三通it學(xué)院asa高級課程第三大部分anyconnect控制與

第一大部分:WEBVPN高級控第一大部分:WEBVPN高級控第五大部分:EasyVPN高VPN高級課作者北京Yeslab安全實(shí)驗(yàn)室出ASAVPNASAVPN高級課內(nèi)容簡內(nèi)容簡通過授權(quán)ACL控制VPNSplit-dns外部Group-下載各自AnyconnectAnyconnectVPN控制VPN高級課VPN高級課第三大部Anyconnect高級控制與授VPN高級VPN高級課Anyconnect高級控制與授3.1通過授權(quán)ACL控制VPN流ASAVPN高ASAVPN高級課VPN流實(shí)驗(yàn)拓ASAVPN高ASAVPN高級課VPN流配置WebTypeaccess-listWEB-ACLwebtypepermittcphosteqwwwlogdefaultaccess-listWEB-ACLwebtypedenyurllogdefaultfiltervalueWEB-嚴(yán)重注意:WebTypeACL只對代理服務(wù)器工作模型（7層工作模型）的ASAVPN高ASAVPN高級課VPN流配置WebTypeASAVPN高級課ASAVPN高級課VPN流配置網(wǎng)絡(luò)類access-listNet-ACLextendedpermittcpanyhosteqvpn-filtervalueNet-ACL嚴(yán)重注意:網(wǎng)ACL只對三層網(wǎng)絡(luò)工作模型的SSLVPN生效，對代理服務(wù)器作模式的SSLVPN不生效ASAVPN高級ASAVPN高級課VPN流配置網(wǎng)絡(luò)類ASAVPNASAVPN高級課Anyconnect高級控制與授3.2“LocalAccess”隧道分割技ASAVPN高級課ASAVPN高級課3.2LocalAccess”隧道分配置Access隧道分割access-listLOCAL-ACCESSstandardpermithostgroup-policymingjiaogroupinternalsplit-tunnel-policyexcludespecifiedsplit-tunnel-network-listvalueLOCAL-ASAVPN高ASAVPN高級課3.2LocalAccess”隧道分配置LocalAccess隧道分割A(yù)SAVPN高級ASAVPN高級課3.2“LocalAccess隧道割技客戶端手動激活LocalASAVPN高ASAVPN高級課3.2“LocalAccess隧道通過ClientProfile激活Local割技VPN高級VPN高級課Anyconnect高級控制與授3.3Split-dns技ASAVPN高ASAVPN高級課3.3Split-dns技配置Split-dns技術(shù)dns-servervalue00default-domainvaluesplit-dnsvalue只有后綴為的域名會送往00這個DNS服務(wù)器進(jìn)行解測試結(jié)果只要網(wǎng)絡(luò)允許（隧道分割），VPN客戶會同時利用本地配置和VPN推送DNS服務(wù)器來解析域名啟用Split-dns后，內(nèi)部服務(wù)器只解析，split-dns所指定后綴名的域名ASAVPNASAVPN高級課3.3Split-dns技配置Split-dns技術(shù)VPN高級VPN高級課Anyconnect高級控制與授ASAVPNASAVPN高級課3.4外部Group-配置外部Group-第一步:定義AAA服務(wù)器aaa-serverACS5protocolaaa-serverACS5(Outside)host41keyciscoASAVPN高ASAVPN高級課3.4外部Group-配置外部Group-第二步:創(chuàng)建用戶并且測試ASA#testaaaauthenticationACS5ServerIPAddressorname:41Username:acsuserPassword:INFO:AuthenticationASAVPNASAVPN高級課3.4外部Group-配置外部Group-第三步:配置外部ASAVPNASAVPN高級課3.4外部Group-配置外部Group-第三步:配置外部group-policywaibugroupexternalserver-groupACS5passwordASAVPNASAVPN高級課3.4外部Group-配置外部Group-第四步:配置AuthorProfile（forASAVPN高級課ASAVPN高級課3.4外部Group-配置外部Group-第五步:配置AuthorProfile（for具體授權(quán)參數(shù)的介紹請參考VPN官方指南的62-69ASAVPN高級ASAVPN高級課3.4外部Group-配置外部Group-第六步:配置授權(quán)，為用戶關(guān)聯(lián)ASAVPNASAVPN高級課3.4外部Group-配置外部Group-第七步:修改tunnel-group的認(rèn)證服務(wù)器tunnel-groupDefaultWEBVPNGroupgeneral-attributesauthentication-server-groupACS5ASAVPNASAVPN高級課3.4外部Group-配置外部Group