Új hozzászólás Aktív témák

• #12651 crok Topikgazda Gesztiboy #12650

  Új Válasz 2017-02-25 20:09:40 #12651

  Új hozzászólás

  Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra

  Privát üzenet küldése

  

  crok

  Topikgazda

  válasz Gesztiboy #12650 üzenetére

  Ezt mentettem ki magamnak anno ASA pcap-re a kis gyűjteményembe:
  http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/110117-asa-capture-asdm-config.html
  http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html
  1. Configure the Inside and Outside interfaces as shown in the network diagram with IP address and Security-levels.
  2. Configure the access-lists asdm_cap_selector_inside and asdm_cap_selector_outside for capturing the
  packets that travel from the inside network to the outside network and outside network to inside network.
  access-list asdm_cap_selector_inside extended permit ip host 10.20.10.2 host 172.16.1.2
  access-list asdm_cap_selector_inside extended permit ip host 172.16.1.2 host 10.20.10.2
  access-list asdm_cap_selector_outside extended permit ip host 172.16.1.2 host 10.20.10.2
  access-list asdm_cap_selector_outside extended permit ip host 10.20.10.2 host 172.16.1.2
  3. Start the packet capture process using the capture command in privileged EXEC mode.
  The capture command should be used after the access-lists have been configured as shown in the ASA configuration.
  In this configuration example, the capture named capin is defined. Bind it to the inside interface, and specify
  to only capture packets that match the access-list asdm_cap_selector_inside as shown here:
  ASA#capture capin interface inside access-list asdm_cap_selector_inside
  Similarly, the capture named capout is defined. Bind it to the outside interface,
  and specify to only capture packets that match the access-list asdm_cap_selector_outside as shown here:
  ASA#capture capout interface outside access-list asdm_cap_selector_outside
  The ASA will now start capturing the traffic flow between the interfaces. In order to stop the capture
  at any time, use the no capture command followed by the capture name.
  4. Check the captures:
  ASA#show capture capin
  20 packets captured
  1: 01:49:24.087474 10.20.10.2 > 172.16.1.2: icmp: echo request
  2: 01:49:24.087474 172.16.1.2 > 10.20.10.2: icmp: echo reply
  <..omitted..>
  19: 01:49:26.257051 172.16.1.2 > 10.20.10.2: icmp: echo request
  20: 01:49:26.257051 10.20.10.2 > 172.16.1.2: icmp: echo reply
  20 packets shown
  ASA#
  The show capture capout command shows the contents of the capture buffer named capout.
  ASA#show capture capout
  20 packets captured
  1: 01:49:24.087474 10.20.10.2 > 172.16.1.2: icmp: echo request
  2: 01:49:24.087474 172.16.1.2 > 10.20.10.2: icmp: echo reply
  <..omitted..>
  19: 01:49:26.257051 172.16.1.2 > 10.20.10.2: icmp: echo request
  20: 01:49:26.257051 10.20.10.2 > 172.16.1.2: icmp: echo reply
  20 packets shown

Új hozzászólás Aktív témák