我想在我的 ASA 上改进从外部主机到内部网络的端口转发。
网络和主机位于两个不同的接口上，内部网络位于内部接口 g0/1 上，IP 地址为 192.168.10.0/24，而外部主机位于外部接口 g0/7 上，IP 地址为 192.168.17.57。对于我的配置，我使用端口 500 来尝试配置端口转发。
使用 Windows 功能“Internet 信息服务”，我能够使用“192.168.17.57:500”从内部子网与外部主机进行通信，但我无法从外部主机与内部网络执行相同操作。
如何启用它？
这是我的配置：
interface GigabitEthernet0/0
nameif inside7
security-level 100
ip address 192.168.8.1 255.255.255.0
interface GigabitEthernet0/1
nameif inside1
security-level 100
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/2
nameif inside2
security-level 100
ip address 192.168.12.1 255.255.255.0
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
interface GigabitEthernet0/5
shutdown
no nameif
no security-level
no ip address
interface GigabitEthernet0/6
shutdown
no nameif
no security-level
no ip address
interface GigabitEthernet0/7
nameif outside7
security-level 0
ip address 192.168.17.1 255.255.255.0
interface GigabitEthernet0/8
shutdown
no nameif
no security-level
no ip address
interface Management0/0
management-only
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
ftp mode passive
dns server-group DefaultDNS
domain-name copying.com
object network RETE1
range 192.168.10.100 192.168.10.160
object network RETE7
host 192.168.17.1
object network rete1
subnet 192.168.10.0 255.255.255.0
object service PORT
service tcp destination eq 500
object network rete17
host 192.168.17.57
object network RETE17
subnet 192.168.17.0 255.255.255.0
object service HTTP
service tcp destination eq www
object network HOST1
host 192.168.10.102
access-list ACL2 extended permit tcp 192.168.10.0 255.255.255.0 interface outside7 eq 500
access-list ACL extended permit tcp host 192.168.17.57 192.168.10.0 255.255.255.0 eq 500
access-list ACL extended permit tcp host 192.168.17.57 192.168.10.0 255.255.255.0 eq www
access-list ICMP extended permit icmp host 192.168.17.57 192.168.10.0 255.255.255.0
pager lines 23
logging asdm informational
mtu inside7 1500
mtu inside1 1500
mtu inside2 1500
mtu outside7 1500
mtu management 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside1,outside7) source static RETE1 interface service PORT HTTP
nat (outside7,inside1) source static rete17 interface service PORT HTTP
access-group ACL2 out interface inside1
access-group ACL in interface outside7
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
no service password-recovery
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
auto-import
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
class-map inspection_default
match default-inspection-traffic
class-map ICMP-CLASS
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map ICMP-POLICY
class ICMP-CLASS
inspect icmp
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
service-policy ICMP-POLICY interface outside7
no call-home reporting anonymous
call-home
答案1
安德里亚，
我不确定我是否正确理解了你的问题。
您说内部接口 g0/1 的 IP 地址为 192.168.10.0/24。好的，这很合理。
您说您的外部主机位于外部接口 g0/7 上，IP 地址为 192.168.17.57。您说的“外部主机”是什么意思？此路由器不用作网关（仅用于内部流量路由）吗？
无论如何，执行端口重定向的正确方法如下。
对于目标主机（响应 TCP 端口 500 上收到的请求的主机），您需要创建一个对象。在下面的代码中替换私人的使用目标主机的私有IP地址。
object network obj_*Private*
host *Private*
然后，您需要添加 NAT 语句，以便将流量从私有 IP 地址转换为公有 IP 地址。在下面的代码中，您需要将“inside”更改为目标主机的私有 IP 地址所连接的接口，将“outside”更改为服务请求源所连接的接口，将民众到您要用于主机的公共 IP 地址，将 SPORT 更改为要发出请求的端口，并将 DPORT 更改为服务器将接受请求的端口。
nat (inside,outside) static *Public* service tcp SPORT DPORT
您的最终更改可能看起来像这样。
object network obj_192.168.10.102
host 192.168.10.102
nat (inside,outside) static 192.168.17.57 service tcp 500 500