在ASA後查詢其公有IP地址的主機之間的LAN通訊

下載選項

PDF (449.6 KB)
在多種裝置上使用 Adobe Reader 檢視
ePub (326.7 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上的各種應用程式中檢視
Mobi (Kindle) (237.3 KB)
在 Kindle 裝置或多部裝置的 Kindle 應用程式上檢視

已更新: 2018 年 8 月 19 日

文件 ID:213531

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

簡介

本文檔描述了不同的網路實施，從這些實施中，在尋找自適應安全裝置(ASA)背後的公有IP地址的主機之間，需要允許區域網(LAN)通訊。

必要條件

需求

思科建議您瞭解以下主題：

Cisco基本ASA NAT配置，版本8.3及更高版本。
Cisco基本ASA NAT配置，版本8.2及更早版本。

採用元件

本文中的資訊係根據以下軟體和硬體版本：

ASA5500和ASA5500-X系列。
Cisco ASA 8.3及更高版本。
Cisco ASA 8.2及更低版本。

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

問題：在ASA後查詢其公共IP地址的主機之間的LAN通訊

在下一部分中，您可以看到三個拓撲示例，它們顯示了在ASA後面查詢公有IP地址的主機之間允許LAN通訊的此通訊要求。

示例1.源主機PC-A連線到內部ASA介面，而目的主機Test Server連線到DMZ介面。

示例2.源主機和目的主機PC-A和測試伺服器連線到同一內部ASA介面。

示例3.源主機和目的主機PC-A和測試伺服器連線到內部ASA介面，但位於另一個第3層裝置（可以是路由器或多層交換機）的後面。

附註：三個映像中的測試伺服器在ASA中配置了靜態網路地址轉換(NAT)，此靜態NAT轉換從外部應用至對應的內部介面，以允許從外部使用公共IP地址64.100.0.5訪問測試伺服器，然後將其轉換為測試伺服器內部專用IP地址。

解決方案

為了允許源主機PC-A使用其公有IP地址而不是專用地址到達目標測試伺服器，我們需要應用兩次NAT配置。兩次NAT配置可幫助我們在流量通過ASA時轉換資料包的源IP地址和目標IP地址。

以下是每個拓撲所需的兩次nat配置的詳細資訊：

示例1.源主機PC-A連線到內部ASA介面，而目的主機Test Server連線到DMZ介面。

組態

用於ASA 8.3版及更高版本的兩次NAT:

object network obj-10.1.1.5
 host 10.1.1.5

object network obj-172.16.1.5
 host 172.16.1.5

object network obj-64.100.0.5
 host 64.100.0.5

nat (inside,dmz) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-172.16.1.5

NOTE: After this NAT is applied in the ASA you will receive a warning message as the following:

WARNING: All traffic destined to the IP address of the outside interface is being redirected.
WARNING: Users may not be able to access any service enabled on the outside interface.

用於ASA 8.2及更舊版本的兩次NAT:

access-list IN-DMZ-INTERFACE extended permit ip host 10.1.1.5 host 64.100.0.5
static (inside,dmz) interface access-list IN-DMZ-INTERFACE

access-list DMZ-IN-INTERFACE extended permit ip host 172.16.1.5 host 172.16.1.1
static (dmz,inside) 64.100.0.5 access-list DMZ-IN-INTERFACE

疑難排解

Packet Tracer 8.3版及更高版本：

ASA# packet-tracer input inside tcp 10.1.1.5 123 64.100.0.5 80

Phase: 1
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,dmz) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-172.16.1.5
Additional Information:
NAT divert to egress interface dmz
Untranslate 64.100.0.5/80 to 172.16.1.5/80

Phase: 3
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (inside,dmz) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-172.16.1.5
Additional Information:
Static translate 10.1.1.5/123 to 172.16.1.1/123

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,dmz) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-172.16.1.5
Additional Information:

Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 167632, packet dispatched to next module

Result: 
input-interface: inside
input-status: up
input-line-status: up
output-interface: dmz
output-status: up
output-line-status: up
Action: allow

