GNS3模擬Cisco+ipsec+vpn配置實例講解學習

1、GNS妙莫擬Cisco+ipsec+vpn配置實例ASA121181208,4R1211.81.2091/24ASA2192.168,2.0/24具體要求：要求通過互聯(lián)網(wǎng)連接的公司A區(qū)和8區(qū)之間通過ips及vlim實現(xiàn)192.168.2.0/54和172.16.2.0/2可以互訪GNS額驗拓撲圖ASAlR1ASA2R1配置說明：R1只需要按照圖在接口上配置好ip地址。!version12.4!hostnameR1!interfaceFastEthernet0/0ipaddress211.81.208.1255.255.255.0duplexautospeedauto!interfaceFast

2、Ethernet0/1ipaddress211.81.209.1255.255.255.0duplexautospeedauto!endR2配置說明：R2在這里使用的是c3660-telco-mz.124-15.T5.bin的IOS,再在slot1插槽上加上NM-16ES澳塊模擬交換機；R3同R2模擬交換機。!version12.4!hostnameR2interfaceFastEthernet0/0ipaddress11.1.1.2255.255.255.0duplexautospeedauto!interfaceFastEthernet1/10switchportaccessvlan2!i

3、nterfaceVlan1noipaddress!interfaceVlan2ipaddress192.168.2.1255.255.255.0!iproute0.0.0.00.0.0.011.1.1.1!endR3配置說明!version12.4!hostnameR3!interfaceFastEthernet0/0ipaddress12.1.1.2255.255.255.0duplexautospeedauto!interfaceFastEthernet1/10switchportaccessvlan2!interfaceVlan1noipaddress!interfaceVlan2ipa

4、ddress172.16.2.1255.255.255.0!iproute0.0.0.00.0.0.012.1.1.1!endASA1配置說明:SavedASAVersion8.0(2)!hostnameasalenablepassword8Ry2YjIyt7RRXU24encryptednames!interfaceEthernet0/0nameifoutsidesecurity-level0ipaddress211.81.208.2255.255.255.0!interfaceEthernet0/5nameifinsidesecurity-level100ipaddress11.1.1.1

5、255.255.255.0!access-listicmpextendedpermiticmpanyanyaccess-listnonatextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0access-listvpnextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0global(outside)1interfacenat(inside)0access-listnonatnat(inside)10.0.0.00.0.0.0access-group

6、icmpininterfaceoutsiderouteoutside0.0.0.00.0.0.0211.81.208.11routeinside192.168.2.0255.255.255.011.1.1.21cryptoipsectransform-setsetesp-desesp-md5-hmaccryptomapmap111matchaddressvpncryptomapmap111setpeer211.81.209.2cryptomapmap111settransform-setsetcryptomapmapinterfaceoutsidecryptoisakmpenableoutsi

7、decryptoisakmppolicy11authenticationpre-shareencryption3deshashshagroup2lifetime86400cryptoisakmppolicy65535authenticationpre-shareencryption3deshashshagroup2lifetime86400!tunnel-group211.81.209.2typeipsec-l2ltunnel-group211.81.209.2ipsec-attributespre-shared-key*:endASA2BE置說明asa2#shrun:SavedASAVers

8、ion8.0(2)!hostnameasa2enablepassword8Ry2YjIyt7RRXU24encryptednames!interfaceEthernet0/0nameifoutsidesecurity-level0ipaddress211.81.209.2255.255.255.0!interfaceEthernet0/1shutdownnonameifnosecurity-levelnoipaddress!interfaceEthernet0/5nameifinsidesecurity-level100ipaddress12.1.1.1255.255.255.0!access

9、-listicmpextendedpermiticmpanyanyaccess-listnonatextendedpermitip172.16.2.0255.255.255.0192.168.2.0255.255.255.0access-listvpnextendedpermitip172.16.2.0255.255.255.0192.168.2.0255.255.255.0global(outside)1interfacenat(inside)0access-listnonatnat(inside)10.0.0.00.0.0.0access-groupicmpininterfaceoutsi

