能ping通asa内部设备，但无法ssh或telnet
如图ASA上用了failover（两台ASA配置完全一样），4507对内作了HSRP内网有一台服务器地址是192.80.21.107，经过4507--ASA5550--7609出公网，在ASA5550上做了NAT（因为ASA上其实已经是公网地址）
static (inside-4507-1,outside-1) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
static (inside-4507-1,outside-2) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
static (inside-4507-2,outside-2) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
static (inside-4507-2,outside-1) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
（为了冗余asa的内外网提供了4个接口，所以做了4种映射）
现在有个问题，用了一段时间后，发现可以从公网ping通100.100.100.75，但ssh确上不去。
处理的办法就是，重新修改一下nat的映射地址，比如把原有的nat都删掉，再依次执行
static (inside-4507-1,outside-1) 100.100.100.76 192.80.21.107 netmask 255.255.255.255
no static (inside-4507-1,outside-1) 100.100.100.76 192.80.21.107 netmask 255.255.255.255
static (inside-4507-1,outside-1) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
这时100.100.100.75 又能ssh了
请问大家这是怎么回事？或者有没有办法排查一下？谢谢
附ASA上的配置
interface GigabitEthernet0/0
description LAN/STATE Failover Interface
!
interface Management0/0
nameif MANAGE
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
interface GigabitEthernet1/0
nameif inside-4507-2
security-level 100
ip address 192.80.2.5 255.255.255.252
!
interface GigabitEthernet1/1
nameif inside-4507-1
security-level 100
ip address 192.80.2.1 255.255.255.252
!
interface GigabitEthernet1/2
nameif outside-1
security-level 0
ip address 100.100.100.66 255.255.255.252
!
interface GigabitEthernet1/3
nameif outside-2
security-level 0
ip address 100.100.100.74 255.255.255.252
!
ftp mode passive
clock timezone CST 8
dns server-group DefaultDNS
domain-name default.domain.invalid
same-security-traffic permit inter-interface
access-list outside extended permit icmp any any
access-list outside extended permit tcp any any eq telnet
access-list outside extended permit tcp any any eq pcanywhere-data
access-list outside extended permit udp any any eq pcanywhere-status
access-list outside extended permit tcp any any eq 3389
access-list outside extended permit tcp any any eq ssh
access-list inside extended permit icmp any any
access-list inside extended permit ip any any
access-list inside extended permit udp any any
pager lines 24
mtu MANAGE 1500
mtu inside-4507-2 1500
mtu inside-4507-1 1500
mtu outside-1 1500
mtu outside-2 1500
failover
failover lan unit secondary
failover lan interface ASA-failover GigabitEthernet0/0
failover link ASA-failover GigabitEthernet0/0
failover interface ip ASA-failover 10.1.1.1 255.255.255.252 standby 10.1.1.2
asdm image disk0:/asdm512-k8.bin
no asdm history enable
arp timeout 14400
global (outside-1) 1 100.100.100.70
nat (inside-4507-2) 1 192.80.21.240 255.255.255.240
nat (inside-4507-1) 1 192.80.21.240 255.255.255.240
static (inside-4507-1,outside-1) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
static (inside-4507-1,outside-2) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
static (inside-4507-2,outside-2) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
static (inside-4507-2,outside-1) 100.100.100.75 192.80.21.107 netmask 255.255.255.255
static (inside-4507-1,outside-1) 100.100.100.77 192.80.21.252 netmask 255.255.255.255
static (inside-4507-2,outside-1) 100.100.100.77 192.80.21.252 netmask 255.255.255.255
access-group inside in interface inside-4507-2
access-group inside in interface inside-4507-1
access-group outside in interface outside-1
access-group outside in interface outside-2
route inside-4507-2 192.80.0.0 255.255.0.0 192.80.2.6 2
route inside-4507-1 192.80.0.0 255.255.0.0 192.80.2.2 1
route outside-1 0.0.0.0 0.0.0.0 100.100.100.65 1
route outside-2 0.0.0.0 0.0.0.0 100.100.100.73 2
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 MANAGE
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.80.0.0 255.255.0.0 inside-4507-2
telnet 192.80.0.0 255.255.0.0 inside-4507-1
telnet timeout 5
ssh timeout 5
console timeout 0
management-access MANAGE
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
Cryptochecksum:9920fd7d1cd1ed32c1a226abc90b1c14
: end
页:
[1]