IPsecVPN（下）

FreeBSD ---- CISCO ASA 5540 (IPsec VPN 隧道模式) CISCO ASA 5540配置 1、 端口配置 IP 地址 ciscoasa(config)# interface GigabitEthernet0/0 ciscoasa(config-if)# nameif outside ciscoasa(config-if)# security-level 0 ciscoasa(config-if)# ip addre

FreeBSD ---- CISCO ASA 5540 (IPsec VPN 隧道模式)

CISCO ASA 5540配置

1、端口配置IP地址

ciscoasa(config)# interface GigabitEthernet0/0

ciscoasa(config-if)# nameif outside

ciscoasa(config-if)# security-level 0

ciscoasa(config-if)# ip address 61.49.29.x 255.255.255.x

ciscoasa(config-if)# q

ciscoasa(config)# interface GigabitEthernet0/1

ciscoasa(config-if)# nameif outside

ciscoasa(config-if)# security-level 100

ciscoasa(config-if)# ip address 10.1.32.5 255.255.255.0

ciscoasa(config-if)# q

2、添加路由

ciscoasa(config)# route outside 0.0.0.0 0.0.0.0 61.49.29.x

ciscoasa(config)# route inside 10.1.10.0 255.255.255.0 10.1.5.1

ciscoasa(config)# route inside 10.1.254.101 255.255.255.255 10.1.32.1

ciscoasa(config)# route inside 172.16.31.0 255.255.255.0 10.1.5.1

3、配置IKE

ciscoasa(config)# crypto isakmp identity auto

ciscoasa(config)# crypto isakmp enable outside

ciscoasa(config)# crypto isakmp policy 10

ciscoasa(config-isakmp-policy)# authentication pre-share

ciscoasa(config-isakmp-policy)# encryption 3des

ciscoasa(config-isakmp-policy)# hash sha

ciscoasa(config-isakmp-policy)# group 2

ciscoasa(config-isakmp-policy)# lifetime 86400

ciscoasa(config-isakmp-policy)# q

ciscoasa(config)# crypto isakmp nat-traversal 20

4、配置Keys

ciscoasa(config)# crypto isakmp key Umessage-vpn address 60.247.57.x

5、配置IPSec

ciscoasa(config)# crypto ipsec transform-set xVPN esp-3des esp-sha-hmac

ciscoasa(config)# crypto ipsec security-association lifetime seconds 28800

ciscoasa(config)# crypto ipsec security-association lifetime kilobytes 4608000

ciscoasa(config)# crypto ipsec security-association replay window-size 64

ciscoasa(config)# crypto ipsec fragmentation before-encryption outside

ciscoasa(config)# crypto ipsec fragmentation before-encryption inside

ciscoasa(config)# crypto ipsec df-bit copy-df outside

ciscoasa(config)# crypto ipsec df-bit copy-df inside

6、配置访问控制列表

ciscoasa(config)# object-group network local-lan

ciscoasa(config-network)# network-object host 10.1.5.0

ciscoasa(config-network)# q

ciscoasa(config)# object-group network remote-lan

ciscoasa(config-network)# network-object host 192.168.190.20

ciscoasa(config-network)# q

ciscoasa(config)# access-list vpnacl extended permit ip object-group local-lan object-group remote-lan

7、配置IPSec加密映射

ciscoasa(config)# crypto map vpnmap 10 match address vpnacl

ciscoasa(config)# crypto map vpnmap 10 set pfs group2

ciscoasa(config)# crypto map vpnmap 10 set connection-type bi-directional

ciscoasa(config)# crypto map vpnmap 10 set peer 60.247.57.x

ciscoasa(config)# crypto map vpnmap 10 set transform-set xVPN

ciscoasa(config)# crypto map vpnmap 10 set inheritance rule

ciscoasa(config)# crypto map vpnmap 10 set phase1-mode main

ciscoasa(config)# crypto map vpnmap interface outside

seven