Sơ đồ:

Lưu ý: Sử dụng Cisco ASA chạy trên VMWare kết hợp Router chạy trên Cisco IOU hoặc GNS3.

Mô tả:

• Thực hiện xác thực cho tất cả các dịch vụ hoạt động trên TCP cho các PC thuộc mạng 192.168.1.0/24. Dùng local database để thực hiện xác thực.

• Những dịch vụ cho phép thực hiện xác thực:

  • HTTP (80)

  • HTTPS (443)

  • FTP (21)

  • TELNET (23)

Cấu hình:

Xác định luồng dữ liệu sẽ được xác thực, những luồng dữ liệu được cho phép trong ACL sẽ được xác thực:

FW-ASA-DTU(config)# access-list AUTHEN permit tcp 192.168.1.0 255.255.255.0 any

Lưu ý: Trong trường hợp ACL là permit ip hoặc permit udp, thì những dịch vụ yêu cầu sự phân giải qua DNS sẽ không hoạt động được, do đó cần thực hiện deny đối với dịch vụ DNS.

Cho phép echo-reply trở về:

FW-ASA-DTU(config)# access-list PING permit icmp any 192.168.1.0 255.255.255.0 echo-reply

FW-ASA-DTU(config)# access-group PING in interface outside

Tắt tính năng NAT (tùy chọn):

FW-ASA-DTU(config)# no nat-control

Định nghĩa local database:

FW-ASA-DTU(config)# username dtu password dtu@123

Kích hoạt khả năng Cut-through proxy cho tất cả các luồng dữ liệu xuất phát từ cổng inside mà so trùng với ACL:

FW-ASA-DTU(config)# aaa authentication match AUTHEN inside local

Cấu hình đầy đủ:

FW-ASA-DTU

FW-ASA-DTU# sh run

: Saved

:

: Serial Number: 9ABBHQ1E2G6

: Hardware: ASAv, 2048 MB RAM, CPU Xeon 5500 series 2394 MHz

:

ASA Version 9.2(1)

!

hostname FW-ASA-DTU

enable password hAPB9Mw30flcY4kz encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

passwd r/GApwtPETElZ6aH encrypted

names

!

interface GigabitEthernet0/0

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface GigabitEthernet0/2

nameif outside

security-level 0

ip address 192.168.2.1 255.255.255.0

!

interface Management0/0

management-only

nameif quanly

security-level 100

ip address 192.168.20.100 255.255.255.0

!

ftp mode passive

access-list AUTHEN extended permit tcp 192.168.1.0 255.255.255.0 any

access-list PING extended permit icmp any 192.168.1.0 255.255.255.0 echo-reply

pager lines 23

mtu quanly 1500

mtu inside 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

access-group PING in interface outside

route outside 0.0.0.0 0.0.0.0 192.168.2.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication match AUTHEN inside LOCAL

no snmp-server location

no snmp-server contact

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet 192.168.20.0 255.255.255.0 quanly

telnet timeout 5

ssh stricthostkeycheck

ssh 192.168.20.0 255.255.255.0 quanly

ssh timeout 5

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username dtu password 91ezoD62XNiM5vaU encrypted

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 2

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCES

ervice

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly 1

subscribe-to-alert-group configuration periodic monthly 1

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f97ea56c9c447cedac25fd3d4e8cf00f

: end

FW-ASA-DTU#

GATEWAY

GATEWAY#sh run

Building configuration...

Current configuration : 1579 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname GATEWAY

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

no ip icmp rate-limit unreachable

ip cef

!

!

!

!

no ip domain lookup

ip auth-proxy max-nodata-conns 3

ip admission max-nodata-conns 3

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

ip tcp synwait-time 5

!

!

!

!

!

interface FastEthernet0/0

ip address 192.168.2.2 255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

interface Serial0/0

no ip address

shutdown

clock rate 2000000

!

interface FastEthernet0/1

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

interface Serial0/1

no ip address

shutdown

clock rate 2000000

!

interface Serial1/0

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/1

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/2

no ip address

shutdown

serial restart-delay 0

!

interface Serial1/3

no ip address

shutdown

serial restart-delay 0

!

ip forward-protocol nd

ip route 192.168.1.0 255.255.255.0 192.168.2.1

!

!

no ip http server

no ip http secure-server

ip nat inside source list 1 interface FastEthernet0/1 overload

!

access-list 1 permit 192.168.1.0 0.0.0.255

access-list 1 permit 192.168.2.0 0.0.0.255

no cdp log mismatch duplex

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

!

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

line vty 0 4

login

!

!

end

GATEWAY#