asa 5505 DMZ - VPN

Virtual private networks e affini

Moderatore: Federico.Lagni

Rispondi
miky-2008
n00b
Messaggi: 12
Iscritto il: mar 21 apr , 2009 11:09 am

Salve a tutti,

ho un problema con un cisco 5505 con la licenza sec, ho due sedi A e B
la sede A ha un asa5510 mentre la sede B ha un asa5505.
Nella sede B ho configurato anche una DMZ.
La sed A e la sede B sono in VPN fra di loro la sede A vede e accede tranquillamente alla LAN e alla DMZ della sede B.
Quello che vorrei fare è fare in modo che la DMZ riesca a vedere la LAN della sede A.

Qualcuno mi può aiutare, non so se sono stata chiara.
Top
ketVet
Cisco power user
Messaggi: 90
Iscritto il: gio 14 lug , 2005 6:59 pm

La licenza è solo un problema se hai ASA 5505, http://www.cisco.com/en/US/docs/securit ... vlans.html, ma visto che nella sede A hai un 5510, potrebbe essere la configurazione, la puoi postare?
Top
miky-2008
n00b
Messaggi: 12
Iscritto il: mar 21 apr , 2009 11:09 am

Questa è la conf dell ASA5505.

hostname ASA-xxxx
domain-name xxxx.it
enable password ddddddddddd encrypted
passwd dddddddddddddd encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 10.194.193.250 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address pp.qq.rr.tt 255.255.255.248
!
interface Vlan3
nameif dmz
security-level 50
ip address 10.194.101.254 255.255.255.0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 3
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
boot system disk0:/asa804-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name xxxx.it
same-security-traffic permit inter-interface
access-list NO-NAT extended permit ip 10.194.193.0 255.255.255.0 10.193.160.0 255.255.240.0
access-list VPN_ETI extended permit ip 10.194.193.0 255.255.255.0 10.193.160.0 255.255.240.0
access-list VPN_ETI extended permit ip 10.194.101.0 255.255.255.0 10.193.160.0 255.255.240.0
access-list NO-NAT-DMZ extended permit ip 10.194.101.0 255.255.255.0 10.193.160.0 255.255.240.0
access-list in->out extended permit ip any 10.194.101.0 255.255.255.0
access-list in->out extended permit ip 10.194.101.0 255.255.255.0 10.193.160.0 255.255.240.0
access-list dmz_access_in extended permit ip 10.194.101.0 255.255.255.0 10.193.160.0 255.255.240.0
pager lines 24
logging enable
mtu inside 1500
mtu outside 1500
mtu dmz 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any dmz
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NO-NAT
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz) 0 access-list NO-NAT-DMZ
nat (dmz) 1 10.193.101.0 255.255.255.0
static (inside,dmz) 10.193.160.0 10.193.160.0 netmask 255.255.240.0
static (inside,dmz) 10.194.193.0 10.194.193.0 netmask 255.255.255.0
access-group in->out in interface inside
route outside 0.0.0.0 0.0.0.0 94.90.108.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
http server enable
http 10.194.193.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-MD5-HMAC esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 120 match address VPN_ETI
crypto map outside_map 120 set peer aa.bb.cc.dd
crypto map outside_map 120 set transform-set ESP-MD5-HMAC
crypto map outside_map 120 set security-association lifetime seconds 28800
crypto map outside_map 120 set security-association lifetime kilobytes 4608000
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 5
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 10.194.193.0 255.255.255.0 inside
ssh timeout 30
console timeout 0
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username aaaa password ssssssssssssssss encrypted
tunnel-group aa.bb.cc.dd type ipsec-l2l
tunnel-group aa.bb.cc.dd ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Top
ketVet
Cisco power user
Messaggi: 90
Iscritto il: gio 14 lug , 2005 6:59 pm

Scusa ma, se vuoi far vedere la LAN dalla DMZ devi inserire le regole di security + NAT, nello specifico:

Codice: Seleziona tutto

access-list NO-NAT-DMZ extended permit ip 10.194.101.0 255.255.255.0 10.194.193.0 255.255.255.0 
access-list dmz_access_in extended permit ip 10.194.101.0 255.255.255.0 10.194.193.0 255.255.255.0
Fammi sapere!
Top
miky-2008
n00b
Messaggi: 12
Iscritto il: mar 21 apr , 2009 11:09 am

La LAN è ok quello che voglio far vedere è la LAN della sede A alla DMZ della sede B.
Top
ketVet
Cisco power user
Messaggi: 90
Iscritto il: gio 14 lug , 2005 6:59 pm

Posti anche la configurazione, dell'altra sede?
Grazie!
Top
miky-2008
n00b
Messaggi: 12
Iscritto il: mar 21 apr , 2009 11:09 am

Scusate ma mi sono sbagliata la sede A ha un PIX 515 con un failover.

L'ASA 5510 ce l'ho in un'altra sede

Questa è la conf del PIX 515 della sede A.

Grazie
Micaela
--------------------------------------------

hostname aaaa
domain-name aaaa.it
enable password encrypted
names
dns-guard
!
interface Ethernet0
nameif outside
security-level 0
ip address aa.bb.cc.ff 255.255.255.248 standby aa.bb.cc.dd
ospf cost 10
!
interface Ethernet1
nameif inside
security-level 100
ip address 10.193.160.250 255.255.240.0 standby 10.193.160.251
ospf cost 10
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system flash:/image.bin
ftp mode passive
dns server-group DefaultDNS
domain-name aaaa.it
access-list inside_nat0_outbound extended permit ip 10.193.160.0 255.255.240.0 10.194.193.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.193.160.0 255.255.240.0 10.194.101.0 255.255.255.0
access-list VPN_xxxx extended permit ip 10.193.160.0 255.255.240.0 10.194.193.0 255.255.255.0
access-list VPN_xxxx extended permit ip 10.193.160.0 255.255.240.0 10.194.101.0 255.255.255.0
pager lines 24
logging enable
logging asdm warnings
mtu outside 1500
mtu inside 1500
ip local pool Pooladm 10.195.254.1-10.195.254.7
ip verify reverse-path interface outside
failover
asdm image flash:/asdm-521.bin
asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 routertelecom 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
group-policy DfltGrpPolicy attributes
banner none
wins-server none
dns-server none
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain none
split-dns none
intercept-dhcp 255.255.255.255 disable
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
msie-proxy server none
msie-proxy method no-modify
msie-proxy except-list none
msie-proxy local-bypass disable
nac disable
nac-sq-period 300
nac-reval-period 36000
nac-default-acl none
address-pools none
client-firewall none
client-access-rule none
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 88.149.181.243 255.255.255.255 outside
http 10.193.160.0 255.255.240.0 inside
snmp-server host inside 10.193.160.45 community public
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 140 match address VPN_xxxx
crypto map outside_map 140 set peer pp.qq.rr.tt
crypto map outside_map 140 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group pp.qq.rr.tt type ipsec-l2l
tunnel-group pp.qq.rr.tt ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh 10.193.160.0 255.255.240.0 inside
ssh timeout 5
ssh version 1
console timeout 0
!
class-map class-map-telefonia
match access-list acl-telefonia
class-map inspection_default
match default-inspection-traffic
!
!
policy-map policy-map-telefonia
class class-map-telefonia
priority
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
Top
miky-2008
n00b
Messaggi: 12
Iscritto il: mar 21 apr , 2009 11:09 am

Non riesco proprio a far funzionare questa cosa.

Qualcuno può aiutarmi???
Top
Rispondi

Torna a “VPN”