当前位置:高校自动化网 >> Cisco >> 浏览文章

cisco实验:设置IPSEC VPN和SSL VPN步骤

文章来源:本站原创 作者:佚名


该文章讲述了cisco实验:设置IPSEC VPN和SSL VPN步骤.

本文用实验来讲解:cisco路

由器的ASA防火墙 设置IPSEC VPN和SSL VPN

一:实验拓扑:

二:实验要求:
1:PC1属于上海分公司内网主机,PC2属于总公司主机.要求上海分公司的用户直接可以喝总公司的PC2通信.(Site-to-Site IPSEC VPN实现)
2:公网上用户可以访问总公司的OA服务器PC2.(SSL VPN实现)

三:配置过程:
1:基本配置: ASA1(config)#

具体操作如下:

一:实验拓扑:

 

点击浏览下一页

 

二:实验要求:

1:PC1属于上海分公司内网主机,PC2属于总公司主机.要求上海分公司的用户直接可以喝总公司的PC2通信.(Site-to-Site IPSEC VPN实现)

2:公网上用户可以访问总公司的OA服务器PC2.(SSL VPN实现)

三:配置过程:

1:基本配置:

ASA1(config)# int e0/1

ASA1(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ASA1(config-if)# ip add 172.16.1.254 255.255.255.0

ASA1(config-if)# no sh

ASA1(config-if)# int e0/0

ASA1(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

ASA1(config-if)# ip add 12.0.0.1 255.255.255.0

ASA1(config-if)# no sh

ASA1(config-if)#

ASA1# ping 172.16.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/344/1670 ms

R1(config)#int f0/0

R1(config-if)#ip add 12.0.0.2 255.255.255.0

R1(config-if)#no sh

R1(config-if)#int f1/0

R1(config-if)#ip add 23.0.0.2 255.255.255.0

R1(config-if)#no sh

R1(config-if)#int f2/0

R1(config-if)#ip add 1.1.1.254 255.255.255.0

R1(config-if)#no sh

ASA2(config)# int e0/0

ASA2(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

ASA2(config-if)# ip add 23.0.0.3 255.255.255.0

ASA2(config-if)# no sh

ASA2(config-if)# int e0/1

ASA2(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ASA2(config-if)# ip add 192.168.1.254 255.255.255.0

ASA2(config-if)# no sh

配置路由,NAT,ACL

ASA1(config)# route outside 0 0 12.0.0.2

ASA1(config)# nat-control

ASA1(config)# nat (inside) 1 0 0

ASA1(config)# global (outside) 1 interface

INFO: outside interface address added to PAT pool

ASA1(config)# access-list haha permit icmp any any

ASA1(config)# access-group haha in interface outside

ASA2(config)# route outside 0 0 23.0.0.2

ASA2(config)# nat-con

ASA2(config)# nat-control

ASA2(config)# nat (inside) 1 0 0

ASA2(config)# global (outside) 1 interface

INFO: outside interface address added to PAT pool

ASA2(config)# access-list haha permit icmp any any

ASA2(config)# access-group haha in interface outside

私网上公网没问题,但两个私网无法互通

2:配置Site-to-Site VPN

ASA1(config)# access-list no-nat permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0

ASA1(config)# nat (inside) 0 access-list no-nat??

ASA2(config)# access-list no-nat permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0

ASA2(config)# nat (inside) 1 access-list no-nat

ASA1(config)# crypto isakmp enable outside

ASA1(config-isakmp-policy)# authentication pre-share

ASA1(config-isakmp-policy)# encryption des

ASA1(config-isakmp-policy)# hash md5

ASA1(config-isakmp-policy)# group 2

ASA1(config-isakmp-policy)# exit

ASA1(config)# isakmp key cisco address 23.0.0.3

ASA1(config)# crypto ipsec transform-set mytrans esp-des esp-md

ASA1(config)# crypto ipsec transform-set mytrans esp-des esp-md5-hmac

ASA1(config)# crypto map mymap 10 set peer 23.0.0.3

??????

ASA1(config)# crypto map mymap 10 set transform-set mytrans

ASA1(config)# crypto map mymap 10 match address no-nat

ASA1(config)# crypto map mymap interface outside

ASA2(config)# crypto isakmp enable outside

ASA2(config-isakmp-policy)# authentication pre-share

ASA2(config-isakmp-policy)# encryption des

ASA2(config-isakmp-policy)# hash md5

ASA2(config-isakmp-policy)# group 2

ASA2(config-isakmp-policy)# exit

ASA2(config)# isakmp key cisco address 12.0.0.1

ASA2(config)# crypto ipsec transform-set mytrans esp-des esp-md

ASA2(config)# crypto ipsec transform-set mytrans esp-des esp-md5-hmac

ASA2(config)# crypto map mymap 10 set peer 12.0.0.1

 

ASA2(config)# crypto map mymap 10 set transform-set mytrans

ASA2(config)# crypto map mymap 10 match address no-nat

ASA2(config)# crypto map mymap interface outside

Site-to-Site IPSEC 配置完成.

ASA2(config)# WEBvpn

ASA2(config-WEBvpn)# enable outside

INFO: WebVPN and DTLS are enabled on 'outside'.

ASA2(config-webvpn)# svc image disk0:/sslclient-win-1.1.3.173.pkg

ASA2(config-webvpn)# svc enable

ASA2(config-webvpn)# exit

ASA2(config)# username cisco password cisco

ASA2(config)# ip local pool vpn 192.168.100.1-192.168.100.200

ASA2(config)# access-list 100 permit ip 192.168.1.0 255.255.255.0 any

ASA2(config)# group-policy my10 internal

ASA2(config)# group-policy my10 attributes

ASA2(config-group-policy)# vpn-tunnel-protocol webvpn svc

ASA2(config-group-policy)# split-tunnel-policy tunnelspecified

ASA2(config-group-policy)# split-tunnel-network-list value 100

ASA2(config-group-policy)# webvpn

ASA2(config-group-webvpn)# svc ask enable

ASA2(config-group-webvpn)# exit

ASA2(config-group-policy)# exit

ASA2(config)# tunnel-group jishu type webvpn???????

ASA2(config)# tunnel-group jishu general-attributes

ASA2(config-tunnel-general)# address-pool vpn

ASA2(config-tunnel-general)# default-group-policy my10

ASA2(config-tunnel-general)# webvpn

ASA2(config-webvpn)# tunnel-group-list enable

ASA2(config-webvpn)# tunnel-group jishu webvpn-attributes

ASA2(config-tunnel-webvpn)# group-alias 2t39

SSL VPN配置完毕.

access-list sslvpn extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0

nat (inside) 0 access-list sslvpn

相关文章:
  • Cisco CCNP 冗余HSRP、QOS、多播 (一)
  • 双绞线连接网络和电话水晶头分配
  • 分享日常配置思科的简单问题
  • 上一篇:网吧路由器上的NAT功能设置使用安全
    下一篇: 介绍多种排查网吧网络错误的方法
    最近更新