如何配置asa 5505来限制用户只访问公司资源和Skype？

Question

我配置了asa 5505来限制用户只访问公司资源和skype。我让skype工作了，但是ACL中的公司网站是无法访问的。

我做错了什么？

ASA Version 8.2(5)
!
firewall transparent
hostname ciscoasa
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
 shutdown
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
interface Vlan1
 no nameif
 no security-level
!
interface Vlan2
 nameif outside
 security-level 0
!
interface Vlan3
 nameif inside
 security-level 100
!
ftp mode passive
object-group network LIMITED_USERS
 network-object 192.168.108.64 255.255.255.192
object-group network ESSENTIALS
 network-object 196.33.158.28 255.255.255.255
 network-object 212.22.161.2 255.255.255.255
 network-object 196.30.251.214 255.255.255.255
 network-object 212.22.179.162 255.255.255.255
 network-object 41.78.37.84 255.255.255.255
 network-object 91.190.216.21 255.255.255.255
object-group service SKYPE
 service-object tcp-udp gt 1024
access-list LIMIT_TRAFFIC extended permit ip object-group LIMITED_USERS object-group ESSENTIALS
access-list LIMIT_TRAFFIC extended permit object-group SKYPE object-group LIMITED_USERS any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address 192.168.108.6 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group LIMIT_TRAFFIC in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.108.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
console timeout 0
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd option 3 ip 192.168.108.4
!
dhcpd address 192.168.108.65-192.168.108.96 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:ed62961c9bc8bc367be20c8c498bb290
: end

capture DENY type asp-drop all real-time trace输出

 1: 00:58:52.033079 802.1Q vlan#2 P0 192.168.108.9.63084 > 239.255.255.250.3702:  udp 656
   2: 00:58:55.155570 802.1Q vlan#2 P0 fe80::49d5:e406:d284:1d36.546 > ff02::1:2.547:  udp 88 [hlim 1]
   3: 00:58:55.988291 802.1Q vlan#3 P0 192.168.108.65.63090 > 8.8.8.8.53:  udp 36
   4: 00:58:55.988397 802.1Q vlan#3 P0 192.168.108.65.63090 > 8.8.4.4.53:  udp 36
   5: 00:58:58.135643 802.1Q vlan#3 P0 192.168.108.65.51399 > 8.8.4.4.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule
   6: 00:58:59.134789 802.1Q vlan#3 P0 192.168.108.65.51399 > 8.8.8.8.53:  udp 43
   7: 00:59:00.035337 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.4.4.53:  udp 36
   8: 00:59:00.134499 802.1Q vlan#3 P0 192.168.108.65.51399 > 8.8.4.4.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule
   9: 00:59:01.034406 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.8.8.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule
  10: 00:59:02.034132 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.4.4.53:  udp 36
  11: 00:59:02.134072 802.1Q vlan#3 P0 192.168.108.65.51399 > 8.8.8.8.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule
  12: 00:59:02.134163 802.1Q vlan#3 P0 192.168.108.65.51399 > 8.8.4.4.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule
  13: 00:59:03.117791 802.1Q vlan#3 P0 192.168.108.65.49972 > 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 <mss 1460,nop,                      wscale 2,nop,nop,sackOK> Drop-reason: (acl-drop) Flow is denied by configured rule
  14: 00:59:03.616728 802.1Q vlan#3 P0 192.168.108.65.49972 > 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 <mss 1460,nop,                      wscale 2,nop,nop,sackOK>
  15: 00:59:04.033750 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.8.8.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule
  16: 00:59:04.033857 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.4.4.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule
  17: 00:59:04.116647 802.1Q vlan#3 P0 192.168.108.65.49972 > 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 <mss 1460,nop,                      nop,sackOK> Drop-reason: (acl-drop) Flow is denied by configured rule
  18: 00:59:04.296585 802.1Q vlan#2 P0 fe80::9fd:d9c5:9aaf:6667.546 > ff02::1:2.547:  udp 82 [hlim 1]
  19: 00:59:06.134346 802.1Q vlan#3 P0 192.168.108.65.51399 > 8.8.8.8.53:  udp 43
  20: 00:59:06.134468 802.1Q vlan#3 P0 192.168.108.65.51399 > 8.8.4.4.53:  udp 43
  21: 00:59:08.033949 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.8.8.53:  udp 36
  22: 00:59:08.034055 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.4.4.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf  

Answer 1

在捕获中有两个问题..。

1. DNS流量被拒绝..。15: 00:59:04.033750 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.8.8.53: udp 36 Drop-reason: (acl-drop) Flow is denied by configured rule 16: 00:59:04.033857 802.1Q vlan#3 P0 192.168.108.65.62398 > 8.8.4.4.53: udp 36 Drop-reason: (acl-drop) Flow is denied by configured rule
2. 你的一个客户想去79.119.88.88.1，但被拒绝了.17: 00:59:04.116647 802.1Q vlan#3 P0 192.168.108.65.49972 > 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 <mss 1460,nop,nop,sackOK> Drop-reason: (acl-drop) Flow is denied by configured rule

更有可能的是，您的客户端使用主机名访问某些资源，并且需要允许object-group network ESSENTIALS中的DNS通信量达到8.8.8.8和8.8.4.4。

一般来说，最好是制定一条允许所有DNS (即目的地udp/53)的规则，因为DNS查询可以通过其他解析器递归。