配置等级策略，保证outside端口可以访问inside端口
access-list 100 extended permit icmp any any
access-list 100 extended permit ip any any
access-group 100 in interface outside
做PAT：
object network nat
subnet 192.168.1.0 255.255.255.0
nat (inside,ouside) dynamic interfac
做路由：
route outside 0.0.0.0 0.0.0.0 60.22.23.1
把内网路由到外网（内网的默认路由）
route inside 172.168.1.0 255.255.255.0 172.16.1.1 1
把外网路由到内网
route inside 192.168.0.0 255.255.0.0 172.16.1.1 1
9：开启SSH和telnet：
ciscoasa(config)#crypto key generate rsa modulus 1024
ciscoasa(config)#write mem
ciscoasa(config)#ssh 0.0.0.0 0.0.0.0 outside
//任何外网都可以通过shh登录
ciscoasa(config)#ssh timeout 30 //设置超时时间,单位为分钟
ciscoasa(config)#ssh version 1 //指定SSH版本,可以选择版本2
ciscoasa(config)#passwd 密码 //passwd命令所指定的密码为远程访问密码
telnet 0.0.0.0 0.0.0.0 inside
telnet 192.168.10.0 255.255.255.0 inside
telnet 10.1.2.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
开启ASDM
asdm image disk0:/asdm-645.bin
no asdm history enable
http server enable
http 192.168.0.0 255.255.0.0 inside
http 192.168.1.0 255.255.255.0 management
http 192.168.10.0 255.255.255.0 inside
配置SSL VPN：
----------------------产生证书---------------------------
crypto key generate rsa label asa.yeslab.net modulus 1024
crypto ca trustpoint localtrustpoint
enrollment self
fqdn asa.yeslab.net
subject-name cn=asa.yeslab.net
keypair asa.yeslab.net
crl configure
ssl trust-point localtrustpoint
---------------------anyconnect配置---------------------------
webvpn
enable outside
no anyconnect-essentials
anyconnect image disk0:/anyconnect-win-3.0.1047-k9.pkg 1
anyconnect enable
ip local pool vpn-pool 172.16.2.1-172.16.2.100
根据原有配置或者客户需求配置该地址池
group-policy simapolicy internal
group-policy simapolicy attributes
vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
address-pools value vpn-pool
webvpn
url-list none
anyconnect ask enable
url-entry disable
username sima password 123 privilege 15 更具客户安排定义用户名和密码
username sima attributes
vpn-group-policy simapolicy
---------------------------IKEv2配置-----------------------------------
crypto ikev2 enable Outside client-services port 443
crypto ikev2 remote-access trustpoint localtrustpoint
crypto ikev2 policy 10
crypto ipsec ikev2 ipsec-proposal ikev2-p
crypto dynamic-map dymap 100 set ikev2 ipsec-proposal
ikev2-p
crypto map cisco 1000 ipsec-isakmp dynamic dymap
crypto map cisco interface Outside
12：隧道分离：
ciscoasa(config)# access-list split-ssl extended permit ip
172.16.1.0 255.255.255.252 any
!注意源地址为ASA的inside网络地址，目标地址始终为any
!
ciscoasa(config)# group-policy sslvpn-group-policy
attributes
ciscoasa(config-group-policy)# split-tunnel-policy
tunnelspecified
ciscoasa(config-group-policy)# split-tunnel-network-list value
split-ssl
13：SSL VPN关注流量不需要NAT：
object network inside-router-loop0
subnet 192.168.0.0 255.255.0.0
object network remote-vpn-address
subnet 172.16.2.0 255.255.255.0 //定义object关联做nat豁免
nat (inside,outside) source static inside-router-loop0
inside-router-loop0 destination static remote-vpn-address
remote-vpn-address
14: 端口映射
dhcpd address 192.168.55.2-192.168.55.254 management
dhcpd enable management
object network obj-192.168.2.27
host 192.168.2.27
object network obj-192.168.2.13
host 192.168.2.13
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) static 202.97.156.21 server tcp www
www
ERROR: Address 202.97.156.21 overlaps with outside interface
address.
ERROR: NAT Policy is not downloaded
object network obj-192.168.2.27
nat (inside,outside) static 218.26.213.126 service tcp www
8080
object network obj-192.168.2.13
nat (inside,outside) static 218.26.213.126 service tcp www
www
object network obj_any
nat (inside,outside) dynamic interface
SSL连接建立成功以后，ASA上将自动创建指向客户的静态路由。
