CISCOIPSECVPN配置

1:PC1 属于上海分公司内网主机 ,PC2 属于总公司主机 . 要求上海分公司的用户直接可以喝总公司的 PC2 通信 .(Site-to-Site IPSEC VPN 实现 ) 2: 公网上用户可以访问总公司的 OA 服务器 PC2.(SSL VPN 实现 ) 三 : 配置 过程 : 1: 基本 配置 : ASA1(config)# in

1:PC1属于上海分公司内网主机,PC2属于总公司主机.要求上海分公司的用户直接可以喝总公司的PC2通信.(Site-to-Site IPSEC VPN实现)
2:公网上用户可以访问总公司的OA服务器PC2.(SSL VPN实现)
三:配置过程:
1:基本配置:
ASA1(config)# int e0/1
ASA1(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ASA1(config-if)# ip add 172.16.1.254 255.255.255.0
ASA1(config-if)# no sh
ASA1(config-if)# int e0/0
ASA1(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ASA1(config-if)# ip add 12.0.0.1 255.255.255.0
ASA1(config-if)# no sh
ASA1(config-if)#
ASA1# ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/344/1670 ms

R1(config)#int f0/0
R1(config-if)#ip add 12.0.0.2 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int f1/0
R1(config-if)#ip add 23.0.0.2 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int f2/0
R1(config-if)#ip add 1.1.1.254 255.255.255.0
R1(config-if)#no sh

ASA2(config)# int e0/0
ASA2(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ASA2(config-if)# ip add 23.0.0.3 255.255.255.0
ASA2(config-if)# no sh
ASA2(config-if)# int e0/1
ASA2(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ASA2(config-if)# ip add 192.168.1.254 255.255.255.0
ASA2(config-if)# no sh

配置路由,NAT,ACL

ASA1(config)# route outside 0 0 12.0.0.2
ASA1(config)# nat-control
ASA1(config)# nat (inside) 1 0 0
ASA1(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
ASA1(config)# access-list haha permit icmp any any
ASA1(config)# access-group haha in interface outside

ASA2(config)# route outside 0 0 23.0.0.2
ASA2(config)# nat-con
ASA2(config)# nat-control
ASA2(config)# nat (inside) 1 0 0
ASA2(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
ASA2(config)# access-list haha permit icmp any any
ASA2(config)# access-group haha in interface outside

私网上公网没问题,但两个私网无法互通
2:配置Site-to-Site VPN
ASA1(config)# access-list no-nat permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0
ASA1(config)# nat (inside) 0 access-list no-nat

ASA2(config)# access-list no-nat permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
ASA2(config)# nat (inside) 1 access-list no-nat

ASA1(config)# crypto isakmp enable outside
ASA1(config-isakmp-policy)# authentication pre-share
ASA1(config-isakmp-policy)# encryption des
ASA1(config-isakmp-policy)# hash md5
ASA1(config-isakmp-policy)# group 2
ASA1(config-isakmp-policy)# exit
ASA1(config)# isakmp key cisco address 23.0.0.3
ASA1(config)# crypto ipsec transform-set mytrans esp-des esp-md
ASA1(config)# crypto ipsec transform-set mytrans esp-des esp-md5-hmac
ASA1(config)# crypto map mymap 10 set peer 23.0.0.3

ASA1(config)# crypto map mymap 10 set transform-set mytrans
ASA1(config)# crypto map mymap 10 match address no-nat
ASA1(config)# crypto map mymap interface outside

ASA2(config)# crypto isakmp enable outside
ASA2(config-isakmp-policy)# authentication pre-share
ASA2(config-isakmp-policy)# encryption des
ASA2(config-isakmp-policy)# hash md5
ASA2(config-isakmp-policy)# group 2
ASA2(config-isakmp-policy)# exit
ASA2(config)# isakmp key cisco address 12.0.0.1
ASA2(config)# crypto ipsec transform-set mytrans esp-des esp-md
ASA2(config)# crypto ipsec transform-set mytrans esp-des esp-md5-hmac
ASA2(config)# crypto map mymap 10 set peer 12.0.0.1

ASA2(config)# crypto map mymap 10 set transform-set mytrans
ASA2(config)# crypto map mymap 10 match address no-nat
ASA2(config)# crypto map mymap interface outside

草原狼的个性” 博客，转载请与作者联系！