ASA做时间控制上网实战配置

network

ASA做时间控制上网实战配置


上班时间不可以上网。下班和周末可以上网，配置自己看吧
sh run
: Saved
:
ASA Version 8.0(3)
!
hostname ciscoasa
enable password 9jNfZuG3TC5tCVH0 encrypted
names
!
interface Ethernet0/0
nameif inside
security-level 100
ip address 172.16.1.1 255.255.0.0
!
interface Ethernet0/1
nameif dmz1
security-level 60
ip address 192.168.100.254 255.255.255.0
!
interface Ethernet0/2
nameif outside
security-level 0
ip address 10.10.184.2 255.255.254.0
!
interface Ethernet0/3
nameif dmz2
security-level 50
ip address 192.168.101.254 255.255.255.0
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
passwd 9jNfZuG3TC5tCVH0 encrypted
!
time-range shangban
periodic weekdays 0:00 to 6:59
periodic weekdays 11:00 to 13:59
periodic weekdays 17:30 to 23:59
periodic weekend 0:00 to 23:59
!
ftp mode passive
clock timezone HKST 8
dns domain-lookup inside
dns domain-lookup outside
access-list outside_acl extended permit icmp any any
access-list outside_acl extended permit ip any any
access-list dmz1_in extended permit icmp any any
access-list dmz1_in extended permit ip any any
access-list dmz2_in extended permit ip any any
access-list dmz2_in extended permit icmp any any
access-list inside_nonat extended permit ip 172.16.0.0 255.255.0.0 192.168.100.0 255.255.255.0
access-list inside_nonat extended permit ip 172.16.0.0 255.255.0.0 192.168.101.0 255.255.255.0
access-list inside extended permit ip any any
access-list shangban extended permit ip host 192.168.100.150 any time-range shangban
access-list shangban extended permit ip host 192.168.101.200 any time-range shangban
access-list shangban extended permit ip host 172.16.2.200 any
access-list shangban extended permit ip host 172.16.2.201 any
access-list shangban extended permit ip host 172.16.2.202 any
access-list shangban extended permit ip host 172.16.2.203 any
access-list shangban extended permit ip host 172.16.2.204 any
access-list shangban extended permit ip host 172.16.2.205 any
access-list shangban extended permit ip host 172.16.2.206 any
access-list shangban extended permit ip host 172.16.2.207 any
access-list shangban extended permit ip host 172.16.2.208 any
access-list shangban extended permit ip host 172.16.2.209 any
access-list shangban extended permit ip host 172.16.2.210 any
access-list shangban extended permit ip host 172.16.2.211 any
access-list shangban extended permit ip host 172.16.2.212 any
access-list shangban extended permit ip host 172.16.2.213 any
access-list shangban extended permit ip host 172.16.2.214 any
access-list shangban extended permit ip host 172.16.2.215 any
access-list shangban extended permit ip host 172.16.2.216 any
access-list shangban extended permit ip host 172.16.2.217 any
access-list shangban extended permit ip host 172.16.2.218 any
access-list shangban extended permit ip host 172.16.2.219 any
access-list shangban extended permit ip host 172.16.2.220 any
access-list shangban extended permit ip host 172.16.2.221 any
access-list shangban extended permit ip host 172.16.2.222 any
access-list shangban extended permit ip host 172.16.2.223 any
access-list shangban extended permit ip host 172.16.2.224 any
access-list shangban extended permit ip host 172.16.2.225 any
access-list shangban extended permit ip host 172.16.2.226 any
access-list shangban extended permit ip host 172.16.2.227 any
access-list shangban extended permit ip host 172.16.2.228 any
access-list shangban extended permit ip host 172.16.2.229 any
access-list shangban extended permit ip host 172.16.2.230 any
access-list shangban extended permit ip host 172.16.2.231 any
access-list shangban extended permit ip host 172.16.2.232 any
access-list shangban extended permit ip host 172.16.2.233 any
access-list shangban extended permit ip host 172.16.2.234 any
access-list shangban extended permit ip host 172.16.2.235 any
access-list shangban extended permit ip host 172.16.2.236 any
access-list shangban extended permit ip host 172.16.2.237 any
access-list shangban extended permit ip host 172.16.2.238 any
access-list shangban extended permit ip host 172.16.2.239 any
access-list shangban extended permit ip 172.16.0.0 255.255.0.0 10.0.0.0 255.0.0.0
access-list shangban extended permit ip 172.16.0.0 255.255.0.0 host 61.177.7.1
pager lines 24
mtu inside 1500
mtu dmz1 1500
mtu outside 1500
mtu dmz2 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-603.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nonat
nat (inside) 1 172.16.0.0 255.255.0.0
alias (inside) 10.10.185.250 192.168.100.150 255.255.255.255
alias (inside) 10.10.185.252 192.168.101.200 255.255.255.255
static (dmz1,outside) 10.10.185.250 192.168.100.150 netmask 255.255.255.255
static (dmz2,outside) 10.10.185.252 192.168.101.200 netmask 255.255.255.255
access-group shangban in interface inside
access-group dmz1_in in interface dmz1
access-group outside_acl in interface outside
access-group dmz2_in in interface dmz2
route outside 0.0.0.0 0.0.0.0 10.10.184.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 61.177.7.1
dhcpd domain ydzx
!
dhcpd address 172.16.1.2-172.16.2.1 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics
ntp server 172.16.0.0
!class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny  
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip  
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:eb3a449d21220adaff801db491f1a3c3
: end
ciscoasa#