.

 

출처는 아래 URL 의 Release Note 를 참고하시면 됩니다.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/interface-routed-tfw.html 

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.7 - Routed and Transparent Mode Interfaces [Cisco AS

 

 

해당 URL 의 하단 부분으로 내려보시면 아래와 같이 예제 Config 를 확인 할 수 있습니다.

 

interface gigabitethernet 1/1
  nameif outside
  security-level 0
  ip address dhcp setroute
  no shutdown
!
interface gigabitethernet 1/2
  nameif inside1
  security-level 100
  bridge-group 1
  no shutdown
interface gigabitethernet 1/3
  nameif inside2
  security-level 100
  bridge-group 1
  no shutdown
interface gigabitethernet 1/4
  nameif inside3
  security-level 100
  bridge-group 1
  no shutdown
!
interface bvi 1
  nameif inside
  security-level 100
  ip address 10.10.10.1 255.255.255.0
!
interface gigabitethernet 1/5
  nameif dmz1
  security-level 100
  bridge-group 2
  no shutdown
interface gigabitethernet 1/6
  nameif dmz2
  security-level 100
  bridge-group 2
  no shutdown
interface gigabitethernet 1/7
  nameif dmz3
  security-level 100
  bridge-group 2
  no shutdown
!
interface bvi 2
  nameif dmz
  security-level 50
  ip address 209.165.201.1 255.255.255.224
!
same-security-traffic permit inter-interface
!
# Assigns IP addresses to inside hosts
dhcpd address 10.10.10.2-10.10.10.200 inside
dhcpd enable inside
!
# Applies interface PAT for inside traffic going outside
nat (inside1,outside) source dynamic any interface
nat (inside2,outside) source dynamic any interface
nat (inside3,outside) source dynamic any interface 
!
# Allows outside traffic to each server for specific applications
object network server1
  host 209.165.201.2
object network server2
  host 209.165.201.3
object network server3
  host 209.165.201.4
!
# Defines mail services allowed on server3
object-group service MAIL
  service-object tcp destination eq pop3
  service-object tcp destination eq imap4
  service-object tcp destination eq smtp
!
# Allows access from outside to servers on the DMZ
access-list SERVERS extended permit tcp any object server1 eq www
access-list SERVERS extended permit tcp any object server2 eq ftp
access-list SERVERS extended permit tcp any object server3 object-group MAIL 
access-group SERVERS in interface outside