Newsgroup: it.comp.reti.cisco
Titolo: Migraziore dal router all'asa

Ciao,
vorrei migrare una configurazione fatta su un router cisco per degli
ASA.
Dopo questa configurazione riesco a pingare le varie reti dal firewall
ma gli host sotto le reti non escono su internet.
Cosa manca ? :(
ROUTER :
Current configuration : 4387 bytes
!
! Last configuration change at 00:38:57 CET Sat Feb 26 2011 by neen
! NVRAM config last updated at 00:39:20 CET Sat Feb 26 2011 by neen
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname negw01
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
resource policy
!
clock timezone CET 1
clock summer-time EST recurring 1 Sun Apr 5:00 last Sun Oct 5:00
ip subnet-zero
!
!
ip cef
!
!
ip domain name 
neen.it
login on-failure log
login on-success log
!
!
!
crypto pki trustpoint TP-self-signed-3353781950
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3353781950
 revocation-check none
 rsakeypair TP-self-signed-3353781950
!
!
!
!
!
!
interface FastEthernet0/0
 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0/0$
 ip address 81.29.200.252 255.255.255.248
 no ip proxy-arp
 duplex auto
 speed auto
 standby 1 ip 81.29.200.254
 standby 1 priority 105
 standby 1 preempt
 standby 1 authentication neen
!
interface FastEthernet0/1
 no ip address
 no ip proxy-arp
 duplex auto
 speed auto
!
interface FastEthernet0/1.1
 encapsulation dot1Q 1 native
 ip address 81.29.194.161 255.255.255.240 no snmp trap link-status
 no cdp enable
 standby preempt
 standby 2 ip 81.29.194.163
 standby 2 priority 105
 standby 2 preempt
 standby 2 authentication neenP
 standby 2 track FastEthernet0/0
!
interface FastEthernet0/1.3
 encapsulation dot1Q 3
 ip address 85.159.144.2 255.255.255.0
 no snmp trap link-status
 standby 3 ip 85.159.144.1
 standby 3 priority 105
 standby 3 preempt
 standby 3 authentication neen-sec
!
interface FastEthernet0/1.4
 encapsulation dot1Q 4
 ip address 91.208.152.2 255.255.255.0
 no snmp trap link-status
 standby 4 ip 91.208.152.1
standby 4 priority 105
 standby 4 preempt
 standby 4 authentication neen3
!
interface FastEthernet0/1.5
 encapsulation dot1Q 5
 ip address 81.29.212.50 255.255.255.240
 no snmp trap link-status
 standby 5 ip 81.29.212.49
 standby 5 priority 105
 standby 5 preempt
 standby 5 authentication neen5
!
interface FastEthernet0/1.6
 encapsulation dot1Q 6
 ip address 81.29.215.146 255.255.255.240
 no snmp trap link-status
 standby 6 ip 81.29.215.145
 standby 6 priority 105
 standby 6 preempt
 standby 6 authentication neen6
!
ip classless
ip route 0.0.0.0 0.0.0.0 81.29.200.249
!
no ip http server
no ip http secure-server
!
access-list 23 permit 81.29.194.169
access-list 23 permit 78.134.7.155
access-list 23 deny   any log
!
!
control-plane
!
!
!
line con 0
 login local
line aux 0
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input ssh
line vty 5 15
access-class 23 in
 privilege level 15
 login local
 transport input ssh
!
scheduler allocate 20000 1000
ntp clock-period 17180039
ntp server 193.204.114.105 version 2
!
end
ASA
ASA Version 8.3(1)
!
hostname
domain-name
enable password bpqz7vgptDJV8TXh encrypted
passwd KyGfpjGdrkBannwK encrypted
names
!
interface GigabitEthernet0/0
 nameif Outside
 security-level 0
 ip address 81.29.200.254 255.255.255.248 standby 81.29.200.253
!
interface GigabitEthernet0/1
 nameif Outside2
 security-level 100
 no ip address
!
interface GigabitEthernet0/1.1
 vlan 1
 nameif Outside3
 security-level 0
 ip address 81.29.194.163 255.255.255.240
!
interface GigabitEthernet0/1.3
 vlan 3
 nameif Outside4
 security-level 100
 ip address 85.159.144.1 255.255.255.0
!
interface GigabitEthernet0/1.4
 vlan 4
 nameif Outside5
 security-level 0
 ip address 91.208.152.1 255.255.255.0
!
interface GigabitEthernet0/1.5
 vlan 5
 nameif Outside6
 security-level 0
 ip address 81.29.212.49 255.255.255.240
!
interface GigabitEthernet0/1.6
 vlan 6
 nameif Outside7
 security-level 0
 no ip address
!
interface GigabitEthernet0/1.7
 no vlan
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/0
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/1
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3
 description LAN Failover Interface
!
boot system disk0:/asa831-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name 
neen.it
object-group network neen-network
 network-object host 93.62.198.90
access-list acl_outside extended permit tcp any any
access-list acl_outside extended permit udp any any
access-list acl_outside2 extended permit tcp any any
access-list acl_outside2 extended permit udp any any
access-list acl_outside3 extended permit tcp any any
access-list acl_outside3 extended permit udp any any
access-list acl_outside4 extended permit tcp any any
access-list acl_outside4 extended permit udp any any
access-list acl_outside5 extended permit tcp any any
access-list acl_outside5 extended permit udp any any
access-list acl_outside6 extended permit tcp any any
access-list acl_outside6 extended permit udp any any
access-list acl_outside7 extended permit tcp any any
access-list acl_outside7 extended permit udp any any
pager lines 24
logging enable
logging timestamp
logging standby
logging monitor debugging
logging buffered warnings
logging asdm informational
logging mail alerts
logging from-address 
neenc...@neen.it
logging recipient-address 
monit...@neen.it
 level alerts
logging class auth buffered informational
logging class sys buffered critical
mtu Outside 1500
mtu Outside2 1500
mtu Outside3 1500
mtu Outside4 1500
mtu Outside5 1500
mtu Outside6 1500
mtu Outside7 1500
failover
failover lan unit primary
failover lan interface StateFailover GigabitEthernet1/3
failover polltime unit 15 holdtime 45
failover key *****
failover interface ip StateFailover 192.168.0.1 255.255.255.0 standby
192.168.0.2
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
access-group acl_outside in interface Outside
access-group acl_outside2 in interface Outside2
access-group acl_outside3 in interface Outside3
access-group acl_outside4 in interface Outside4
access-group acl_outside5 in interface Outside5
access-group acl_outside6 in interface Outside6
access-group acl_outside7 in interface Outside7
route Outside 0.0.0.0 0.0.0.0 81.29.200.249 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat
0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-
disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
service resetoutside
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 93.62.198.90 255.255.255.255 Outside
ssh 178.236.176.169 255.255.255.255 Outside
ssh timeout 30
!
tls-proxy maximum-session 1000
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 193.204.114.105 source Outside prefer
ntp server 193.204.114.233 source Outside
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
 inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:91fe8a6d48b1db43ae6fc3ece75795dd
: end

metti le translazioni 1:1 tra le intf host e la Outside.
ciao