Packet Tracer 8.2及更低版本輸出：

ASA#packet-tracer input inside tcp 10.1.1.5 123 64.100.0.5 80 

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
static (dmz,inside) 64.100.0.5 access-list DMZ-IN-INTERFACE 
 match ip dmz host 172.16.1.5 inside host 172.16.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:
NAT divert to egress interface dmz
Untranslate 64.100.0.5/0 to 172.16.1.5/0 using netmask 255.255.255.255

Phase: 2
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 3
Type: NAT
Subtype: 
Result: ALLOW
Config: 
static (inside,dmz) interface access-list IN-DMZ-INTERFACE 
 match ip inside host 10.1.1.5 dmz host 64.100.0.5
 static translation to 172.16.1.1
 translate_hits = 1, untranslate_hits = 0
Additional Information:
Static translate 10.1.1.5/0 to 172.16.1.1/0 using netmask 255.255.255.255

Phase: 4
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,dmz) interface access-list IN-DMZ-INTERFACE 
 match ip inside host 10.1.1.5 dmz host 64.100.0.5
 static translation to 172.16.1.1
 translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 5
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
static (dmz,inside) 64.100.0.5 access-list DMZ-IN-INTERFACE 
 match ip dmz host 172.16.1.5 inside host 172.16.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:

Phase: 6
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (dmz,inside) 64.100.0.5 access-list DMZ-IN-INTERFACE 
 match ip dmz host 172.16.1.5 inside host 172.16.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 8 
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 503, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: dmz
output-status: up
output-line-status: up
Action: allow

封包擷取：

ASA# sh cap
capture capin type raw-data interface inside [Capturing - 1300 bytes] 
 match ip host 10.1.1.5 host 64.100.0.5 
capture capout type raw-data interface dmz [Capturing - 1300 bytes] 
 match ip host 172.16.1.1 host 172.16.1.5 

ASA# sh cap capin

10 packets captured
 1: 12:36:28.245455 10.1.1.5 > 64.100.0.5: icmp: echo request 
 2: 12:36:28.269441 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 3: 12:36:28.303451 10.1.1.5 > 64.100.0.5: icmp: echo request 
 4: 12:36:28.333692 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 5: 12:36:28.372478 10.1.1.5 > 64.100.0.5: icmp: echo request 
 6: 12:36:28.395563 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 7: 12:36:28.422402 10.1.1.5 > 64.100.0.5: icmp: echo request 
 8: 12:36:28.449241 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 9: 12:36:28.481420 10.1.1.5 > 64.100.0.5: icmp: echo request 
 10: 12:36:28.507435 64.100.0.5 > 10.1.1.5: icmp: echo reply 
10 packets shown

ASA1# sh cap capout

10 packets captured
 1: 12:36:28.245730 172.16.1.1 > 172.16.1.5: icmp: echo request 
 2: 12:36:28.269395 172.16.1.5 > 172.16.1.1: icmp: echo reply 
 3: 12:36:28.303725 172.16.1.1 > 172.16.1.5: icmp: echo request 
 4: 12:36:28.333646 172.16.1.5 > 172.16.1.1: icmp: echo reply 
 5: 12:36:28.372737 172.16.1.1 > 172.16.1.5: icmp: echo request 
 6: 12:36:28.395533 172.16.1.5 > 172.16.1.1: icmp: echo reply 
 7: 12:36:28.422661 172.16.1.1 > 172.16.1.5: icmp: echo request 
 8: 12:36:28.449195 172.16.1.5 > 172.16.1.1: icmp: echo reply 
 9: 12:36:28.481695 172.16.1.1 > 172.16.1.5: icmp: echo request 
 10: 12:36:28.507404 172.16.1.5 > 172.16.1.1: icmp: echo reply 
10 packets shown

示例2.源主機和目的主機PC-A和測試伺服器連線到同一內部ASA介面。

組態

用於ASA 8.3版及更高版本的兩次NAT:

object network obj-10.1.1.5
 host 10.1.1.5

object network obj-10.1.1.6
 host 10.1.1.6

object network obj-64.100.0.5
 host 64.100.0.5

nat (inside,inside) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-10.1.1.6

NOTE: After this NAT is applied in the ASA you will receive a warning message as the following:

WARNING: All traffic destined to the IP address of the outside interface is being redirected.
WARNING: Users may not be able to access any service enabled on the outside interface.

