{"id":1199,"date":"2016-05-30T15:46:04","date_gmt":"2016-05-30T14:46:04","guid":{"rendered":"http:\/\/diablo.craem.net\/?p=1199"},"modified":"2016-05-30T15:46:04","modified_gmt":"2016-05-30T14:46:04","slug":"cisco-asa-8-2-to-9-x-migrando-parte-4","status":"publish","type":"post","link":"https:\/\/diablo.craem.net\/?p=1199","title":{"rendered":"Cisco ASA 8.2 to 9.x :: migrando :: parte 4"},"content":{"rendered":"<p>Seguimos migrando&#8230;.<br \/>\nAhora toca a\u00f1adir ssh para acceder a la config desde el exterior&#8230; los pasos:<br \/>\n<code><br \/>\nasa(config)#username pix password password privilege 15<br \/>\nasa(config)#aaa authentication ssh console LOCAL<br \/>\nasa(config)#crypto key generate rsa<br \/>\nWARNING: You have a RSA keypair already defined named <default-RSA-Key>.<br \/>\nDo you really want to replace them? [yes\/no]: yes<br \/>\nKeypair generation process begin. Please wait...<br \/>\nasa(config)#ssh 1.1.1.0 255.255.255.0 outside<br \/>\n<\/code><br \/>\nY ahora ordenamos los nats&#8230;.. en las configs anteriores no estaba del todo claro:<br \/>\nsuponemos que tenemos los servers siguientes:<br \/>\nserver11, server12 y server13 y hemos de abrir varios puertos con cada uno de ellos:<br \/>\n<code><br \/>\nobject network srv-192.168.0.13_3389<br \/>\n host 192.168.0.13<br \/>\n description server13_3389<br \/>\nobject network srv-192.168.0.12_21<br \/>\n host 192.168.0.12<br \/>\n description server12_21<br \/>\nobject network srv-192.168.0.12_20<br \/>\n host 192.168.0.12<br \/>\n description server12_20<br \/>\nobject network srv-192.168.0.12_20_udp<br \/>\n host 192.168.0.12<br \/>\n description server12_20<br \/>\nobject network srv-192.168.0.11_80<br \/>\n host 192.168.0.11<br \/>\n description server11_80<br \/>\nobject network srv-192.168.0.11_443<br \/>\n host 192.168.0.11<br \/>\n description server11_443<br \/>\nobject network srv-192.168.0.11_110<br \/>\n host 192.168.0.11<br \/>\n description server11_110<br \/>\nobject network srv-192.168.0.11_143<br \/>\n host 192.168.0.11<br \/>\n description server11_143<br \/>\nobject network srv-192.168.0.11_587<br \/>\n host 192.168.0.11<br \/>\n description server11_587<br \/>\naccess-list outside_in extended permit tcp any object server13 eq 444<br \/>\naccess-list outside_in extended permit tcp any object server13 eq 3389<br \/>\naccess-list outside_in extended permit tcp any object server12 eq ftp<br \/>\naccess-list outside_in extended permit tcp any object server12 eq ftp-data<br \/>\naccess-list outside_in extended permit udp any object server12 eq 20<br \/>\naccess-list outside_in extended permit tcp any object server11 eq www<br \/>\naccess-list outside_in extended permit tcp any object server11 eq httpss<br \/>\naccess-list outside_in extended permit tcp any object server11 eq pop3<br \/>\naccess-list outside_in extended permit tcp any object server11 eq imap4<br \/>\naccess-list outside_in extended permit tcp any object server11 eq 587<br \/>\nobject network srv-192.168.0.13_444<br \/>\n nat (inside,outside) static interface service tcp 444 444<br \/>\nobject network srv-192.168.0.13_3389<br \/>\n nat (inside,outside) static interface service tcp 3389 3389<br \/>\nobject network srv-192.168.0.12_21<br \/>\n nat (inside,outside) static interface service tcp ftp ftp<br \/>\nobject network srv-192.168.0.12_20<br \/>\n nat (inside,outside) static interface service tcp ftp-data ftp-data<br \/>\nobject network srv-192.168.0.12_20_udp<br \/>\n nat (inside,outside) static interface service tcp ftp-data ftp-data<br \/>\nobject network srv-192.168.0.11_80<br \/>\n nat (inside,outside) static interface service tcp www www<br \/>\nobject network srv-192.168.0.11_443<br \/>\n nat (inside,outside) static interface service tcp httpss httpss<br \/>\nobject network srv-192.168.0.11_110<br \/>\n nat (inside,outside) static interface service tcp pop3 pop3<br \/>\nobject network srv-192.168.0.11_143<br \/>\n nat (inside,outside) static interface service tcp imap4 imap4<br \/>\naccess-group outside_in in interface outside<br \/>\n<\/code><br \/>\nEs bastante m\u00e1s engorroso, pero supongo que tendr\u00e1 una explicaci\u00f3n \ud83d\ude09<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Seguimos migrando&#8230;. Ahora toca a\u00f1adir ssh para acceder a la config desde el exterior&#8230; los pasos: asa(config)#username pix password password privilege 15 asa(config)#aaa authentication ssh console LOCAL asa(config)#crypto key generate rsa WARNING: You have a RSA keypair already defined named . Do you really want to replace them? [yes\/no]: yes Keypair generation process begin. Please [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[13,25,41],"class_list":["post-1199","post","type-post","status-publish","format-standard","hentry","category-cisco","tag-9-x","tag-asa","tag-cisco"],"_links":{"self":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/1199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1199"}],"version-history":[{"count":0,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/1199\/revisions"}],"wp:attachment":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}