ASA系统管理与日志_02

域名DNSASA1(config)# hostname ASA1ASA1(config)# domain-name java.localASA1(config)# show running-config dns    dns domain-lookup DMZ              //dns解析都从DMZ口出去    DNS server-group DefaultDNS        name-server 192.168.15.200     //这两条可直接在全局下敲 dns + ....        domain-name java.local时间ASA1(config)# clock timezone GMT +8    //设置时区 +8表示东8区ASA1(config)# clock set 10:26:00 Jun 10 2016  //设置时间ASA1(config)# show clock     10:27:05.239 GMT Fri Jun 10 2016NTP同步(client)ASA1(config)# show running-config ntp     ntp authentication-key 1 md5 cisco    ntp authenticate    ntp trusted-key 1    ntp server 192.168.12.100 key 1 source DMZASA文件系统ASA1(config)# dir /all    //虚拟机只能看见asdm    disk0:/asa842-k8.bin    //boot system 可选的系统    disk0:/asdm-731.bin    //asdm p_w_picpath asdm镜像    disk0:/boot.cfg        //cfg 启动配置文件  runningconfig 和start 不可见ASA1(config)# boot system disk0:/asa842-k8.binASA1(config)# asdm p_w_picpath disk0:/asdm-731.binASA1(config)# copy running-config disk0:/boot.cfg //将running保存到指定文件ASA1(config)# boot config disk0:/boot.cfg        //指定启动加载的配置文件

日志系统

可发送给：console；ASDM；Monitor；Buffer；Syslog；SNMP Trap；Email；NetFlow

日志的格式及消息等级：

logging默认关闭logging enablelogging console 7    //表示将等级7（全部信息）发送到console口 取消加nologging buffered 7    //存入缓存logging asdm informational //发给ASDM等级6的日志ASA1(config)# show running-config logging logging enablelogging trap debugging    // 发送指定日志级别（可自定义一个列表）**logging  list  locketest  level information  class  ospf  //定义一个ospf的列表**logging  trap  debugging         //发送locketestlogging  message  503001  level  alerts    //将来自503001的信息等级设置为1no  logging  message  503001               //禁用日志503001logging host DMZ 192.168.12.1  //指定出接口日志服务器（syslogserver）IP地址

排错工具Packet Tracer

Packet Tracer模拟一个数据包穿越ASA的数据通道，并跟踪ASA对该数据包的整个处理过程

ASA1(config)# packet-tracer input dmZ icmp 192.168.12.100 8 0 192.168.12.139 Phase: 1                //查看路由Type: ROUTE-LOOKUPSubtype: Resolve Egress InterfaceResult: ALLOWConfig:Additional Information:in   192.168.12.139  255.255.255.255 identityPhase: 2Type: ACCESS-LISTSubtype: Result: ALLOWConfig:Implicit RuleAdditional Information:Phase: 3Type: NATSubtype: per-sessionResult: ALLOWConfig:Additional Information:Phase: 4                  //查看ip的options字段，防火墙默认不允许带options的ip包Type: IP-OPTIONSSubtype:      Result: ALLOWConfig:Additional Information:Phase: 5Type: CLUSTER-REDIRECTSubtype: cluster-redirectResult: ALLOWConfig:Additional Information:Phase: 6Type: INSPECTSubtype: np-inspectResult: ALLOWConfig:Additional Information:Phase: 7Type: INSPECTSubtype: np-inspectResult: ALLOWConfig:       Additional Information:Phase: 8Type: FLOW-CREATIONSubtype: Result: ALLOWConfig:Additional Information:New flow created with id 33, packet dispatched to next moduleResult:input-interface: DMZinput-status: upinput-line-status: upoutput-interface: NP Identity Ifcoutput-status: upoutput-line-status: upAction: allow

抓包

ASA1(config)# capture test interface dmz ASA1(config)# no capture test interface dmz  //停止抓包ASA1(config)# no capture test                //删除包ASA1(config)# show capture test23 packets captured   1: 13:34:41.259263       192.168.12.139.514 > 192.168.12.1.514:  udp 88    2: 13:34:41.259340       192.168.12.139.514 > 192.168.12.1.514:  udp 107    ..........................  23: 13:35:17.952999       192.168.12.139.514 > 192.168.12.1.514:  udp 94 23 packets shown

