Cisco ASA Modellari
Cisco ASA 5510 - masofadan turib ishlashni hisobga oladigan kichik va o'rta
biznes korxonalar
uchun mukammal model, bu iqtisodiy jihatdan xavfsiz yechim
hamdir. Barcha xavfsizlik xizmatlarini onlayn boshqarish platformasi orqali
boshqarish mumkin. Cisco 5510-da siz kutgan yuqori samarali firewall va tarmoq
xavfsizligi yechimlari mavjud. Xavfsizlik xizmatlari moduli buzilishning oldini
olish imkoniyatlarini to'liq boshqarish imkoniyatini beradi va mustahkam antivirus
xizmatini bajaradi. Biznes kelajakda kengayishini
inobatga olgan holda himoya
qilish mexanizmlarini sinflarga ajratadi, shuning uchun Cisco ASA 5510
kompaniyaga kerak bo'lganda funksiyalarni kengaytirishga imkon beradi.
Cisco ASA 5525-X - Cisco SecureX freymidan foydalangan holda, ushbu model
xavfsizligi yanada murakkab tarmoqqa ega bo'lgan o'rta kompaniyalar uchun juda
mos keladi. SecureX texnologiyasi Cisco taqdim etadigan xavfsizlik yechimlarining
eng so'nggi versiyasidir.
Ishni bajarish tartibi
1.
Cisco packet tracer dasturi ishga tushiriladi.
2.
Laboratoriya ishi uchun cisco 2960 kommutatori, 2911 marshruzatori, ASA0
5505 firewalli, server va kompyuterlar tanlanadi.
3.
Quyida keltirilgan topologiya quriladi.
4.
Qurilgan topologiya testlab ko`riladi.
16.2-rasm. Tadqiq qilinayotgan tarmoq topologiyasi.
Qurilgan topologiyada quyidagi buyruqlar teriladi:
ASA0 ga quyidagi buyruqlar ketma ketligi kiritiladi.
ciscoasa>en
Password:
ciscoasa#conf t
ciscoasa(config)#interface vlan 1
ciscoasa(config-if)#no ip address
WARNING: DHCPD bindings cleared on interface 'inside',
address pool removed
ciscoasa(config-if)#ip address 192.168.100.1 255.255.255.0
ciscoasa(config-if)#exit
ciscoasa(config)#dhcpd dns 8.8.8.8
ciscoasa(config)#enable password
salom
ciscoasa(config)#username javohir password admin
ciscoasa(config)#ssh 192.168.100.22 255.255.255.0
inside
WARNING: IP address <192.168.100.22> and netmask <255.255.255.0> inconsistent
ciscoasa(config)#ssh 192.168.100.22 255.255.255.255 inside
ciscoasa(config)#ssh timeout 1
ciscoasa(config)#aaa authentication
ssh console LOCAL
ciscoasa(config)#interface vlan 2
ciscoasa(config-if)#no ip address
WARNING: DHCPD bindings cleared on interface 'outside', address pool removed
ciscoasa(config-if)#ip address 195.158.0.2 255.255.255.252
ciscoasa(config-if)#exit
ciscoasa(config)#route outside 0.0.0.0.0.0.0.0 195.158.0.1
% Incomplete command.
ciscoasa(config)#object network NET
ciscoasa(config-network-object)#subnet 192.168.100.0 255.255.255.0
ciscoasa(config-network-object)#nat (inside,outside)
dynamic interface
ciscoasa(config-network-object)#ex
ciscoasa#conf t
ciscoasa(config)#access-list NAT extended
permit icmp any any
ciscoasa(config)#access-group NAT in interface outside
ciscoasa(config)#
ciscoasa#
ROUTERga quyida buyruqlar ketma ketligi kiritiladi.
ciscoasa>en
Password:
ciscoasa#conf t
ciscoasa(config)#interface vlan 1
ciscoasa(config-if)#no ip address
WARNING: DHCPD bindings cleared on interface 'inside', address pool removed
ciscoasa(config-if)#ip address 192.168.100.1 255.255.255.0
ciscoasa(config-if)#exit
ciscoasa(config)#dhcpd dns 8.8.8.8
ciscoasa(config)#enable password salom
ciscoasa(config)#username javohir password admin
ciscoasa(config)#ssh 192.168.100.22 255.255.255.0 inside
WARNING: IP address <192.168.100.22> and netmask <255.255.255.0> inconsistent
ciscoasa(config)#ssh 192.168.100.22 255.255.255.255 inside
ciscoasa(config)#ssh timeout 1
ciscoasa(config)#aaa authentication ssh console LOCAL
ciscoasa(config)#interface vlan 2
ciscoasa(config-if)#no ip address
WARNING: DHCPD bindings cleared on interface 'outside', address pool removed
ciscoasa(config-if)#ip address 195.158.0.2 255.255.255.252
ciscoasa(config-if)#exit
ciscoasa(config)#route outside 0.0.0.0.0.0.0.0 195.158.0.1
% Incomplete command.
ciscoasa(config)#object network NET
ciscoasa(config-network-object)#subnet 192.168.100.0 255.255.255.0
ciscoasa(config-network-object)#nat (inside,outside) dynamic interface
ciscoasa(config-network-object)#ex
ciscoasa#conf t
ciscoasa(config)#access-list NAT extended permit icmp any any
ciscoasa(config)#access-group NAT in interface outside
ciscoasa(config)#
ciscoasa#
