多厂商***系列之十二:ASA Dynamic site-to-site IPSec ***
作者:互联网
说明
1. 拓扑: 总部为固定IP ,分部为ADSL 拨号上网
2. 要求: 分部要与总部实现IPSec *** 总部通过dynamic map配置,分部静态配置即可
拓扑
3. 总部 *** 配置:
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
【配置NAT ,内部用户可以上网】
access-list ***acl extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list ***acl extended permit ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0
nat (inside) 0 access-list nonat
【配置***的感兴趣流量以及,NAT旁路,让***的流量不走NAT】
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto ipsec transform-set myset esp-des esp-md5-hmac
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key ccieh3c.com
【红色部分为系统默认的组,动态L2L,必须在这下面配置】
crypto dynamic-map cisco 10 match address ***acl
crypto dynamic-map cisco 10 set transform-set myset
crypto dynamic-map cisco 10 set reverse-route
crypto map mp 10 ipsec-isakmp dynamic cisco
crypto map mp interface outside
crypto isakmp enable outside
4 . 分部*** 配置
access-list *** extended permit ip 192.168.20.0 255.255.255.0 host 192.168.1.254
access-list nonat extended permit ip 192.168.20.0 255.255.255.0 host 192.168.1.254
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
tunnel-group 120.1.1.1 type ipsec-l2l
tunnel-group 120.1.1.1 ipsec-attributes
pre-shared-key ccieh3c.taobao.com
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto isakmp key cisco address 100.1.1.1
crypto map mp 1 match address ***
crypto map mp 1 set peer 100.1.1.1
crypto map mp 1 set transform-set myset
crypto map mp interface outside
crypto isakmp enable outside
基于8.4的实现与NAT旁路【只给出了重要的配置,大部分跟8.0一致】
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
说明:与传统的8.0相同,多了一个IKEV1的参数,因为8.4以后支持IKEV2了,所以区分开来。
tunnel-group DefaultL2LGroup ipsec-attributes
ikev1 pre-shared-key ccieh3c.taobao.com
说明:这里必须使用系统默认的组来做动态L2L。
crypto ipsec ikev1 transform-set trans esp-des esp-md5-hmac
crypto dynamic-map dyl2l 1000 set ikev1 transform-set trans
crypto map l2l 1000 ipsec-isakmp dynamic dyl2l
crypto map l2l interface outside
说明:这里必须用动态map调用转换集,然后用静态map关联动态。
配置内部网络访问Internet的NAT
object network inside
subnet 2.2.2.0 255.255.255.0
nat (inside,outside) dynamic interface
NAT旁路【让***的流量不经过NAT转换】
object network inside-***
subnet 192.168.1.0 255.255.255.0
object network outside-***1
subnet 192.168.20.0 255.255.255.0
object network outside-***2
subnet 192.168.10.0 255.255.255.0
nat (inside,outside) source static inside-*** inside-*** destination static outside-***1 outside-***1
nat (inside,outside) source static inside-*** inside-*** destination static outside-***2 outside-***2
本文转载于公众号:网络之路博客
标签:map,outside,inside,Dynamic,site,192.168,255.255,ASA,255.0 来源: https://blog.51cto.com/ccieh3c/2658829