Cisco ASA 5512 設定 DHCP & NAT

顯示目前的interface狀態

ciscoasa# conf t
ciscoasa(config)# show int ip bri

找一個interface當做vlan接口

ciscoasa(config)# int gigabitEthernet 0/5
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit

設定 IEEE 802.1Q VLAN Identifier

ciscoasa(config)# interface gigabitEthernet 0/5.200
ciscoasa(config-subif)# vlan 200
ciscoasa(config-subif)# nameif Corp_LAN
ciscoasa(config-subif)# security-level 100
ciscoasa(config-subif)# ip address 192.168.200.254 255.255.255.0
ciscoasa(config-subif)# exit

設定DHCP Server

ciscoasa(config)# dhcpd address 10.10.200.1-10.10.200.250 Corp_LAN
ciscoasa(config)# dhcpd dns 168.95.1.1 8.8.8.8
ciscoasa(config)# dhcpd lease lease_length                      # 預設是3600sec，0 to 1,048,575
ciscoasa(config)# dhcpd domain domain_name
ciscoasa(config)# dhcpd option 3 ip 10.10.200.254(gateway_ip)   # dhcpd option 3 這是定義dhcp client的default gateway
                                                                # 如果不用的話，就會被改用management interface
                                                                # 這interface是不包含DHCP ACK這個選項的
                                                                # 所以不會去幫你做轉送。
ciscoasa(config)# dhcpd enable Corp_LAN                         # 啟用dhcp server

顯示目前的vlan

ciscoasa(config)# show vlan

顯示目前DHCP Server的設定

ciscoasa(config)# show running-config dhcpd

dhcpd option 3 ip 10.10.200.254
!
dhcpd address 10.10.200.1-10.10.200.250 Corp_LAN
dhcpd dns 168.95.1.1 8.8.8.8 interface Corp_LAN
dhcpd enable Corp_LAN

設定ACL - 讓DHCP Client可以正常ping internet

ciscoasa(config)# access-list ACL_OUT permit icmp any any

新增 global_policy

ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class inspection_default
ciscoasa(config-pmap-c)# inspect icmp 
ciscoasa(config-pmap-c)# inspect icmp error        # Enable NAT on icmp error messages

Reference:

• Chapter: Configuring DHCP
• Cisco ASA 5500 – Sub Interfaces and VLANS
• Can't ping out to the internet from the internal LAN through ASA5505