用於ASA 8.2及更舊版本的兩次NAT:

access-list IN-OUT-INTERFACE extended permit ip host 10.1.1.5 host 64.100.0.5
static (inside,inside) interface access-list IN-OUT-INTERFACE

access-list OUT-IN-INTERFACE extended permit ip host 10.1.1.6 host 10.1.1.1
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE

附註：從10.1.1.5到ASA內部介面IP地址10.1.1.1的源IP地址的NAT轉換的主要目的是強制來自主機10.1.1.6的應答返回到ASA，這是避免非對稱路由和允許ASA處理感興趣主機之間的所有流量所非常需要的，如果我們不像本例中那樣轉換源IP地址，則ASA將阻止由於非對稱路由而引起的相關流量。

疑難排解

Packet Tracer 8.3版及更高版本：

ASA# packet-tracer input inside tcp 10.1.1.5 123 64.100.0.5 80

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,inside) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-10.1.1.6
Additional Information:
NAT divert to egress interface inside
Untranslate 64.100.0.5/80 to 10.1.1.6/80

Phase: 2
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (inside,inside) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-10.1.1.6
Additional Information:
Static translate 10.1.1.5/123 to 10.1.1.1/123

Phase: 3
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule 
Additional Information:

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,inside) source static obj-10.1.1.5 interface destination static obj-64.100.0.5 obj-10.1.1.6
Additional Information:
 
Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 167839, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

Packet Tracer 8.2及更低版本輸出：

ASA# packet-tracer input inside tcp 10.1.1.5 123 64.100.0.5 80

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE 
 match ip inside host 10.1.1.6 inside host 10.1.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:
NAT divert to egress interface inside
Untranslate 64.100.0.5/0 to 10.1.1.6/0 using netmask 255.255.255.255

Phase: 2
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:

Phase: 3
Type: IP-OPTIONS
Subtype: 
Result: ALLOW 
Config:
Additional Information:

Phase: 4
Type: NAT
Subtype: 
Result: ALLOW
Config:
static (inside,inside) interface access-list IN-OUT-INTERFACE 
 match ip inside host 10.1.1.5 inside host 64.100.0.5
 static translation to 10.1.1.1
 translate_hits = 1, untranslate_hits = 0
Additional Information:
Static translate 10.1.1.5/0 to 10.1.1.1/0 using netmask 255.255.255.255

Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,inside) interface access-list IN-OUT-INTERFACE 
 match ip inside host 10.1.1.5 inside host 64.100.0.5
 static translation to 10.1.1.1
 translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE 
 match ip inside host 10.1.1.6 inside host 10.1.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:

Phase: 7
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE 
 match ip inside host 10.1.1.6 inside host 10.1.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:
 
Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 727, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

封包擷取：

ASA# sh cap
capture capin type raw-data interface inside [Capturing - 1300 bytes] 
 match ip host 10.1.1.5 host 64.100.0.5 
capture capout type raw-data interface inside [Capturing - 1300 bytes] 
 match ip host 10.1.1.1 host 10.1.1.6

ASA# sh cap capin

10 packets captured
 1: 12:50:39.304748 10.1.1.5 > 64.100.0.5: icmp: echo request 
 2: 12:50:39.335431 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 3: 12:50:39.368389 10.1.1.5 > 64.100.0.5: icmp: echo request 
 4: 12:50:39.389368 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 5: 12:50:39.398432 10.1.1.5 > 64.100.0.5: icmp: echo request 
 6: 12:50:39.418176 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 7: 12:50:39.419732 10.1.1.5 > 64.100.0.5: icmp: echo request 
 8: 12:50:39.425103 64.100.0.5 > 10.1.1.5: icmp: echo reply 
 9: 12:50:39.434395 10.1.1.5 > 64.100.0.5: icmp: echo request 
 10: 12:50:39.438423 64.100.0.5 > 10.1.1.5: icmp: echo reply 
10 packets shown

