gwaynez

我用的是ASA802 UDP版本的，通过虚拟的Cisco3660 路由器交换模块和VM虚拟机上的Windows2000 和Windows XP通讯，已经把楼主的RULes文件拷贝进Fiddler， 然后ASDM602 和ASDM603都试了，当出现以下画面后：

接着并没有出现：


然后浏览器出现错误信息，The page cannot be displayed，Cannot find server or DNS Error。

wg4ne

cpu 100%忙的朋友，请关掉asdm logging功能
默认的debugging级别的logging很耗费系统资源，就是在实际的系统中打开这个也很耗费cpu

锅巴粥

gwaynez:

show run 你的配置，还有dir flash,我怀疑你可能遇到了这个问题:
拷贝asdm602到ASA中，然后又将ASA从FLASH中delete,接着又拷了个603到系统中了。
其实这个时候show run里的配置还是asdm602.bin没有自动改过来，(asdm image disk0:/asdm-602.bin)
这样会导致提示说找不到服务器。

或许你遇到了这个问题。你再仔细看看.
如果你遇到了这个rename flash中的文件名改为show run中的文件名一致

zzlonline

楼主用的是udp的吗?asdm一登我就死了累啊

gwaynez

我ASA的配置如下，
asa802#
asa802# sh run
: Saved
:
ASA Version 8.0(2)
!
hostname asa802
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 192.168.11.11 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.10.254.12 255.255.255.0
!
interface Ethernet0/2
nameif dmz
security-level 0
ip address 192.168.13.13 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif   
no security-level
no ip address
!
interface Ethernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/5
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!            
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny  
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip  
  inspect xdmcp
!
service-policy global_policy global
username admin password f3UhLvUj1QsXsuK7 encrypted privilege 15
username ronsun password arAvk/QGvhiRdea6 encrypted
prompt hostname context
Cryptochecksum:f9c3c7fde168599a32eaa586a670bfe3
: end
asa802#
asa802#
asa802# dir

Directory of disk0:/

4      drwx  2048        12:18:06 Dec 02 2007  .private
10     drwx  2048        14:33:48 Dec 03 2007  boot
7      drwx  2048        14:35:38 Dec 02 2007  csco_config
55     -rwx  6889764     14:16:34 Dec 03 2007  asdm-602.bin

15679488 bytes total (8617984 bytes free)
asa802#


同时打开 #debug asdm history 和 #debug ip packet ,

asa802#
asa802# sh logg
Syslog logging: enabled
    Facility: 20
    Timestamp logging: disabled
    Standby logging: disabled
    Deny Conn when Queue Full: disabled
    Console logging: disabled
    Monitor logging: disabled
    Buffer logging: level informational, 383 messages logged
    Trap logging: disabled
    History logging: disabled
    Device ID: disabled
    Mail logging: disabled
    ASDM logging: disabled
TO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 140, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 1032, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 140, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 1032, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 96, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-5-402128: CRYPTO: An attempt to allocate a large memory block failed, size: 100, limit: 0.
%ASA-6-725002: Device completed SSL handshake with client inside:10.10.254.4/1450


从debug看，SSL的握手已经完成，但是浏览器出现最后的结果如下：

VTheme.1.jpg (83.55 KB)

2008-11-5 11:28

通过Sniffer抓包，出现以下错误：

VTheme.2.jpg (161.4 KB)

2008-11-5 11:59

抓包结果附件，为OmniPeek的格式： asdm_cap.rar (5.01 KB)

asdm_cap.rar (5.01 KB)
下载次数: 10

2008-11-5 11:59

从结果看，似乎RULES没有起作用，不知楼主怎么看？是否浏览器的问题？还是UDP版的ASA无法正常完成？

[ 本帖最后由 gwaynez 于 2008-11-5 11:59 编辑 ]

锅巴粥

不明白你说的什么UDP版本的ASA？
是那个我以前修改的在qemu上添加了-net udp版本的qemu?
http://www.netemu.cn/bbs/viewthr ... B%B9%F8%B0%CD%D6%E0
贴出你的所有脚本。

锅巴粥

引用:

