配置等级策略，保证outside端口可以访问inside端口
access-list 100 extended permit icmp any any
access-list 100 extended permit ip any any

access-group 100 in interface outside

做PAT：
object network nat
subnet 192.168.1.0 255.255.255.0
nat (inside,ouside) dynamic interfac

做路由：
route outside 0.0.0.0 0.0.0.0 60.22.23.1把内网路由到外网（内网的默认路由）
route inside 172.168.1.0 255.255.255.0 172.16.1.1 1把外网路由到内网
route inside 192.168.0.0 255.255.0.0 172.16.1.1 1

9：开启SSH和telnet：
ciscoasa(config)#crypto key generate rsa modulus 1024
ciscoasa(config)#write mem
ciscoasa(config)#ssh 0.0.0.0 0.0.0.0 outside//任何外网都可以通过shh登录
ciscoasa(config)#ssh timeout 30 //设置超时时间,单位为分钟
ciscoasa(config)#ssh version 1 //指定SSH版本,可以选择版本2
ciscoasa(config)#passwd 密码 //passwd命令所指定的密码为远程访问密码

telnet 0.0.0.0 0.0.0.0 inside
telnet 192.168.10.0 255.255.255.0 inside
telnet 10.1.2.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5 
 

开启ASDM
asdm image disk0:/asdm-645.bin
no asdm history enable
http server enable
http 192.168.0.0 255.255.0.0 inside
http 192.168.1.0 255.255.255.0 management
http 192.168.10.0 255.255.255.0 inside
 

配置SSL VPN：
----------------------产生证书---------------------------
crypto key generate rsa label asa.yeslab.net modulus 1024

crypto ca trustpoint localtrustpoint
enrollment self
fqdn asa.yeslab.net
subject-name cn=asa.yeslab.net
keypair asa.yeslab.net
crl configure

ssl trust-point localtrustpoint
---------------------anyconnect配置---------------------------
webvpn
enable outside
no anyconnect-essentials
anyconnect image disk0:/anyconnect-win-3.0.1047-k9.pkg 1
anyconnect enable

ip local pool vpn-pool 172.16.2.1-172.16.2.100根据原有配置或者客户需求配置该地址池

group-policy simapolicy internal
group-policy simapolicy attributes
vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
address-pools value vpn-pool
webvpn
url-list none
anyconnect ask enable
url-entry disable

username sima password 123 privilege 15 更具客户安排定义用户名和密码
username sima attributes
vpn-group-policy simapolicy

---------------------------IKEv2配置-----------------------------------
crypto ikev2 enable Outside client-services port 443
crypto ikev2 remote-access trustpoint localtrustpoint
crypto ikev2 policy 10
crypto ipsec ikev2 ipsec-proposal ikev2-p

crypto dynamic-map dymap 100 set ikev2 ipsec-proposalikev2-p
crypto map cisco 1000 ipsec-isakmp dynamic dymap
crypto map cisco interface Outside
12：隧道分离：
ciscoasa(config)# access-list split-ssl extended permit ip172.16.1.0 255.255.255.252 any
!注意源地址为ASA的inside网络地址，目标地址始终为any
!
ciscoasa(config)# group-policy sslvpn-group-policyattributes
ciscoasa(config-group-policy)# split-tunnel-policytunnelspecified
ciscoasa(config-group-policy)# split-tunnel-network-list valuesplit-ssl 
13：SSL VPN关注流量不需要NAT：
object network inside-router-loop0
subnet 192.168.0.0 255.255.0.0
object network remote-vpn-address
subnet 172.16.2.0 255.255.255.0 //定义object关联做nat豁免
nat (inside,outside) source static inside-router-loop0inside-router-loop0 destination static remote-vpn-addressremote-vpn-address
14: 端口映射
dhcpd address 192.168.55.2-192.168.55.254 management
dhcpd enable management
object network obj-192.168.2.27 
host 192.168.2.27
object network obj-192.168.2.13 
host 192.168.2.13
object network obj_any 
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) static 202.97.156.21 server tcp wwwwww
ERROR: Address 202.97.156.21 overlaps with outside interfaceaddress.
ERROR: NAT Policy is not downloaded
object network obj-192.168.2.27
nat (inside,outside) static 218.26.213.126 service tcp www8080 
object network obj-192.168.2.13
nat (inside,outside) static 218.26.213.126 service tcp wwwwww 
object network obj_any
nat (inside,outside) dynamic interface
SSL连接建立成功以后，ASA上将自动创建指向客户的静态路由。