问一个ASA同安全级别端口互相访问的问题

network

问一个ASA同安全级别端口互相访问的问题 --问题解决了，总结了一下和大家分享！


在输入same-security-traffic permit inter-interface命令之后，如果不添加任何ACL，同安全级别的端口之间所能做到的互相访问是不是应该像在同一台未作任何配置的交换机上面一样？包括FTP之类的应用服务～谢谢啦！
---------------------------------------------------------------------------原问题如上-------------------------------------------------------------------------------------------

首先，一个防火墙上的两个端口之间如果需要建立链接，必须满足两个条件：
1，两个端口对儿上要有相应的地址转换策略；
2，有安全策略对转发数据放行，一般以ACL体现；
这样，
当高安全级别区域访问低安全级别区域的时候，安全策略是允许的；
低安全级别区域访问高安全级别区域就需要ACL放行了；
当2个同安全级别区域互相访问的时候，如果端口没有关联NAT策略，那么通过same-security-traffic permit inter-interface可以实现互访，如果关联的NAT策略的话，就需要对这两个同安全级别端口进行端口之间的NAT调整，我这里使用了static(natserver,vlan300)192.168.30.0 192.168.30.0 netmask 255.255.255.0，static(vlan300,natserver)192.168.12.0 192.168.12.0 netmask 255.255.255.0这一对儿对应的NAT来实现对2个同安全级别区域自身网段NAT的转换，目的就是让ASA受到packet之后，不只关联到nat()1，而搞不清楚正确的转发方向。同样对于其他同安全级别互访区域都配置一对儿双向的静态NAT就可以了！
NAT()0我感觉也应该可以实现，试了一下似乎没成，回头再试试看！

现行配置：
ASA Version 7.0(7)
!
hostname 5520
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
names
dns-guard
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 2××.1××.1××.×× 255.255.255.248
!
interface GigabitEthernet0/1
speed 100
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/1.100
vlan 100
nameif vlan100
security-level 100
ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/1.200
vlan 200
nameif vlan200
security-level 100
ip address 192.168.11.1 255.255.255.0
!
interface GigabitEthernet0/1.300
vlan 300
nameif vlan300
security-level 100
ip address 192.168.12.1 255.255.255.0
!
interface GigabitEthernet0/1.400
vlan 400
nameif vlan400
security-level 100
ip address 192.168.13.1 255.255.255.0
!
interface GigabitEthernet0/2
description link_to_server
nameif dmz
security-level 50
ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/3
description link_to_natserver
nameif natserver
security-level 100
ip address 192.168.30.254 255.255.255.0
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list outside_to_natserver extended permit ip any host 211.142.134.99
access-list outside_to_natserver extended permit ip any host 211.142.134.100
pager lines 24
logging asdm informational
mtu outside 1500
mtu vlan100 1500
mtu vlan200 1500
mtu vlan300 1500
mtu vlan400 1500
mtu dmz 1500
mtu natserver 1500
mtu management 1500
no failover
asdm image disk0:/asdm-507.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 2 2××.1××.1××.1××
global (outside) 3 2××.1××.1××.××
nat (vlan100) 1 192.168.10.0 255.255.255.0
nat (vlan300) 1 192.168.12.0 255.255.255.0
nat (vlan400) 1 192.168.13.0 255.255.255.0
nat (dmz) 2 192.168.20.0 255.255.255.0
nat (natserver) 3 192.168.30.0 255.255.255.0
static (dmz,outside) 2××.1××.1××.1×× 192.168.20.254 netmask 255.255.255.255
static (natserver,outside) 2××.1××.1××.×× 192.168.30.1 netmask 255.255.255.255
static (natserver,vlan300) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
static (vlan300,natserver) 192.168.12.0 192.168.12.0 netmask 255.255.255.0
static (natserver,vlan100) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
static (vlan100,natserver) 192.168.10.0 192.168.10.0 netmask 255.255.255.0
static (natserver,vlan200) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
static (vlan200,natserver) 192.168.11.0 192.168.11.0 netmask 255.255.255.0
access-group outside_to_natserver in interface outside
route outside 0.0.0.0 0.0.0.0 211.142.134.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username cisco password 3USUcOPFUiMCO4Jk encrypted
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
ssh version 1
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:736895fa883f241310142e5961872c89
: end