помогите новичку, имеем настроеную систему, надо внести изменения.
есть asa 5520
у нее 4 физ. интерфейса inside, inside RF1, inside RF2, outside
inside подключен к коммутатору в локальную сеть, insideRF1 подключен к софтверному фаерволу (TMG1), insideRF2 аналогично к TMG2, outside на основной раутер cisco 2801 в конечном итоге через него все в и-нет и в филиалы вылетают. надо
1. чтобы трафик приходящий на int inside валился на int insideRF1, при этом работа с филиалами также шла через int outside напрямую.
2. почему инт insideRF1 в дауне лежит (см. конфу)
--------------
names
dns-guard
!
interface GigabitEthernet0/0
duplex full
nameif outside
security-level 0
ip address 172.20.15.2 255.255.255.192
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.15.1 255.255.255.0
!
interface GigabitEthernet0/2
nameif insideRF1
security-level 0
ip address 172.20.15.129 255.255.255.192
!
interface GigabitEthernet0/3
shutdown
nameif insideRF2
security-level 100
ip address 172.20.15.193 255.255.255.192
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd PQ encrypted
ftp mode passive
same-security-traffic permit intra-interface
access-list to_vpn extended permit ip 192.168.15.0 255.255.255.0 192.168.0.0 255
.255.0.0
access-list to_vpn extended permit ip 192.168.15.0 255.255.255.0 172.16.0.0 255.
248.0.0
-------------
pager lines 24
logging enable
logging buffered informational
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu insideRF1 1500
mtu insideRF2 1500
mtu management 1500
no failover
asdm image disk0:/asdm-507.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 2 interface
global (insideRF1) 2 interface
nat (inside) 0 access-list to_vpn
access-group outside in interface outside
access-group inside in interface inside
route outside 0.0.0.0 0.0.0.0 172.20.15.1 100
route outside 192.168.38.0 255.255.255.0 172.20.38.1 1
route outside 192.168.39.0 255.255.255.0 172.20.39.1 1
route outside 192.168.40.0 255.255.255.0 172.20.40.1 1
route outside 192.168.41.0 255.255.255.0 172.20.41.1 1
route outside 192.168.46.0 255.255.255.0 172.20.46.1 1
route outside 192.168.44.0 255.255.255.0 172.20.44.1 1
route outside 192.168.43.0 255.255.255.0 172.20.43.1 1
route outside 192.168.35.0 255.255.255.0 172.20.35.1 1
route outside 192.168.33.0 255.255.255.0 172.20.33.1 1
route outside 192.168.47.0 255.255.255.0 172.20.47.1 1
route insideRF1 0.0.0.0 0.0.0.0 172.20.15.130 110
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username root password a encrypted privilege 15
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set corp esp-3des esp-md5-hmac
crypto ipsec transform-set gngss_ipsec esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600
crypto map tnmoskow 1 set security-association lifetime seconds 28800
crypto map kspd 1 match address to_corp
crypto map kspd 1 set peer xxx.xxx.xxx.xxx

-------
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
tunnel-group xxx.xxx.xxx.xxx type ipsec-l2l
tunnel-group xxx.xxx.xxx.xxx ipsec-attributes
pre-shared-key *
-------
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:fad
: end
-----------------------------------
ASA-1# sh int ip br
Interface                  IP-Address      OK? Method Status                Prot
ocol
GigabitEthernet0/0         172.20.15.2     YES manual up                    up
GigabitEthernet0/1         192.168.15.1    YES CONFIG up                    up
GigabitEthernet0/2         172.20.15.129   YES manual down                  down
GigabitEthernet0/3         172.20.15.193   YES CONFIG administratively down up
Management0/0              192.168.1.1     YES CONFIG down                  down