ASA防火墙上配置IPSEC-VPN和SSL-VPN.docx

《ASA防火墙上配置IPSEC-VPN和SSL-VPN.docx》由会员分享，可在线阅读，更多相关《ASA防火墙上配置IPSEC-VPN和SSL-VPN.docx（4页珍藏版）》请在得力文库 - 分享文档赚钱的网站上搜索。

1、ASA防火墙上配置IPSEC VPN和SSL VPN 一:实验拓扑:二:实验要求:1:PC1属于上海分公司内网主机,PC2属于总公司主机.要求上海分公司的用户直接可以喝总公司的PC2通信.(Site-to-Site IPSEC VPN实现)2:公网上用户可以访问总公司的OA服务器PC2.(SSL VPN实现)三:配置过程:1:基本配置:ASA1(config)# int e0/1ASA1(config-if)# nameif insideINFO: Security level for inside set to 100 by default.ASA1(config-if)# ip add 1

2、72.16.1.254 255.255.255.0ASA1(config-if)# no shASA1(config-if)# int e0/0ASA1(config-if)# nameif outsideINFO: Security level for outside set to 0 by default.ASA1(config-if)# ip add 12.0.0.1 255.255.255.0ASA1(config-if)# no shASA1(config-if)# ASA1# ping 172.16.1.1Type escape sequence to abort.Sending

3、5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 10/344/1670 msR1(config)#int f0/0R1(config-if)#ip add 12.0.0.2 255.255.255.0R1(config-if)#no shR1(config-if)#int f1/0R1(config-if)#ip add 23.0.0.2 255.255.255.0R1(config-if)#no shR

4、1(config-if)#int f2/0R1(config-if)#ip add 1.1.1.254 255.255.255.0R1(config-if)#no shASA2(config)# int e0/0ASA2(config-if)# nameif outsideINFO: Security level for outside set to 0 by default.ASA2(config-if)# ip add 23.0.0.3 255.255.255.0ASA2(config-if)# no shASA2(config-if)# int e0/1ASA2(config-if)#

5、nameif insideINFO: Security level for inside set to 100 by default.ASA2(config-if)# ip add 192.168.1.254 255.255.255.0ASA2(config-if)# no sh配置路由,NAT,ACLASA1(config)# route outside 0 0 12.0.0.2ASA1(config)# nat-control ASA1(config)# nat (inside) 1 0 0 ASA1(config)# global (outside) 1 interface INFO:

6、outside interface address added to PAT poolASA1(config)# access-list haha permit icmp any anyASA1(config)# access-group haha in interface outsideASA2(config)# route outside 0 0 23.0.0.2ASA2(config)# nat-conASA2(config)# nat-control ASA2(config)# nat (inside) 1 0 0ASA2(config)# global (outside) 1 int

7、erface INFO: outside interface address added to PAT poolASA2(config)# access-list haha permit icmp any anyASA2(config)# access-group haha in interface outside私网上公网没问题,但两个私网无法互通2:配置Site-to-Site VPNASA1(config)# access-list no-nat permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0ASA1(config

8、)# nat (inside) 0 access-list no-natASA2(config)# access-list no-nat permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0ASA2(config)# nat (inside) 1 access-list no-natASA1(config)# crypto isakmp enable outside ASA1(config-isakmp-policy)# authentication pre-share ASA1(config-isakmp-policy)#

9、encryption des ASA1(config-isakmp-policy)# hash md5 ASA1(config-isakmp-policy)# group 2ASA1(config-isakmp-policy)# exitASA1(config)# isakmp key cisco address 23.0.0.3ASA1(config)# crypto ipsec transform-set mytrans esp-des esp-mdASA1(config)# crypto ipsec transform-set mytrans esp-des esp-md5-hmac A

10、SA1(config)# crypto map mymap 10 set peer 23.0.0.3 ASA1(config)# crypto map mymap 10 set transform-set mytransASA1(config)# crypto map mymap 10 match address no-natASA1(config)# crypto map mymap interface outsideASA2(config)# crypto isakmp enable outside ASA2(config-isakmp-policy)# authentication pr

11、e-share ASA2(config-isakmp-policy)# encryption des ASA2(config-isakmp-policy)# hash md5 ASA2(config-isakmp-policy)# group 2ASA2(config-isakmp-policy)# exitASA2(config)# isakmp key cisco address 12.0.0.1ASA2(config)# crypto ipsec transform-set mytrans esp-des esp-mdASA2(config)# crypto ipsec transfor

12、m-set mytrans esp-des esp-md5-hmac ASA2(config)# crypto map mymap 10 set peer 12.0.0.1 ASA2(config)# crypto map mymap 10 set transform-set mytransASA2(config)# crypto map mymap 10 match address no-natASA2(config)# crypto map mymap interface outsideSite-to-Site IPSEC 配置完成.ASA2(config)# webvpn ASA2(co

13、nfig-webvpn)# enable outside INFO: WebVPN and DTLS are enabled on outside.ASA2(config-webvpn)# svc image disk0:/sslclient-win-1.1.3.173.pkgASA2(config-webvpn)# svc enable ASA2(config-webvpn)# exitASA2(config)# username cisco password ciscoASA2(config)# ip local pool vpn 192.168.100.1-192.168.100.200

14、ASA2(config)# access-list 100 permit ip 192.168.1.0 255.255.255.0 anyASA2(config)# group-policy my10 internal ASA2(config)# group-policy my10 attributes ASA2(config-group-policy)# vpn-tunnel-protocol webvpn svc ASA2(config-group-policy)# split-tunnel-policy tunnelspecified ASA2(config-group-policy)#

15、 split-tunnel-network-list value 100ASA2(config-group-policy)# webvpn ASA2(config-group-webvpn)# svc ask enable ASA2(config-group-webvpn)# exitASA2(config-group-policy)# exitASA2(config)# tunnel-group jishu type webvpn ASA2(config)# tunnel-group jishu general-attributes ASA2(config-tunnel-general)#

16、address-pool vpnASA2(config-tunnel-general)# default-group-policy my10ASA2(config-tunnel-general)# webvpn ASA2(config-webvpn)# tunnel-group-list enable ASA2(config-webvpn)# tunnel-group jishu webvpn-attributes ASA2(config-tunnel-webvpn)# group-alias 2t39SSL VPN配置完毕.access-list sslvpn extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0nat (inside) 0 access-list sslvpn