ASA Version 7.2(2)
!
hostname ASA-AIP-CLI
domain-name corp.com
enable password WwXYvtKrnjXqGbu1 encrypted
names
!
interface Ethernet0/0
nameif Outside
security-level 0
ip address 192.168.1.2 255.255.255.0
!
interface Ethernet0/1
nameif Inside
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface Ethernet0/2
nameif DMZ
security-level 50
ip address 172.16.1.12 255.255.255.0
!
interface Ethernet0/3
no nameif
no security-level
no ip address
!
interface Management0/0
no nameif
no security-level
no ip address
!
!--- Output is suppressed.
!--- Permit inbound FTP control traffic.
access-list 100 extended permit tcp any host 192.168.1.5 eq ftp
!--- Permit inbound FTP data traffic.
access-list 100 extended permit tcp any host 192.168.1.5 eq ftp-data
!
!--- Command to redirect the FTP traffic received on IP 192.168.1.5
!--- to IP 172.16.1.5.
static (DMZ,outside) 192.168.1.5 172.16.1.5 netmask 255.255.255.255
access-group 100 in interface outside
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
!--- This command tells the device to
!--- use the "global_policy" policy-map on all interfaces.
service-policy global_policy global
LAN Outbound FTP Access :
access-list inside extended permit tcp host 10.1.1.254 any eq ftp
Create Object group in order to tidy config :
object-group service Bluecoatbypass tcp
description Bypass for bluecoat server
port-object eq echo
port-object eq irc
port-object eq ftp-data
port-object range 3389 3389
port-object eq domain
port-object range 8080 8080
port-object eq pop3
port-object eq ftp
port-object eq www
port-object eq https
port-object eq 1935
port-object eq ssh
!
Create Access-list :
access-list inside extended permit tcp host 10.1.1.254
any object-group Bluecoatbypass
Verify :
show access-list | grep ftp | grep 10.1.1.254
show service-policy inspect ftp
show service-policy global