R1---Outside----ASA842----Inside-----R2

                                   |

                                 DMZ

                                   |

                                 R3

二.測(cè)試思路

 利用ASA的twice nat實(shí)現(xiàn)訪問(wèn)DMZ的公網(wǎng)地址時(shí)轉(zhuǎn)向DMZ的真實(shí)地址。

三.基本配置

A.R1:

interface FastEthernet0/0
 ip address 202.100.1.1 255.255.255.0
 no shut

B.R2:

interface FastEthernet0/0
 ip address 10.1.1.1 255.255.255.0

 no shut

ip route 0.0.0.0 0.0.0.0 10.1.1.10

C.R3:

interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0

 no shut

ip route 0.0.0.0 0.0.0.0 192.168.1.10

line vty 0 4

 password cisco

 login

D.ASA842:

interface GigabitEthernet0
 nameif Outside
 security-level 0
 ip address 202.100.1.10 255.255.255.0
 no shut
interface GigabitEthernet1
 nameif DMZ
 security-level 50
 ip address 192.168.1.10 255.255.255.0
 no shut
interface GigabitEthernet2
 nameif Inside
 security-level 100
 ip address 10.1.1.10 255.255.255.0
 no shut

四.ASA靜態(tài)NAT,twice-NAT和策略配置

A.定義對(duì)象：

object network R3-dmz
 host 192.168.1.1
object network R3-outside
 host 202.100.1.8
object network Inside-net
 subnet 10.1.1.0 255.255.255.0

B.配置DMZ到Outside的靜態(tài)NAT:

object network R3-dmz
    nat (DMZ,Outside) static R3-outside

C.配置inside到DMZ的的twice-nat：

nat (Inside,DMZ) source static Inside-net Inside-net destination static R3-outside R3-dmz

D.配置并應(yīng)用outside接口策略:

-----Inside訪問(wèn)DMZ默認(rèn)放行

access-list Outside extended permit ip any object R3-dmz
access-group Outside in interface Outside

五.驗(yàn)證：

A.從Ouside訪問(wèn)DMZ的公網(wǎng)地址：

R1#telnet 202.100.1.8
Trying 202.100.1.8 ... Open

User Access Verification

Password:
R3>show users
   Line      User      Host(s)             Idle      Location
  0 con 0               idle                00:14:22
* 2 vty 0               idle                00:00:00 202.100.1.1

 Interface   User              Mode        Idle    Peer Address

R3>

B.從Inside訪問(wèn)DMZ的公網(wǎng)地址：

R2#telnet 202.100.1.8
Trying 202.100.1.8 ... Open

User Access Verification

Password:
R3>show users
   Line      User      Host(s)             Idle      Location
  0 con 0               idle                00:16:37
* 2 vty 0               idle                00:00:00 10.1.1.1

 Interface   User              Mode        Idle    Peer Address

R3>

C.從Inside訪問(wèn)DMZ真實(shí)地址：

R2#telnet 192.168.1.1
Trying 192.168.1.1 ... Open

User Access Verification

Password:
R3>show users
   Line      User      Host(s)             Idle      Location
  0 con 0               idle                00:17:03
* 2 vty 0               idle                00:00:00 10.1.1.1

 Interface   User              Mode        Idle    Peer Address

R3>

另外有需要云服務(wù)器可以了解下創(chuàng)新互聯(lián)scvps.cn，海內(nèi)外云服務(wù)器15元起步，三天無(wú)理由+7*72小時(shí)售后在線，公司持有idc許可證，提供“云服務(wù)器、裸金屬服務(wù)器、高防服務(wù)器、香港服務(wù)器、美國(guó)服務(wù)器、虛擬主機(jī)、免備案服務(wù)器”等云主機(jī)租用服務(wù)以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡(jiǎn)單易用、服務(wù)可用性高、性價(jià)比高”等特點(diǎn)與優(yōu)勢(shì)，專(zhuān)為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應(yīng)用場(chǎng)景需求。