IOS-ASA Pre-share IPSec VPN 配置 - 思科技术 - 51CTO技术论坛

社区导航: 专家门诊网络技术操作系统数据库程序设计系统应用考试认证 CIO及信息化站长交流综合交流下载基地 51CTO产品服务

【设为首页 | 收藏本站】

51CTO技术论坛» 思科技术 » IOS-ASA Pre-share IPSec VPN 配置 [ 打印] [ 订阅] [ 收藏] [ 推荐给朋友] [ 本帖文本页]

论坛跳转:

maxl
新新人类

帖子 14
精华 0
无忧币 8
积分 8
阅读权限 20

注册日期 2008-6-5

最后登录 2008-8-9

离线

[查看资料] [发短消息] [Blog]

发表于:2008-6-10 16:17　　标题：IOS-ASA Pre-share IPSec VPN 配置
＜上一帖 | 下一帖＞

IOS－ASA Pre-share IPSec VPN 配置
配置中也顺便加入了NAT部分的配置。

1、在r1上配置IPSec VPN。
hostname r1
!
crypto isakmp policy 10
encr 3des
authentication pre-share
hash sha
group 2
crypto isakmp key cisco1234 address 218.1.1.1
!
crypto ipsec transform-set ccsp esp-3des esp-sha-hmac
mode tunnel
!
crypto map cisco 10 ipsec-isakmp
set peer 218.1.1.1
set transform-set ccsp
match address 102
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Serial0/0
ip address 173.16.1.5 255.255.255.252
ip nat outside
ip virtual-reassembly
crypto map cisco
!
ip route 0.0.0.0 0.0.0.0 173.16.1.6
!
ip nat inside source list 101 interface Serial0/0 overload
!
access-list 101 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 101 permit ip 10.1.1.0 0.0.0.255 any
!定义NAT感兴趣流，要将IPSec流量在NAT中去掉

access-list 102 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
!定义IPSec感兴趣流

2、在ASA上配置IPSec VPN。
hostname ciscoasa
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 218.1.1.1 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.2.2.1 255.255.255.0
!
access-list per-icmp extended permit icmp any any
access-group per-icmp in interface outside
!
access-list go-vpn extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0
!
nat-control
global (outside) 1 interface
nat (inside) 0 access-list go-vpn
!IPSec流量不作翻译

nat (inside) 1 10.2.2.0 255.255.255.0
!由于PIX/ASA在执行NAT时，对nat id是区分先后的，即先执行nat 0，然后执行nat 1，所以在此不必特别的注明IPSec流量不作翻译。

route outside 0.0.0.0 0.0.0.0 218.1.1.2 1
!
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
!
tunnel-group 173.16.1.5 type ipsec-l2l
tunnel-group 173.16.1.5 ipsec-attributes
pre-shared-key *
!
pix/asa 7.x新命令，在此处配置预共享密钥和VPN类型，值得注意的是，当配置lan2lan (site2site) VPN时，tunnel-group的名字必须为对等体的IP地址。
!
crypto ipsec transform-set ccsp esp-3des esp-sha-hmac
crypto map cisco 10 match address go-vpn
crypto map cisco 10 set peer 173.16.1.5
crypto map cisco 10 set transform-set ccsp
crypto map cisco interface outside