防火墙ACL和NAT部署

ACL

定义感兴趣流
access-list in2out permit ip 192.168.1.0 255.255.255.0 any
定义内部接口并定义ACL
nat (inside) 1 access-list in2out
定义外部接口并翻转
global (outside) 1 interface
开启协议修正，强制ICMP流量检测
fixup protocol icmp

Show conn all 查看状态表
Show conn detail 查看详细状态表
Show xlate 查看NAT表

NAT

静态NAT
第一步，定义地址映射
static (dmz,outside) 100.1.1.2 172.16.1.2
第二步，运行外网访问本地的服务器
access-list OPEN extended permit ip any host 100.1.1.2
access-group OPEN in interface outside

更细致的匹配
static (dmz,outside) tcp 100.1.1.2 telnet 172.16.1.2 telnet
access-list OPEN extended permit tcp any host 100.1.1.2 eq telnet
access-group OPEN in interface outside

策略NAT
//做完 NAT 后可能会使内网无法访问服务器，需要部署以下命令
access-list NONAT extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
nat (inside) 0 access-list NONAT //0表示不翻转