¶ 实验需求：
¶ 1. ASA 使用列表放行 Outside 路由器到 DMZ 路由器的 WWW 流量并拒绝 Telnet 流量，当放行和拒绝流量匹配后产生日志通告。
提示：需要使能 ASA的日志功能和 DMZ路由器的 HTTP功能。
设备配置：
access-list Outside_access_in extended permit tcp 202.100.1.0 255.255.255.0 192.168.1.0 255.255.255.0 eq www
access-list Outside_access_in extended deny tcp interface Outside interface DMZ eq telnet
access-group Outside_access_in in interface Outside
测试现象：
拒绝流量
¶ 2. ASA 使用 Object Group 放行 Inside 区域去往 Outside 区域的流量：HTTP（20100.1.1），FTP（20100.1.2），DNS（20100.1.3），并在 PC上测试 HTTP访问。
提示：最后需要放行 SSH流量，否则WIN7 CRT无法管理。
设备配置：
object network Outside-http
host 202.100.1.1
object network Outside-ftp
host 202.100.1.2
object network Outside-dns
host 202.100.1.3
object-group network Outside-app
network-object object Outside-dns
network-object object Outside-ftp
network-object object Outside-http
network-object object Outside-ssh
object-group service Outside-service
service-object tcp destination eq ftp
service-object tcp destination eq http
service-object udp destination eq domain
access-list Inside\_access\_in line 1 extended permit object-group Outside-service 10.1.1.0 255.255.255.0 object-group Outside-app
access-group Inside\_access\_in in interface Inside
outside路由器配置
ip http server
ip http authentication local
测试现象：
##此处展示实验需求的测试结果，可以粘贴文字，也可以粘贴截图##
¶ 3. 放行 Inbound的 ICMP流量并测试。
设备配置：
access-list global\_access line 1 extended permit icmp any any
测试现象：
¶ 4.网管人员怀疑内网中一台主机（10.1.1.100）有问题，想暂时禁止此主机访问（同时也拒绝其他人访问此主机），请给出解决方案。
提示：可用 ping命令和 debug命令展示效果，截图后 no掉该配置即可，以免影响后续实验。
设备配置：
shun 10.1.1.100
测试现象：
¶ 5.禁止 Outside路由器 ping ASA防火墙的 Outside接口（202.100.1.10），但是不影响防火墙 ping Outside路由器（202.100.1.1）。
设备配置：
ASA配置
icmp permit host 202.100.1.1 echo-reply Outside
icmp deny host 202.100.1.1 echo Outside
Outside配置同样效果，二选一
ip access-list extended ping
1 deny icmp host 202.100.1.10 host 202.100.1.1 echo-reply
5 permit icmp any any
interface GigabitEthernet1
ip access-group ping in
测试现象：
¶ 6.参考如下拓扑配置配置防火墙和路由器，将 ASA防火墙的 Outside和 Outside2 口加入 zone，完成 Traffic Zone实验，并配置路由，使去往 1.1.1.1的流量实现负载均衡（zone-name：outside）
ASA# sh conn zone outside | in 1.1.1.1
TCP outside:Outside(Outside) 1.1.1.1:23 Inside 10.1.1.1:22529, idle 0:00:05,bytes 178, flags UIO
TCP outside:Outside(Outside2) 1.1.1.1:23 Inside 10.1.1.100:49186, idle0:04:32, bytes 195, flags UIO
设备配置：
Outside 配置
interface GigabitEthernet2
ip address 202.100.2.1 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 202.100.1.10
ip route 0.0.0.0 0.0.0.0 202.100.2.10
ASA配置
zone outside
interface GigabitEthernet0/0
nameif Outside
security-level 0
zone-member outside
ip address 202.100.1.10 255.255.255.0
interface GigabitEthernet0/3
nameif Outside2
security-level 0
zone-member outside
ip address 202.100.2.10 255.255.255.0
route Outside 0.0.0.0 0.0.0.0 202.100.1.1 1
route Outside2 0.0.0.0 0.0.0.0 202.100.2.1 1
测试现象：
access-list ASA-ZONE-PBR extended permit icmp host 10.1.1.100 host 1.1.1.1
route-map PBR-ASA-ZONE permit 10
match ip address ASA-ZONE-PBR
set ip next-hop 202.100.2.1
interface GigabitEthernet0/0
policy-route route-map PBR-ASA-ZONE
# 删除outside 路由
no ip route 0.0.0.0 0.0.0.0 202.100.2.10
¶ 7.参考如下拓扑配置配置防火墙，按照教主视频完成 Identity Firewall实验。（建议从零预配开始配置，更接近于实际生产环境）
提示：需要看到如下输出：
ASA# show user-identity user active domain QYTANG list detail
Total active users: 2 Total IP addresses: 2
QYTANG: 2 users, 2 IP addresses
QYTANG\\Administrator: 1 active conns; idle 0 mins
192.168.1.200: login 0 mins, idle 0 mins, 1 active conns
QYTANG\\aduser: 3 active conns; idle 0 mins
10.1.1.1: login 0 mins, idle 0 mins, 3 active conns
设备配置：
服务器开启ad服务 添加aduser用户等
ASA
dns domain-lookup DMZ
dns server-group DefaultDNS
name-server 192.168.1.100
domain-name qytang.com
aaa-server QYTAD protocol ldap
aaa-server QYTAD (DMZ) host 192.168.1.100
server-port 389
ldap-base-dn DC=qytang,DC=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password Cisc0123
ldap-login-dn cn=administrator,cn=users,dc=qytang,dc=com
server-type auto-detect
ADagent
CMD:adacfg dc create -name QYTAD -host ad.qytang.com -domain qytang.com -user administrator -password Cisc0123
CMD:adacfg syslog create -name kiwi-server -ip 192.168.1.200
AD域控
aaa-server adagent protocol radius
ad-agent-mode
aaa-server adagent (DMZ) host 192.168.1.200
key cisco
！
user-identity domain QYTANG aaa-server QYTAD
user-identity default-domain QYTANG
user-identity ad-agent aaa-server adagent
aaa authentication ssh console LOCAL
！
object-group user qytang-aduser
user QYTANG\\aduser
object-group user qytang-group
user-group QYTANG\\\\adgroup
access-list in extended deny icmp object-group-user qytang-aduser any host 192.168.1.200
access-list in extended permit ip any any
access-group in in interface Inside
policy-map global\_policy
class inspection\_default
inspect icmp
确保client和ad server通信正常
show user-identity user active domain qytang list detail
测试现象：
