ASA Version 7.2(2) ! hostname ASA-AIP-CLI domain-name corp.com enable password WwXYvtKrnjXqGbu1 encrypted names ! interface Ethernet0/0 nameif Outside security-level 0 ip address 192.168.1.2 255.255.255.0 ! interface Ethernet0/1 nameif Inside security-level 100 ip address 10.1.1.1 255.255.255.0 ! interface Ethernet0/2 nameif DMZ security-level 50 ip address 172.16.1.12 255.255.255.0 ! interface Ethernet0/3 no nameif no security-level no ip address ! interface Management0/0 no nameif no security-level no ip address ! !--- Output is suppressed. !--- Permit inbound FTP control traffic. access-list 100 extended permit tcp any host 192.168.1.5 eq ftp !--- Permit inbound FTP data traffic. access-list 100 extended permit tcp any host 192.168.1.5 eq ftp-data ! !--- Command to redirect the FTP traffic received on IP 192.168.1.5 !--- to IP 172.16.1.5. static (DMZ,outside) 192.168.1.5 172.16.1.5 netmask 255.255.255.255 access-group 100 in interface outside class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! !--- This command tells the device to !--- use the "global_policy" policy-map on all interfaces. service-policy global_policy global LAN Outbound FTP Access :access-list inside extended permit tcp host 10.1.1.254 any eq ftp Create Object group in order to tidy config : object-group service Bluecoatbypass tcp description Bypass for bluecoat server port-object eq echo port-object eq irc port-object eq ftp-data port-object range 3389 3389 port-object eq domain port-object range 8080 8080 port-object eq pop3 port-object eq ftp port-object eq www port-object eq https port-object eq 1935 port-object eq ssh ! Create Access-list : access-list inside extended permit tcp host 10.1.1.254 any object-group BluecoatbypassVerify : show access-list | grep ftp | grep 10.1.1.254 show service-policy inspect ftp show service-policy global
Comments
(There are currently no comments for this post.)