ASA Modular Policy Framework Kullanarak TCP Ayarlarını Düzenlemek

Selam

Bu video Service Policy'lerin TCP Bağlantı ayarlarınını yapmak için nasıl kullanılacağı ile ilgili. Video nun bazı yerlerinde biraz saçmalamışım. Örneğin sonunda TCP sequence number demem gerekirken TCP synchronization number demişim. Bir yerde paket veya prob demem gerekirken, flag demişim. Lütfen dinlerken bu hatalarımı mazur görün. Gecenin bir yarısında video yapmaya çalışınca böyle hatalar olabiliyor.  Ancak genel olarak baktığınızda konfigürasyonlar doğru ve çalışıyorlar. Buna rağmen eğer konu anlatımında veya konfigürasyonlarda önemli bir hata görürseniz lütfen paylaşın ki hem ben hatamı dezelteyim, hem de eğer başka birisi daha bu videoyu izleyecek olursa yanlış bilgiler edinmesin.

Başlangıç konfigürasyonları neredeyse bir önceki videodaki konfigürasyonlarla aynı. Ancak yine de göz gezdirmek isterseniz aşağıda başlangıç konfigürasyonlarını bulabilirsiniz.

=================================== ASA-1 =================================== ASA-1# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-1 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 description *** INSIDE_NETWORK nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 description *** DMZ_NETWORK *** nameif dmz security-level 50 ip address 172.16.1.1 255.255.255.0 ! interface GigabitEthernet2 nameif outside security-level 0 ip address 22.22.22.33 255.255.255.252 ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive object network WWW_PRIVATE host 172.16.1.32 object network WWW_PUBLIC host 22.22.22.1 object network FTP_PRIVATE host 172.16.1.33 object network FTP_PUBLIC host 22.22.22.2 object network INSIDE_FTP_PRIVATE host 10.100.1.111 object network INSIDE_FTP_PUBLIC host 22.22.22.23 object network DNS_PRIVATE host 172.16.1.200 object network DNS_PUBLIC host 22.22.22.3 access-list outside_access extended permit tcp any object INSIDE_FTP_PRIVATE eq ftp access-list outside_access extended permit tcp any object WWW_PRIVATE eq www access-list outside_access extended permit tcp any object FTP_PRIVATE eq ftp access-list outside_access extended permit icmp any any time-exceeded 0 access-list outside_access extended permit icmp any any unreachable 3 access-list outside_access extended permit tcp any object DNS_PRIVATE eq telnet access-list outside_access extended permit tcp any object WWW_PRIVATE eq telnet ! tcp-map BGP_MD5_OPTION_19 tcp-options range 19 19 allow ! pager lines 24 logging console debugging mtu inside 1500 mtu dmz 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 ! object network WWW_PRIVATE nat (dmz,outside) static WWW_PUBLIC object network FTP_PRIVATE nat (dmz,outside) static FTP_PUBLIC object network INSIDE_FTP_PRIVATE nat (inside,outside) static INSIDE_FTP_PUBLIC object network DNS_PRIVATE nat (dmz,outside) static DNS_PUBLIC access-group outside_access in interface outside ! router ospf 10 router-id 111.111.111.111 network 10.100.1.1 255.255.255.255 area 0 network 172.16.1.1 255.255.255.255 area 0 log-adj-changes default-information originate ! route outside 0.0.0.0 0.0.0.0 22.22.22.34 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect ftp inspect icmp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:c75282a25b34e3142d634bc1125ed898 : end ============================================== ASA3 ============================================== ASA-3# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-3 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 nameif outside security-level 0 ip address 41.21.12.2 255.255.255.252 ! interface GigabitEthernet2 nameif outside2 security-level 99 ip address 41.21.13.2 255.255.255.252 ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive same-security-traffic permit intra-interface object network INSIDE_NETWORK subnet 10.100.1.0 255.255.255.0 object network INSIDE_CLIENT host 10.100.1.111 object network OUTSIDE_2 subnet 41.21.13.0 255.255.255.252 object network OUTSIDE subnet 41.21.12.0 255.255.255.252 pager lines 24 logging console debugging mtu inside 1500 mtu outside 1500 mtu outside2 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 nat (outside2,outside) source static OUTSIDE_2 OUTSIDE_2 destination static OUTSIDE OUTSIDE ! object network INSIDE_NETWORK nat (inside,outside) dynamic interface object network OUTSIDE_2 nat (outside2,outside) dynamic interface ! router ospf 10 router-id 33.33.33.33 network 41.21.13.2 255.255.255.255 area 0 log-adj-changes ! route outside 0.0.0.0 0.0.0.0 41.21.12.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp inspect ftp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:4ff769cbb03b5a1b140ccdac5a437a64 : end ======================================= R7 ======================================= INTERNAL_DNS#sh run Building configuration... Current configuration : 2940 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname INTERNAL_DNS ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ip host levent.com 172.16.1.32 ip host company-B.com 84.1.1.1 ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 172.16.1.200 255.255.255.0 duplex auto speed auto ! router ospf 10 router-id 7.7.7.7 log-adjacency-changes network 172.16.1.200 0.0.0.0 area 0 ! ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 exec-timeout 0 0 logging synchronous login local transport input telnet ssh ! ! end ======================================= R1 ======================================= R1#sh run Building configuration... Current configuration : 2894 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.1 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 22.22.22.34 255.255.255.252 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ip route 22.22.22.0 255.255.255.224 FastEthernet1/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end =================================== ML-SW1 =================================== ML_SW1#sh run Building configuration... Current configuration : 3957 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname ML_SW1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 no ip routing no ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet0/1 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet1/0 description ASA_1-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/1 description ASA_1-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/2 description ASA_1-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/3 ! interface FastEthernet1/4 ! interface FastEthernet1/5 description SW1_DMZ switchport access vlan 200 ! interface FastEthernet1/6 description SW2_IN switchport access vlan 100 ! interface FastEthernet1/7 description R1_Perimeter_Fa1/0 switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface FastEthernet1/10 description ASA_2-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/11 description ASA_2-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/12 description ASA_2-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/13 ! interface FastEthernet1/14 ! interface FastEthernet1/15 ! interface Vlan1 no ip address no ip route-cache ! interface Vlan100 ip address 10.100.1.253 255.255.255.0 ! ip default-gateway 10.100.1.1 ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ============================= R6 ============================= R6#sh run Building configuration... Current configuration : 3034 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R6 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! interface FastEthernet0/0 ip address 10.100.2.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface Serial0/0 ip address 86.1.1.1 255.255.255.252 ip nat outside ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 ip address 16.1.1.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet1/0 no ip address shutdown duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ! ! ip http server ip http authentication local ip http secure-server ip nat inside source list NAT interface Serial0/0 overload ! ip access-list extended NAT permit ip 10.100.2.0 0.0.0.255 any ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ================================== R8 ================================== R8#sh run Building configuration... Current configuration : 3295 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R8 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip domain name lab.local ip host company-B.com 84.1.1.1 ip host levent.com 22.22.22.1 ip host ftp.levent.com 22.22.22.2 ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface Loopback0 ip address 8.8.8.8 255.255.255.255 ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.2 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface Serial0/1 ip address 86.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/2 ip address 85.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/3 ip address 84.1.1.2 255.255.255.252 clock rate 2000000 ! ip forward-protocol nd ip route 16.1.1.0 255.255.255.0 86.1.1.1 ip route 22.22.22.0 255.255.255.192 Serial0/0 ip route 41.21.12.0 255.255.255.252 Serial0/3 ip route 41.21.13.0 255.255.255.0 Serial0/3 ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ================================= R4 ================================= R4#sh run Building configuration... Current configuration : 2902 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R4 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface Serial0/0 ip address 84.1.1.1 255.255.255.252 ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 41.21.12.1 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ip route 41.21.13.0 255.255.255.0 FastEthernet1/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ======================================= R11 ======================================= R11#sh run Building configuration... Current configuration : 1138 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R11 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 41.21.13.1 255.255.255.252 duplex auto speed auto ! router ospf 10 log-adjacency-changes network 41.21.13.1 0.0.0.0 area 0 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 41.21.13.2 ! ! no ip http server no ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 exec-timeout 0 0 logging synchronous login local ! ! end ===========================================

Umarım faydalı olabilmişimdir. Herkese iyi çalışmalar.