ASA firewall 2일차

ASA NAT

• Cisco Device에서 NAT는 다음과 같이 구분한다.

Dynamic NAT / Static NAT / PAT / PAR(= Static PAT)

- Cisco 방화벽 장비인 ASA는 '설정 방식'에 따라 다음과 같이 구분이 가능하다.

1. Twice NAT(Manual NAT) - 우선 순위 1
2. Object NAT(Auto NAT) - 우선 순위 2
3. Manual NAT after Auto - 우선 순위 3

# 공통 설정

en
conf t
no ip domain lookup
line c 0
logg syn
exec-timeout 0
exit
host

# IP Address

ISP]
int f0/1
sh
mac-address ffff.ffff.ffff
no shut
ip add dhcp
exit
int f1/0
no shut
ip add 2.2.2.254 255.255.255.0
exit
int f0/0
no shut
ip add 1.1.100.6 255.255.255.252
exit

CE]
int f0/0
no shut
ip add 1.1.100.2 255.255.255.252
exit
int f0/1
no shut
ip add 1.1.100.5 255.255.255.252

DSW]
int f0/0
no shut
ip add 10.1.1.2 255.255.255.0
exit
int l0
ip add 10.2.2.1 255.255.255.0


ASAv]
policy-map global_policy
class inspection_default
inspect icmp
end
conf t
int g 0/0
no shut
desc ##Inside##
ip add 10.1.1.254 255.255.255.0
nameif Inside
security-level 100
exit
int g0/1
no shut
desc ##Outisde##
ip add 1.1.100.1 255.255.255.252
nameif Outside
security_level 0
exit
int g0/2
no shut
desc ##DMZ_NET##
nameif DMZ
security-level 50
ip add 10.1.2.254 255.255.255.0
int management 0/0
no shut
nameif Management
security-level 100
ip add 192.168.1.254 255.255.255.0

# static routing

ASAv]
route Outside 0 0 1.1.100.2

CE]
ip route 0.0.0.0 0.0.0.0 f0/1 1.1.100.6
ip route 211.100.1.0 255.255.255.0 f0/0 1.1.100.1 // 211.100.1.0/24 ASA NAT 공인 주소

ISP]
ip route 1.1.100.0 255.255.255.252 f0/0 1.1.100.5
ip route 211.100.1.0 255.255.255.0 f0/0 1.1.100.5
ip route 0.0.0.0 0.0.0.0 f0/1 10.0.0.1 

# ACL, NAPT

ISP]
ip access-list standard INGRESS
permit 211.100.1.0 0.0.0.255
permit 2.2.2.0 0.0.0.255
permit 1.1.100.0 0.0.0.7
exit
ip nat inside source list INGRESS int f0/1 overload
int f0/0
ip nat in
exit
int f1/0
ip nat in
exit
int f0/1
ip nat out

# ASA Dynamic NAT

ASA] 
object network Global_IP
range 211.100.1.1 211.100.1.254 // NAT의 object 용도일때는 range를 사용. 글로벌IP
exit
object network Inside_NET
subnet 10.1.1.0 255.255.255.0
nat (Inside, Outside) dyanmic Global_IP
show nat detail

DSW]
ping 10.0.0.1 // 핑이 나가는것을 확인할 수 있다.

# PAT

ASA]
clear configure object // 기존 object, NAT 설정 삭제
object network Inside_NET
subnet 10.1.1.0 255.255.255.0
nat (Inside,Outside) dynamic interface

DSW]
ping 10.0.0.1  // 잘 나가는것을 확인할 수 있다.

# Static NAT

ASA]
object network DNS_SVR
host 10.1.2.250
nat (DMZ,Outside) static 211.100.1.250
object network WEB_SVR
host 10.1.2.251
nat (DMZ,Outside) static 211.100.1.251
object network FTP_SVR
host 10.1.2.252
nat (DMZ,Outside) static 211.100.1.252
exit
access-list OUT->DMZ permit udp any host 10.1.2.250 eq 53
access-list OUT->DMZ permit tcp any host 10.1.2.251 eq 80
access-list OUT->DMZ permit tcp any host 10.1.2.252 eq 21
access-list OUT->DMZ permit icmp any 10.1.2.248 255.255.255.248 echo
aceess-list OUT->DMZ deny ip any any
access-group OUT->DMZ in interface Outside 

# DNS Rewrite

칼리에서 DNS의 서버주소를 받아올때 ASA에서 Static NAT가 돌기때문에 211.100.1.250이 network interfaces와 resolve.conf파일에
정의되어야 한다. 그래도 nslookup 으로 보이는 kedu.edu의 사설 10.1.2.251로 접속할 수 없다.
그래서 ASA에서 10.1.2.250 대역이 나갈때 211.100.1.251 으로 나가게 할 수 있다.

object network DNS_RE
host 10.1.2.251 nat (DMZ,Outside) static 211.100.1.251 dns // 외부망에서 접근할 수 있는 DNS Rewrite