GNS3模擬Cisco+ipsec+vpn配置實(shí)例

GNS3莫擬Cisco+ipsec+vpn酉己置實(shí)例ASAI21181206211.81.209ASA2192,168,2.192,168,2.0/24具體要求：要求通過(guò)互聯(lián)網(wǎng)連接的公司A區(qū)和B區(qū)之間通過(guò)ipsecvhn賣頊192J68.20/34和172.1/2,0/2可以互訪GNS豕驗(yàn)拓?fù)鋱DASAIRIASA2R1配置說(shuō)明：R1只需要按照?qǐng)D在接口上配置好ip地址。!version12.4!hostnameR1!interfaceFastEthernet0/0ipaddress211.81.208.1255.255.255.0duplexautospeedauto!interfaceFastEthernet0/1ipaddress211.81.209.1255.255.255.0duplexautospeedauto!endR2配置說(shuō)明：R2在這里使用的是c3660-telco-mz.124-15.T5.bin的IOS,再在slot1插槽上加上NM-16ESWI塊模擬交換機(jī)；R3同R2模擬交換機(jī)。!version12.4hostnameR2interfaceFastEthernet0/0ipaddress11.1.1.2255.255.255.0duplexautospeedauto!interfaceFastEthernet1/10switchportaccessvlan2!interfaceVlan1noipaddress!interfaceVlan2ipaddress192.168.2.1255.255.255.0!iproute0.0.0.00.0.0.011.1.1.1endR3配置說(shuō)明version12.4!hostnameR3!interfaceFastEthernet0/0ipaddress12.1.1.2255.255.255.0duplexautospeedauto!interfaceFastEthernet1/10switchportaccessvlan2!interfaceVlan1noipaddress!interfaceVlan2ipaddress172.16.2.1255.255.255.0!iproute0.0.0.00.0.0.012.1.1.1endASA1配置說(shuō)明:SavedASAVersion8.0(2)!hostnameasalenablepassword8Ry2YjIyt7RRXU24encryptednames!interfaceEthernet0/0nameifoutsidesecurity-level0ipaddress211.81.208.2255.255.255.0!interfaceEthernet0/5nameifinsidesecurity-level100ipaddress11.1.1.1255.255.255.0!access-listicmpextendedpermiticmpanyanyaccess-listnonatextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0access-listvpnextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0global(outside)1interfacenat(inside)0access-listnonatnat(inside)10.0.0.00.0.0.0access-groupicmpininterfaceoutsiderouteoutside0.0.0.00.0.0.0211.81.208.11routeinside192.168.2.0255.255.255.011.1.1.21cryptoipsectransform-setsetesp-desesp-md5-hmaccryptomapmap111matchaddressvpncryptomapmap111setpeer211.81.209.2cryptomapmap111settransform-setsetcryptomapmapinterfaceoutsidecryptoisakmpenableoutsidecryptoisakmppolicy11authenticationpre-shareencryption3deshashshagroup2lifetime86400cryptoisakmppolicy65535authenticationpre-shareencryption3des

hashshagroup2lifetime86400!tunnel-group211.81.209.2typeipsec-l2ltunnel-group211.81.209.2ipsec-attributespre-shared-key*:endASA現(xiàn)置說(shuō)明asa2#shrun:SavedASAVersion8.0(2)!hostnameasa2enablepassword8Ry2YjIyt7RRXU24encryptednames!interfaceEthernet0/0nameifoutsidesecurity-level0ipaddress211.81.209.2255.255.255.0!interfaceEthernet0/1shutdownnonameifnosecurity-levelnoipaddress!interfaceEthernet0/5nameifinsidesecurity-level100ipaddress12.1.1.1255.255.255.0!access-listicmpextendedpermiticmpanyanyaccess-listnonatextendedpermitip172.16.2.0255.255.255.0192.168.2.0192.168.2.0255.255.255.0192.168.2.0access-listvpnextendedpermitip172.16.2.0255.255.255.0255.255.255.0global(outside)1interfacenat(