Cisco ASA 5508-X, Руководство по настройке

Страница: 254 / 428

11-20
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 11 Service Policy Using the Modular Policy Framework
Examples for Service Policies (Modular Policy Framework)
Figure 11-3 HTTP Inspection and Connection Limits to Specific Servers
See the following commands for this example:
hostname(config)# object network obj-192.168.1.2
hostname(config-network-object)# host 192.168.1.2
hostname(config-network-object)# nat (inside,outside) static 209.165.201.1
hostname(config)# object network obj-192.168.1.0
hostname(config-network-object)# subnet 192.168.1.0 255.255.255.0
hostname(config-network-object)# nat (inside,outside) dynamic 209.165.201.2
hostname(config)# access-list serverA extended permit tcp any host 209.165.201.1 eq 80
hostname(config)# access-list ServerB extended permit tcp any host 209.165.200.227 eq 80
hostname(config)# class-map http_serverA
hostname(config-cmap)# match access-list serverA
hostname(config)# class-map http_serverB
hostname(config-cmap)# match access-list serverB
hostname(config)# policy-map policy_serverA
hostname(config-pmap)# class http_serverA
hostname(config-pmap-c)# inspect http
hostname(config-pmap-c)# set connection conn-max 100
hostname(config)# policy-map policy_serverB
hostname(config-pmap)# class http_serverB
hostname(config-pmap-c)# inspect http
hostname(config)# service-policy policy_serverB interface inside
hostname(config)# service-policy policy_serverA interface outside
Applying Inspection to HTTP Traffic with NAT
In this example, the Host on the inside network has two addresses: one is the real IP address 192.168.1.1,
and the other is a mapped IP address used on the outside network, 209.165.200.225. You must use the
real IP address in the ACL in the class map. If you applied it to the outside interface, you would also use
the real address.
in s ide o u t s ide
S erver A
Re a l Addre ss : 192.16 8 .1.2
M a pped Addre ss : 209.165.201.1
Ho s t B
Re a l Addre ss : 192.16 8 .1.1
M a pped Addre ss : 209.165.201.2: port
Ho s t A
209.165.200.226
S erver B
209.165.200.227
port 8 0
port 8 0
in s p.
in s p.
s et conn s
143357
Security
appliance