10、derouteoutside0.0.0.00.0.0.0211.81.209.11routeinside172.16.2.0255.255.255.012.1.1.21cryptoipsectransform-setsetesp-desesp-md5-hmaccryptomapmap111matchaddressvpncryptomapmap111setpeer211.81.208.2cryptomapmap111settransform-setsetcryptomapmapinterfaceoutsidecryptoisakmpenableoutsidecryptoisakmppolicy1

11、1authenticationpre-shareencryption3deshashshagroup2lifetime86400cryptoisakmppolicy65535authenticationpre-shareencryption3deshashshagroup2lifetime86400tunnel-group211.81.208.2typeipsec-l2ltunnel-group211.81.208.2ipsec-attributespre-shared-key*:end配置過程詳細：ASA1配置詳細：端口基礎配置asa1(config)#interfaceethernet0/

12、5asa1(config-if)#nameifinsideINFO:Securitylevelforinsidesetto100bydefault.asa1(config-if)#security-level100asa1(config-if)#ipaddress11.1.1.1255.255.255.0asa1(config-if)#noshutdownasa1(config-if)#interfaceethernet0/0asa1(config-if)#nameifoutsideINFO:Securitylevelforoutsidesetto0bydefault.asa1(config-

13、if)#security-level0asal(config-if)#ipaddress211.81.208.2255.255.255.0asal(config-if)#noshutdownASANAT相關(guān)asa1(config)#nat(inside)100asa1(config)#global(outside)1interfaceINFO:outsideinterfaceaddressaddedtoPATpoolASA路由asa1(config)#routeoutside0.0.0.00.0.0.0211.81.208.1asa1(config)#routeinside192.168.2.

14、0255.255.255.011.1.1.2ASA做acl允許外部pingasa1(config)#access-listicmpextendedpermiticmpanyanyasa1(config)#access-groupicmpininterfaceoutsideB區(qū)配置同A區(qū)，將相應地址更改！IPSECVPN配置ASA1此處僅歹U出asa1的相關(guān)配置步驟，asa2配置見ASA2配置說明)定義從A區(qū)到B區(qū)要走vpn的流量，并且不做natasa1(config)#access-listnonatextendedpermitip192.168.2.0255.255.255.0172.16.

15、2.0255.255.255.0asa1(config)#nat(inside)0access-listnonat啟用isakmpasa1(config)#cryptoisakmpenableoutside配置階段一策略asa1(config)#cryptoisakmppolicy11asa1(config-isakmp-policy)#authenticationpre-shareasa1(config-isakmp-policy)#encryption3desasa1(config-isakmp-policy)#hashshaasa1(config-isakmp-policy)#group

16、2asa1(config-isakmp-policy)#lifetime86400配置IPSECVPN型為LANTOLANasa1(config)#tunnel-group211.81.209.2typeipsec-l2l配置階段一需要使用的預共享密鑰asa1(config)#tunnel-group211.81.209.2ipsec-attributesasa1(config-tunnel-ipsec)#pre-shared-keyxunshi配置需要走vpn的流量asal(config)#access-listvpnextendedpermitip192.168.2.0255.255.25

17、5.0172.16.2.0255.255.255.0配置階段二策略變換集asa1(config)#cryptoipsectransform-setsetesp-desesp-md5-hmac配置階段二的相關(guān)mapasa1(config)#cryptomapmap111matchaddressvpnasa1(config)#cryptomapmap111setpeer211.81.209.2asa1(config)#cryptomapmap111settransform-setsetasa1(config)#cryptomapmapinterfaceoutside測試：R2#ping172.16.2.1source192.168.2.1Typeescapesequencetoabort.Sending5,100-byteICMPEchosto172.16.2.1,timeoutis2seconds:Packetsentwithasourceaddressof192.168.2.1!Successrateis100