inside)0access-listnonatnat(inside)10.0.0.00.0.0.0access-groupicmpininterfaceoutsiderouteoutside0.0.0.00.0.0.0211.81.209.11routeinside172.16.2.0255.255.255.012.1.1.21cryptoipsectransform-setsetesp-desesp-md5-hmaccryptomapmap111matchaddressvpncryptomapmap111setpeer211.81.208.2cryptomapmap111settransform-setsetcryptomapmapinterfaceoutsidecryptoisakmpenableoutsidecryptoisakmppolicy11authenticationpre-shareencryption3deshashshagroup2lifetime86400cryptoisakmppolicy65535authenticationpre-shareencryption3deshashshagroup2lifetime86400tunnel-group211.81.208.2typeipsec-l2ltunnel-group211.81.208.2ipsec-attributespre-shared-key*:end配置過(guò)程詳細(xì)：ASA1配置詳細(xì)：.端口基礎(chǔ)配置asa1(config)#interfaceethernet0/5asa1(config-if)#nameifinsideINFO:Securitylevelfor"inside"setto100bydefault.asa1(config-if)#security-level100asa1(config-if)#ipaddress11.1.1.1255.255.255.0asa1(config-if)#noshutdownasa1(config-if)#interfaceethernet0/0asa1(config-if)#nameifoutsideINFO:Securitylevelfor"outside"setto0bydefault.asa1(config-if)#security-level0asal(config-if)#ipaddress211.81.208.2255.255.255.0asal(config-if)#noshutdown.ASANAT相關(guān)asa1(config)#nat(inside)100asa1(config)#global(outside)1interfaceINFO:outsideinterfaceaddressaddedtoPATpool.ASA路由asa1(config)#routeoutside0.0.0.00.0.0.0211.81.208.1asa1(config)#routeinside192.168.2.0255.255.255.011.1.1.2.ASA做acl允許外部pingasa1(config)#access-listicmpextendedpermiticmpanyanyasa1(config)#access-groupicmpininterfaceoutsideB區(qū)配置同A區(qū)，將相應(yīng)地址更改！！IPSECVPN配置ASA1此處僅列出asa1的相關(guān)配置步驟，asa2配置見(jiàn)ASA2配置說(shuō)明).定義從A區(qū)到B區(qū)要走vpn的流量，并且不做natasa1(config)#access-listnonatextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0asa1(config)#nat(inside)0access-listnonat.啟用isakmpasa1(config)#cryptoisakmpenableoutside.配置階段一策略asa1(config)#cryptoisakmppolicy11asa1(config-isakmp-policy)#authenticationpre-shareasa1(config-isakmp-policy)#encryption3desasa1(config-isakmp-policy)#hashshaasa1(config-isakmp-policy)#group2asa1(config-isakmp-policy)#lifetime86400.配置IPSECVPNfe型為L(zhǎng)ANTOLANasa1(config)#tunnel-group211.81.209.2typeipsec-l2l.配置階段一需要使用的預(yù)共享密鑰asa1(config)#tunnel-group211.81.209.2ipsec-attributesasa1(config-tunnel-ipsec)#pre-shared-keyxunshi.配置需要走vpn的流量asa1(config)#access-listvpnextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0.配置階段二策略變換集asa1(config)#cryptoipsectransform-setsetesp-desesp-md5-hmac.配置階段二的相關(guān)mapasal(config)#cryptomapmap111matchaddressvpnasal(config)#cryptomapmap111setpeer211.81.209.2asa1(config)#cryptomapmap111settransform-setsetasa1(config)#cryptomapmapinterfaceoutside測(cè)試：R2#ping172.16.2.1source192.168.2.1Typeescapesequencetoabort.Sending5,100-byteICMPEchosto172.16.2.1,timeoutis2seconds:Packetsentwithasourceaddressof192.168.2.1!!!!!Successrateis100pe