1、玩传奇能日美女，鸡鸡能变大一:实验拓扑:二:实验要求:1:PC1 属于上海分公司内网主机,PC2 属于总公司主机. 要求上海分公司的用户直接可以喝总公司的 PC2 通信.(Site-to-Site IPSEC VPN 实现)2:公网上用户可以访问总公司的 OA 服务器 PC2.(SSL VPN 实现)三:配置过程:1:基本配置:ASA1(config)# int e0/1ASA1(config-if)# nameif insideINFO: Security level for “inside“ set to 100 by default.ASA1(config-if)# ip add 172
2、.16.1.254 255.255.255.0ASA1(config-if)# no shASA1(config-if)# int e0/0ASA1(config-if)# nameif outsideINFO: Security level for “outside“ set to 0 by default.ASA1(config-if)# ip add 12.0.0.1 255.255.255.0ASA1(config-if)# no shASA1(config-if)# ASA1# ping 172.16.1.1Type escape sequence to abort.Sending
3、5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 10/344/1670 msR1(config)#int f0/0R1(config-if)#ip add 12.0.0.2 255.255.255.0R1(config-if)#no shR1(config-if)#int f1/0R1(config-if)#ip add 23.0.0.2 255.255.255.0R1(config-if)#no shR
4、1(config-if)#int f2/0R1(config-if)#ip add 1.1.1.254 255.255.255.0R1(config-if)#no shASA2(config)# int e0/0ASA2(config-if)# nameif outsideINFO: Security level for “outside“ set to 0 by default.ASA2(config-if)# ip add 23.0.0.3 255.255.255.0ASA2(config-if)# no shASA2(config-if)# int e0/1ASA2(config-if)
5、# nameif insideINFO: Security level for “inside“ set to 100 by default.ASA2(config-if)# ip add 192.168.1.254 255.255.255.0ASA2(config-if)# no sh配置路由,NAT,ACLASA1(config)# route outside 0 0 12.0.0.2ASA1(config)# nat-control ASA1(config)# nat (inside) 1 0 0 ASA1(config)# global (outside) 1 interface IN
6、FO: outside interface address added to PAT poolASA1(config)# access-list haha permit icmp any anyASA1(config)# access-group haha in interface outsideASA2(config)# route outside 0 0 23.0.0.2ASA2(config)# nat-conASA2(config)# nat-control ASA2(config)# nat (inside) 1 0 0ASA2(config)# global (outside) 1
7、 interface INFO: outside interface address added to PAT poolASA2(config)# access-list haha permit icmp any anyASA2(config)# access-group haha in interface outside私网上公网没问题,但两个私网无法互通2:配置 Site-to-Site VPNASA1(config)# access-list no-nat permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0ASA1(c
8、onfig)# nat (inside) 0 access-list no-nat ASA2(config)# access-list no-nat permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0ASA2(config)# nat (inside) 1 access-list no-natASA1(config)# crypto isakmp enable outside ASA1(config-isakmp-policy)# authentication pre-share ASA1(config-isakmp-pol
9、icy)# encryption des ASA1(config-isakmp-policy)# hash md5 ASA1(config-isakmp-policy)# group 2ASA1(config-isakmp-policy)# exitASA1(config)# isakmp key cisco address 23.0.0.3ASA1(config)# crypto ipsec transform-set mytrans esp-des esp-mdASA1(config)# crypto ipsec transform-set mytrans esp-des esp-md5-
10、hmac ASA1(config)# crypto map mymap 10 set peer 23.0.0.3ASA1(config)# crypto map mymap 10 set transform-set mytransASA1(config)# crypto map mymap 10 match address no-natASA1(config)# crypto map mymap interface outsideASA2(config)# crypto isakmp enable outside ASA2(config-isakmp-policy)# authenticati
11、on pre-share ASA2(config-isakmp-policy)# encryption des ASA2(config-isakmp-policy)# hash md5 ASA2(config-isakmp-policy)# group 2ASA2(config-isakmp-policy)# exitASA2(config)# isakmp key cisco address 12.0.0.1ASA2(config)# crypto ipsec transform-set mytrans esp-des esp-mdASA2(config)# crypto ipsec tra
12、nsform-set mytrans esp-des esp-md5-hmac ASA2(config)# crypto map mymap 10 set peer 12.0.0.1ASA2(config)# crypto map mymap 10 set transform-set mytransASA2(config)# crypto map mymap 10 match address no-natASA2(config)# crypto map mymap interface outsideSite-to-Site IPSEC 配置完成.ASA2(config)# webvpn ASA
13、2(config-webvpn)# enable outside INFO: WebVPN and DTLS are enabled on outside.ASA2(config-webvpn)# svc image disk0:/sslclient-win-1.1.3.173.pkgASA2(config-webvpn)# svc enable ASA2(config-webvpn)# exitASA2(config)# username cisco password ciscoASA2(config)# ip local pool vpn 192.168.100.1-192.168.100
14、.200ASA2(config)# access-list 100 permit ip 192.168.1.0 255.255.255.0 anyASA2(config)# group-policy my10 internal ASA2(config)# group-policy my10 attributes ASA2(config-group-policy)# vpn-tunnel-protocol webvpn svc ASA2(config-group-policy)# split-tunnel-policy tunnelspecified ASA2(config-group-poli
15、cy)# split-tunnel-network-list value 100ASA2(config-group-policy)# webvpn ASA2(config-group-webvpn)# svc ask enable ASA2(config-group-webvpn)# exitASA2(config-group-policy)# exitASA2(config)# tunnel-group jishu type webvpn ASA2(config)# tunnel-group jishu general-attributes ASA2(config-tunnel-genera
16、l)# address-pool vpnASA2(config-tunnel-general)# default-group-policy my10ASA2(config-tunnel-general)# webvpn ASA2(config-webvpn)# tunnel-group-list enable ASA2(config-webvpn)# tunnel-group jishu webvpn-attributes ASA2(config-tunnel-webvpn)# group-alias 2t39SSL VPN 配置完毕.access-list sslvpn extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0nat (inside) 0 access-list sslvpn
