! =====================================================================
! CAU HINH MAU: Cisco ASA 5505 (phan mem ASA 8.3 tro len, ke ca 9.x)
! LAN ra internet: NAT, DHCP, SSH quan ly
! Nguon: https://thietbimangcu.com/cau-hinh-mau/
! - Ethernet0/0 = WAN, Ethernet0/1-0/7 = LAN.
! - ASA 8.2 tro xuong dung cu phap NAT cu (xem cuoi file). Kiem tra: show version
! - Doi MAT_KHAU_... truoc khi dan.
! =====================================================================
enable
configure terminal
!
hostname ASA-5505
enable password MAT_KHAU_ENABLE
username admin password MAT_KHAU_ADMIN privilege 15
!
! --- VLAN 1 = inside (LAN), VLAN 2 = outside (WAN) ---
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.10.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
! (WAN la PPPoE thi thay dong "ip address dhcp setroute" bang:
!  vpdn group NHA-MANG request dialout pppoe
!  vpdn group NHA-MANG localname TEN_DANG_NHAP_PPPOE
!  vpdn group NHA-MANG ppp authentication pap
!  vpdn username TEN_DANG_NHAP_PPPOE password MAT_KHAU_PPPOE
!  interface Vlan2
!   pppoe client vpdn group NHA-MANG
!   ip address pppoe setroute )
!
interface Ethernet0/0
 switchport access vlan 2
 no shutdown
interface Ethernet0/1
 no shutdown
interface Ethernet0/2
 no shutdown
interface Ethernet0/3
 no shutdown
!
! --- NAT: LAN ra internet bang IP cong outside ---
object network LAN-NOI-BO
 subnet 192.168.10.0 255.255.255.0
 nat (inside,outside) dynamic interface
!
! --- DHCP cho LAN ---
! License 10 may chi cho dai DHCP toi da 32 dia chi; license 50 may la 128.
dhcpd address 192.168.10.100-192.168.10.131 inside
dhcpd dns 8.8.8.8 1.1.1.1
dhcpd enable inside
!
! --- Cho phep goi ping tra ve tu internet ---
policy-map global_policy
 class inspection_default
  inspect icmp
!
! --- SSH quan ly tu LAN ---
crypto key generate rsa modulus 2048
aaa authentication ssh console LOCAL
ssh 192.168.10.0 255.255.255.0 inside
ssh version 2
ssh timeout 30
!
end
write memory
!
! --- ASA 8.2 tro xuong: thay khoi "object network" bang ---
! nat (inside) 1 192.168.10.0 255.255.255.0
! global (outside) 1 interface
!
! --- Kiem tra ---
! show interface ip brief
! show route
! show xlate
! show dhcpd binding
! show version   (dong "Inside Hosts" cho biet license 10 / 50 / Unlimited)