-第八步:測試結(jié)果VPN高級VPN高級課Anyconnect高級控制與授3.5:下載各自Anyconnect組ASAVPNASAVPN高級課配置各種ClientASAVPNASAVPN高級課配置GroupASAASAVPN高級課配置Groupanyconnectmodulesvaluedart,nam,vpngina,telemetry,postureanyconnectprofilesvalueVPN-ProfiletypeuseranyconnectprofilesvalueNAM-ProfiletypenamanyconnectprofilesvalueTelemetry-PolicytypetelemetryASAVPN高級課ASAVPN高級課通過WEBVPN下載ASAVPNASAVPN高級課下載后效VPN高級VPN高級課Anyconnect高級控制與授3.6:AnyconnectVPN備用網(wǎng)ASAVPN高ASAVPN高級課3.6AnyconnectVPN備用網(wǎng)ASA1預(yù)先配!nameifOutsidesecurity-levelipaddress0no!nameifInsidesecurity-levelipaddress0no!iplocalpoolippool00-!routeOutsidehttpserverhttp!enable3.0.0629-k9.pkg1anyconnect!group-policymingjiaogroupinternalgroup-policymingjiaogroupattributesvpn-tunnel-protocolikev1ikev2ssl-clientaddress-poolsvalue!usernamemingjiaouserpasswordciscousernamemingjiaouserattributesvpn-group-policyASAVPN高ASAVPN高級課3.6AnyconnectVPN備用網(wǎng)ASA2預(yù)先配!nameifOutsidesecurity-levelno!nameifInsidesecurity-levelipaddress1no!iplocalpoolippool00-!routeOutsidehttpserverhttp!enable3.0.0629-k9.pkg1anyconnect!group-policymingjiaogroupinternalgroup-policymingjiaogroupattributesvpn-tunnel-protocolikev1ikev2ssl-clientaddress-poolsvalue!usernamemingjiaouserpasswordciscousernamemingjiaouserattributesvpn-group-policyASAVPNASAVPN高級課3.6AnyconnectVPN備用網(wǎng)配置備用網(wǎng)ASAVPN高ASAVPN高級課3.6AnyconnectVPN備用網(wǎng)測試備用網(wǎng)VPN高級VPN高級課Anyconnect高級控制與授3.7控制ASAVPN高ASAVPN高級課3.7控制拓ASAVPN高ASAVPN高級課3.7控制正常Anyconnect使用DTLS并且壓嚴(yán)重注意需要真機(jī)測ASAVPN高級課ASAVPN高級課3.7控制禁用DTLS的壓縮功CLI配置group-policymingjiaogroupattributesanyconnectssldtlsnoneanyconnectdtlscompressionnoneASDM配置ASAVPNASAVPN高級課3.7控制禁用DTLS的壓縮功能（測試ASAVPNASAVPN高級課3.7控制基于Group-Policy禁用CLI配置group-policymingjiaogroupattributesASDM配置ASAVPNASAVPN高級課3.7控制基于Group-Policy禁用DTLS（測試VPN高級課3.7VPN高級課3.7控制全局禁用CLI配置enableOutsidetls-ASDM配置VPN高級VPN高級課Anyconnect高級控制與授3.8:IPv6/IPv4雙堆棧嚴(yán)重注意需要真機(jī)測ASAASAVPN高級課3.8IPv6/IPv4雙堆棧配置雙堆棧hostnameiplocalpoolipv4-pool00-00ipv6localpoolipv6-pool2001:123::100/64!nameifOutsidesecurity-levelipaddress0noshutdownnameifInsidesecurity-levelipaddress0noshutdownASAVPN高ASAVPN高級課3.8IPv6/IPv4雙堆棧配置雙堆棧httpserverhttpOutsideenableanyconnectimagedisk0:/anyconnect-win-3.1.01065-k9.pkg1anyconnectenable!group-policyipv4-ipv6-GPinternalvpn-tunnel-protocolssl-clientssl-clientlessaddress-poolsvalueipv4-poolipv6-address-poolsvalueipv6-!us