之前根本没接触过ASA系列，研究了1天，可以远程登录服务器，可以ssh
hostname ciscoasa

enable password 1111111111111

passwd 11111111111111

names

!

interface GigabitEthernet0/0

 nameif outside

 security-level 0  

 ip address 1.1.1.2 255.255.255.252

!

interface GigabitEthernet0/1

 nameif ENI

 security-level 0

 ip address 2.2.2.2 255.255.255.252

!

interface GigabitEthernet0/2

 nameif 2950

 security-level 100

 ip address 192.168.7.254 255.255.255.0

!

interface GigabitEthernet0/3

 nameif wuxian

 security-level 100

 ip address 192.168.8.254 255.255.255.0

!

interface Management0/0

 shutdown

 no nameif

 no security-level

 no ip address

!

ftp mode passive

clock timezone GMT 0

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list vnet extended permit ip 192.168.7.0 0.0.0.255  

access-list vnet extended permit ip 192.168.8.0 0.0.0.255

pager lines 24

mtu outside 1500

mtu ENI 1500

mtu inside 1500

mtu wuxian 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-625-53.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

global (ENI) 1 interface

nat (2950) 1 192.168.7.0 255.255.255.0

nat (wuxian) 1 192.168.8.0 255.255.255.0

static (2950,outside) tcp interface 3314 192.168.7.14 3389 netmask 255.255.255.255

access-group vnet in interface ENI 

access-group vnet in interface 2950

access-group vnet in interface wuxian 

route outside 0.0.0.0 0.0.0.0 1.1.1.2 1

route ENI 2.2.2..0 255.255.255.0 2.2.2.2 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 0.0.0.0 0.0.0.0 inside

http 0.0.0.0 0.0.0.0 wuxian

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet 0.0.0.0 0.0.0.0 2950

telnet 0.0.0.0 0.0.0.0 wuxian 

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 60

ssh version 1

console timeout 0

dhcpd dns 202.96.209.5 

!

dhcpd address 192.168.8.1-192.168.8.250 wuxian 

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username 11111 password 11111111111111111 encrypted privilege 15

username 1111111 password 1111111111111111 encrypted privilege 15

!
crypto key generate rsa

aaa authentication ssh console LOCAL

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

 profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:8abd74a7c5f56426c06cd1808e787259

: end