配置带外网管口

接口下ASA1(config-if)# security-level 100    //建议设安全级别最高ASA1(config-if)# management-only        //只用于网管

Telnet网管

启用Telnet网管ASA1(config)# telnet 192.168.17.100 255.255.255.255 inside     //允许来着inside口的指定ipTelnetASA1(config)# telnet 0 0 DMZ         //允许来自DMZ口的所有Telnet连接注：不允许接口级别最低的Telnet进入ASA1(config)# passwd cisco            //登录需要密码ASA1(config)# enable password 502ASA1(config)# username admin password cisco privilege 15    //也可用本地用户认证ASA1(config)# aaa authentication telnet console LOCAL    //在Telnet登录应用本地登入

SSH网管

ASA1(config)# show running-config dns        //先配好域名dns domain-lookup DMZDNS server-group DefaultDNS    name-server 192.168.12.100    domain-name java.local    ASA1(config)# crypto key generate rsa modulus 1024     //为SSH加密会话产生加密密钥ASA1(config)# ssh 192.168.17.100 255.255.255.255 inside    //允许接入ASA1(config)# aaa authentication ssh console LOCAL          //ssh用aaa的本地认证ASA1(config)# ssh 0 0 DMZ  注：远程不能用Telnet，必须用ssh

创建本地管理账号

ASA1(config)# username admin attributes        //设置名为admin账户的属性ASA1(config-username)# service-type ?           //设置服务类型（不设置的话什么都能用）username mode commands/options:  admin          User is allowed access to the configuration prompt.    //允许进config  nas-prompt     User is allowed access to the exec prompt.    //低权限 不能进config  remote-access  User is allowed network access.    //只能远程  aaa authentication enable console LOCAL        //这两句可让service-type生效aaa authorization exec LOCALR3#ssh -l admin 192.168.12.100                //登录

HTTPS网管

ASA1(config)# http server enableASA1(config)# http 192.168.12.0 255.255.255.0 DMZASA1(config)# aaa authentication http console LOCAL ASA1(config)# username cisco password cisco privilege 15    //权限必须要15级只能使用ASDMASA需要一个服务器的证书（缺省是ASA自签名证书--一般会报错）客户认证：任何密码          AAA的一次性密码          证书认证+一次性密码

SNMP

v1/v2c/v3 SNMPV3才有加密认证功能。认证包括MD5 or SHA，加密包括DES or RSA

ASA1(config)# snmp-server group group001 v3 priv       //创建组ASA1(config)# snmp-server user admin group001 v3 auth md5 cisco privde des Cisco    //账号admin 属于group001组 版本v3  认证md5密码是Cisco  加密des密码CiscoASA1(config)# snmp-server host dmZ 192.168.12.1 version 3 admin    //v1 v2 把version 3 换成comunit    ASA1(config)# snmp-server location beijing        //用于说明的（非必须）ASA1(config)# snmp-server contact xiaomingASA1(config)# snmp-server enable traps snmp ?    //允许trap snmp一些信息configure mode commands/options:  authentication  Enable authentication trap  coldstart       Enable coldStart trap  linkdown        Enable linkDown trap  linkup          Enable linkUp trap  warmstart       Enable warmstart trap  

认证管理访问

ASA1(config)# aaa-server aaaname protocol ?            //定义要用的协议和名字configure mode commands/options:  http-form  Protocol HTTP form-based  kerberos   Protocol Kerberos  ldap       Protocol LDAP  radius     Protocol RADIUS  sdi        Protocol SDI  tacacs+    Protocol TACACS+ASA1(config)# aaa-server aaaname (DMZ) host 192.168.12.100 cisco  //定义服务器位置和key-cisco在ssh上用AAAASA1(config)# aaa authentication ssh console aaaname LOCAL 注：记得no aaa authentication exec LOCAL     若要做本地授权则在本地设置一个和认证服务器上相同用户名密码的账号：    ASA1(config)# username test1 password cisco privilege 15

自签名证书