原帖由 zzlonline 于 2008-11-5 10:19 发表
楼主用的是udp的吗?asdm一登我就死了累啊

我说了我是用的qemu带pcap补丁的, 直接桥接到本地网卡的！

gwaynez

ASA的脚本：
@echo off
color 21
title ASA1

setlocal
set command_name= asa -L . -hda FLASH -hdachs 980,16,32 -kernel vmlinuz -initrd asa802-ronsun.gz -m 256 --no-kqemu
set parameter= -append "auto nousb ide1=noprobe bigphysarea=16384 console=ttyS0,9600n8 hda=980,16,32"
set nic1=-net nic,vlan=1,macaddr=00:d0:f8:01:01:00,model=i82559er -net udp,vlan=1,sport=51300,dport=41300,daddr=127.0.0.1
set nic2=-net nic,vlan=2,macaddr=00:d0:f8:01:01:01,model=i82559er -net udp,vlan=2,sport=51301,dport=41301,daddr=127.0.0.1
set nic3=-net nic,vlan=3,macaddr=00:d0:f8:01:01:02,model=i82559er -net udp,vlan=3,sport=51302,dport=41302,daddr=127.0.0.1
set nic4=-net nic,vlan=4,macaddr=00:d0:f8:01:01:03,model=i82559er -net udp,vlan=4,sport=51303,dport=41303,daddr=127.0.0.1
set options=-serial telnet::2023,server,nowait

start %command_name% %parameter% %nic1% %nic2% %nic3% %nic4% %options%

gwaynez

然后通过UDP端口链接到交换机的端口上

锅巴粥

试试把网卡的model修改成pcnet看看
model=pcnet
还有你确定如果不使用fiddler能否连接上ASDM？(虽然这样不能正常登陆到ASDM界面，但是起码的ASDM的WEB界面和登陆过程界面是有的，只是最后提示不支持的报错)

zzlonline

不明白你说的什么UDP版本的ASA？
是那个我以前修改的在qemu上添加了-net udp版本的qemu?
http://www.netemu.cn/bbs/viewthr ... B%B9%F8%B0%CD%D6%E0
贴出你的所有脚本


楼主加我QQ行吗,我虚心求教
25864605

zzlonline

引用:

原帖由 锅巴粥 于 2008-11-5 11:55 发表

我说了我是用的qemu带pcap补丁的, 直接桥接到本地网卡的！

楼主加我qq行吗.我虚心求教
QQ:25864605

锅巴粥

我已经将我运行的所有文件打包上传到FTP中。请下载尝试

注意：
下载之后运行ASA802.bat,你需要修改ifname参数对应你所需要桥接的网卡的数字
去掉ifname=3中的3，保持一个空格.

1.JPG (4.48 KB)

2008-11-5 21:04

保存，然后运行ASA802.bat.

2.JPG (77.6 KB)

2008-11-5 21:04

选择你的网卡对应的数字,比如这里我选择与无线网卡桥接,那么ifname=3

之后运行 ASA802.bat.启动QEMU模拟的ASA
FLASH中已包含ASDM版本为6.03
注意启动以后进去shell.startup-config 中有我的配置，你需要修改一下

复制内容到剪贴板

代码:

ftp://down.netemu.cn/down/NetEmu.cn 专用/qemu/Qemu_asa_asdm/asa802_asdm.7z
Username:down password:netemu.cn

zzlonline

多谢楼主了,我模拟成功!请问你的QQ多少,在下重谢!

admin

引用:

原帖由 zzlonline 于 2008-11-6 09:01 发表
多谢楼主了,我模拟成功!请问你的QQ多少,在下重谢!

谢的话，就写一篇自己模拟心得体会把

csyy

感谢管理员共享！
下载来看看

gwaynez

引用:

原帖由 锅巴粥 于 2008-11-5 15:31 发表
试试把网卡的model修改成pcnet看看
model=pcnet
还有你确定如果不使用fiddler能否连接上ASDM？(虽然这样不能正常登陆到ASDM界面，但是起码的ASDM的WEB界面和登陆过程界面是有的，只是最后提示不支持的报错)

不用fiddler，可以登陆ASDM界面，可是ASA进程崩溃退出。把网卡的model修改成pcnet后，出现的结果还是和之前一样。总之谢谢楼主。 ASDM的功能对我其实并没有太大作用。

锅巴粥

gwaynez：
建议你不要使用我以前编译的那个QEMU带UDP功能的，我在
http://www.netemu.cn/bbs/viewthr ... B%B9%F8%B0%CD%D6%E0
这个帖子中详细说过，这个版本在WINDOWS下变现的很不稳定。
你可以使用mmm123编译的那个带PCAP的QEMU，我已经打包在文件中上传到了FTP 文件名为:qemu-asa.exe

gwaynez

谢谢楼主!

gwaynez

谢谢楼主!