思科ASA防火墙端口NAT回流

素颜马尾好姑娘i 2023-01-15 02:15 230阅读 0赞

参考  
1.[CISCO ASA Hairpinning+NAT配置][CISCO ASA Hairpinning_NAT]  
2.[Cisco ASA Hairpinning技术解决内网通过公网IP访问内网服务器问题][Cisco ASA Hairpinning_IP]  
3.[CISCO ASA HAIRPINNING解决内网使用公网IP访问内部的服务器][CISCO ASA HAIRPINNING_IP]  
4.[ASA5510 8.2 关于内网回流！][ASA5510 8.2]

使用Cisco的Hairpinning技术

IOS 8.3以后版本的 Hairpinning技术相关配置如下：

1.公网端口映射  
内网10.24.11.216:80-->8.8.8.8:10080

object network server01
        host 10.24.11.216
        nat (insdie,outside) static 8.8.8.8 service tcp 80 10080
    //定义Object
    access-list OUTSIDE_access_in extended permit tcp any host 10.24.11.216 eq 80 
    access-group OUTSIDE_access_in in interface outside
    //放行ACL

2.内网通过公网地址直接访问  
内网访问8.8.8.8:10080-->10.24.11.216:80

same-security-traffic permit intra-interface
    //允许同一接口发起进出口流量
    
    object network INSIDE-INSIDE-hairpinning-NETWORK
        subnet 10.24.0.0 255.255.0.0
        nat (inside,inside) dynamic interface
    //定义内网网段inside->inside方向
    
    
    object network MES216-Hairpinning
        host 10.24.11.216 (服务器IP)
        nat (inside,inside) static 8.8.8.8 service tcp 80 10080
    //定义内网到内网映射
    
    access-list OUTSIDE_access_in extended permit tcp any host 8.8.8.8 eq 10080
    access-group OUTSIDE_access_in in interface outside
    放行ACL流量-非必须操作

如果第一步做过映射，则公网端口映射这步可以不做。

[CISCO ASA Hairpinning_NAT]: https://wenku.baidu.com/view/d712621af78a6529647d53ff.html
[Cisco ASA Hairpinning_IP]: https://www.php.cn/mysql-tutorials-118809.html
[CISCO ASA HAIRPINNING_IP]: http://pangzhou.net/?p=551
[ASA5510 8.2]: https://bbs.51cto.com/thread-1160396-1.html