ASA2# sh cap capout

10 packets captured
 1: 12:50:39.305282 10.1.1.1 > 10.1.1.6: icmp: echo request 
 2: 12:50:39.335386 10.1.1.6 > 10.1.1.1: icmp: echo reply 
 3: 12:50:39.368663 10.1.1.1 > 10.1.1.6: icmp: echo request 
 4: 12:50:39.389307 10.1.1.6 > 10.1.1.1: icmp: echo reply 
 5: 12:50:39.398706 10.1.1.1 > 10.1.1.6: icmp: echo request 
 6: 12:50:39.418130 10.1.1.6 > 10.1.1.1: icmp: echo reply 
 7: 12:50:39.419762 10.1.1.1 > 10.1.1.6: icmp: echo request 
 8: 12:50:39.425072 10.1.1.6 > 10.1.1.1: icmp: echo reply 
 9: 12:50:39.434669 10.1.1.1 > 10.1.1.6: icmp: echo request 
 10: 12:50:39.438392 10.1.1.6 > 10.1.1.1: icmp: echo reply 
10 packets shown

示例3.源主機和目的主機PC-A和測試伺服器連線到內部ASA介面，但位於另一個第3層裝置（可以是路由器或多層交換機）的後面。

組態

用於ASA 8.3版及更高版本的兩次NAT:

object network obj-10.2.2.5
 host 10.2.2.5

object network obj-10.3.3.6
 host 10.3.3.6

object network obj-64.100.0.5
 host 64.100.0.5

nat (inside,inside) source static obj-10.2.2.5 interface destination static obj-64.100.0.5 obj-10.3.3.6

NOTE: After this NAT is applied in the ASA you will receive a warning message as the following:

WARNING: All traffic destined to the IP address of the outside interface is being redirected.
WARNING: Users may not be able to access any service enabled on the outside interface.

用於ASA 8.2及更舊版本的兩次NAT:

access-list IN-OUT-INTERFACE extended permit ip host 10.2.2.5 host 64.100.0.5
static (inside,inside) interface access-list IN-OUT-INTERFACE

access-list OUT-IN-INTERFACE extended permit ip host 10.3.3.6 host 10.1.1.1
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE

注意：從10.1.1.5到ASA內部介面IP地址(10.1.1.1)的源IP地址的NAT轉換的主要目的是強制來自主機10.1.1.6的應答返回到ASA，這是避免非對稱路由和允許ASA處理感興趣主機之間的所有流量所必需的事項，如果我們不像本例中那樣轉換源IP地址，則ASA將阻止非對稱路由導致的相關流量。

疑難排解

Packet Tracer 8.3版及更高版本：

ASA# packet-tracer input inside tcp 10.2.2.5 123 64.100.0.5 80

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,inside) source static obj-10.2.2.5 interface destination static obj-64.100.0.5 obj-10.3.3.6
Additional Information:
NAT divert to egress interface inside
Untranslate 64.100.0.5/80 to 10.3.3.6/80

Phase: 2
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (inside,inside) source static obj-10.2.2.5 interface destination static obj-64.100.0.5 obj-10.3.3.6
Additional Information:
Static translate 10.2.2.5/123 to 10.1.1.1/123

Phase: 3
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule 
Additional Information:

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,inside) source static obj-10.2.2.5 interface destination static obj-64.100.0.5 obj-10.3.3.6
Additional Information:
 
Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 167945, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

Packet Tracer 8.2及更低版本輸出：

ASA# packet-tracer input inside tcp 10.2.2.5 123 64.100.0.5 80

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE 
 match ip inside host 10.3.3.6 inside host 10.1.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:
NAT divert to egress interface inside
Untranslate 64.100.0.5/0 to 10.3.3.6/0 using netmask 255.255.255.255

Phase: 2
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:

Phase: 3
Type: IP-OPTIONS
Subtype: 
Result: ALLOW 
Config:
Additional Information:

Phase: 4
Type: NAT
Subtype: 
Result: ALLOW
Config:
static (inside,inside) interface access-list IN-OUT-INTERFACE 
 match ip inside host 10.2.2.5 inside host 64.100.0.5
 static translation to 10.1.1.1
 translate_hits = 1, untranslate_hits = 0
Additional Information:
Static translate 10.2.2.5/0 to 10.1.1.1/0 using netmask 255.255.255.255

Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,inside) interface access-list IN-OUT-INTERFACE 
 match ip inside host 10.2.2.5 inside host 64.100.0.5
 static translation to 10.1.1.1
 translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE 
 match ip inside host 10.3.3.6 inside host 10.1.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:

Phase: 7
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,inside) 64.100.0.5 access-list OUT-IN-INTERFACE 
 match ip inside host 10.3.3.6 inside host 10.1.1.1
 static translation to 64.100.0.5
 translate_hits = 0, untranslate_hits = 1
Additional Information:
 
Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 908, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

封包擷取：

ASA# sh cap
capture capin type raw-data interface inside [Capturing - 1300 bytes] 
 match ip host 10.2.2.5 host 64.100.0.5 
capture capout type raw-data interface inside [Capturing - 1300 bytes] 
 match ip host 10.1.1.1 host 10.3.3.6 

ASA# sh cap capin

10 packets captured
 1: 13:06:09.302047 10.2.2.5 > 64.100.0.5: icmp: echo request 
 2: 13:06:09.315276 64.100.0.5 > 10.2.2.5: icmp: echo reply 
 3: 13:06:09.342221 10.2.2.5 > 64.100.0.5: icmp: echo request 
 4: 13:06:09.381266 64.100.0.5 > 10.2.2.5: icmp: echo reply 
 5: 13:06:09.421227 10.2.2.5 > 64.100.0.5: icmp: echo request 
 6: 13:06:09.459204 64.100.0.5 > 10.2.2.5: icmp: echo reply 
 7: 13:06:09.494939 10.2.2.5 > 64.100.0.5: icmp: echo request 
 8: 13:06:09.534258 64.100.0.5 > 10.2.2.5: icmp: echo reply 
 9: 13:06:09.564210 10.2.2.5 > 64.100.0.5: icmp: echo request 
 10: 13:06:09.593261 64.100.0.5 > 10.2.2.5: icmp: echo reply 
10 packets shown

ASA# sh cap capout

10 packets captured
 1: 13:06:09.302367 10.1.1.1 > 10.3.3.6: icmp: echo request 
 2: 13:06:09.315230 10.3.3.6 > 10.1.1.1: icmp: echo reply 
 3: 13:06:09.342526 10.1.1.1 > 10.3.3.6: icmp: echo request 
 4: 13:06:09.381221 10.3.3.6 > 10.1.1.1: icmp: echo reply 
 5: 13:06:09.421517 10.1.1.1 > 10.3.3.6: icmp: echo request 
 6: 13:06:09.459174 10.3.3.6 > 10.1.1.1: icmp: echo reply 
 7: 13:06:09.495244 10.1.1.1 > 10.3.3.6: icmp: echo request 
 8: 13:06:09.534213 10.3.3.6 > 10.1.1.1: icmp: echo reply 
 9: 13:06:09.564500 10.1.1.1 > 10.3.3.6: icmp: echo request 
 10: 13:06:09.593215 10.3.3.6 > 10.1.1.1: icmp: echo reply 
10 packets shown

在ASA後查詢其公有IP地址的主機之間的LAN通訊

下載選項

無偏見用語

關於此翻譯

目錄

簡介

必要條件

需求

採用元件

問題：在ASA後查詢其公共IP地址的主機之間的LAN通訊

示例1.源主機PC-A連線到內部ASA介面，而目的主機Test Server連線到DMZ介面。

示例2.源主機和目的主機PC-A和測試伺服器連線到同一內部ASA介面。

示例3.源主機和目的主機PC-A和測試伺服器連線到內部ASA介面，但位於另一個第3層裝置（可以是路由器或多層交換機）的後面。

解決方案

示例1.源主機PC-A連線到內部ASA介面，而目的主機Test Server連線到DMZ介面。

組態

疑難排解

示例2.源主機和目的主機PC-A和測試伺服器連線到同一內部ASA介面。

組態

疑難排解

示例3.源主機和目的主機PC-A和測試伺服器連線到內部ASA介面，但位於另一個第3層裝置（可以是路由器或多層交換機）的後面。

組態

疑難排解

相關資訊

由思科工程師貢獻

這份文件是否有所幫助？

讓思科協助您

本文件適用於這些產品