GNS3模拟Cisco+ipsec+vpn配置实例讲解学习

1、GNS妙莫拟Cisco+ipsec+vpn配置实例ASA121181208,4R1211.81.2091/24ASA2192.168,2.0/24具体要求：要求通过互联网连接的公司A区和8区之间通过ips及vlim实现192.168.2.0/54和172.16.2.0/2可以互访GNS额验拓扑图ASAlR1ASA2R1配置说明：R1只需要按照图在接口上配置好ip地址。!version12.4!hostnameR1!interfaceFastEthernet0/0ipaddress211.81.208.1255.255.255.0duplexautospeedauto!interfaceFast

2、Ethernet0/1ipaddress211.81.209.1255.255.255.0duplexautospeedauto!endR2配置说明：R2在这里使用的是c3660-telco-mz.124-15.T5.bin的IOS,再在slot1插槽上加上NM-16ES澳块模拟交换机；R3同R2模拟交换机。!version12.4!hostnameR2interfaceFastEthernet0/0ipaddress11.1.1.2255.255.255.0duplexautospeedauto!interfaceFastEthernet1/10switchportaccessvlan2!i

3、nterfaceVlan1noipaddress!interfaceVlan2ipaddress192.168.2.1255.255.255.0!iproute0.0.0.00.0.0.011.1.1.1!endR3配置说明!version12.4!hostnameR3!interfaceFastEthernet0/0ipaddress12.1.1.2255.255.255.0duplexautospeedauto!interfaceFastEthernet1/10switchportaccessvlan2!interfaceVlan1noipaddress!interfaceVlan2ipa

4、ddress172.16.2.1255.255.255.0!iproute0.0.0.00.0.0.012.1.1.1!endASA1配置说明:SavedASAVersion8.0(2)!hostnameasalenablepassword8Ry2YjIyt7RRXU24encryptednames!interfaceEthernet0/0nameifoutsidesecurity-level0ipaddress211.81.208.2255.255.255.0!interfaceEthernet0/5nameifinsidesecurity-level100ipaddress11.1.1.1

5、255.255.255.0!access-listicmpextendedpermiticmpanyanyaccess-listnonatextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0access-listvpnextendedpermitip192.168.2.0255.255.255.0172.16.2.0255.255.255.0global(outside)1interfacenat(inside)0access-listnonatnat(inside)10.0.0.00.0.0.0access-group

6、icmpininterfaceoutsiderouteoutside0.0.0.00.0.0.0211.81.208.11routeinside192.168.2.0255.255.255.011.1.1.21cryptoipsectransform-setsetesp-desesp-md5-hmaccryptomapmap111matchaddressvpncryptomapmap111setpeer211.81.209.2cryptomapmap111settransform-setsetcryptomapmapinterfaceoutsidecryptoisakmpenableoutsi

7、decryptoisakmppolicy11authenticationpre-shareencryption3deshashshagroup2lifetime86400cryptoisakmppolicy65535authenticationpre-shareencryption3deshashshagroup2lifetime86400!tunnel-group211.81.209.2typeipsec-l2ltunnel-group211.81.209.2ipsec-attributespre-shared-key*:endASA2BE置说明asa2#shrun:SavedASAVers

8、ion8.0(2)!hostnameasa2enablepassword8Ry2YjIyt7RRXU24encryptednames!interfaceEthernet0/0nameifoutsidesecurity-level0ipaddress211.81.209.2255.255.255.0!interfaceEthernet0/1shutdownnonameifnosecurity-levelnoipaddress!interfaceEthernet0/5nameifinsidesecurity-level100ipaddress12.1.1.1255.255.255.0!access

9、-listicmpextendedpermiticmpanyanyaccess-listnonatextendedpermitip172.16.2.0255.255.255.0192.168.2.0255.255.255.0access-listvpnextendedpermitip172.16.2.0255.255.255.0192.168.2.0255.255.255.0global(outside)1interfacenat(inside)0access-listnonatnat(inside)10.0.0.00.0.0.0access-groupicmpininterfaceoutsi

10、derouteoutside0.0.0.00.0.0.0211.81.209.11routeinside172.16.2.0255.255.255.012.1.1.21cryptoipsectransform-setsetesp-desesp-md5-hmaccryptomapmap111matchaddressvpncryptomapmap111setpeer211.81.208.2cryptomapmap111settransform-setsetcryptomapmapinterfaceoutsidecryptoisakmpenableoutsidecryptoisakmppolicy1

11、1authenticationpre-shareencryption3deshashshagroup2lifetime86400cryptoisakmppolicy65535authenticationpre-shareencryption3deshashshagroup2lifetime86400tunnel-group211.81.208.2typeipsec-l2ltunnel-group211.81.208.2ipsec-attributespre-shared-key*:end配置过程详细：ASA1配置详细：端口基础配置asa1(config)#interfaceethernet0/

12、5asa1(config-if)#nameifinsideINFO:Securitylevelforinsidesetto100bydefault.asa1(config-if)#security-level100asa1(config-if)#ipaddress11.1.1.1255.255.255.0asa1(config-if)#noshutdownasa1(config-if)#interfaceethernet0/0asa1(config-if)#nameifoutsideINFO:Securitylevelforoutsidesetto0bydefault.asa1(config-

13、if)#security-level0asal(config-if)#ipaddress211.81.208.2255.255.255.0asal(config-if)#noshutdownASANAT相关asa1(config)#nat(inside)100asa1(config)#global(outside)1interfaceINFO:outsideinterfaceaddressaddedtoPATpoolASA路由asa1(config)#routeoutside0.0.0.00.0.0.0211.81.208.1asa1(config)#routeinside192.168.2.

14、0255.255.255.011.1.1.2ASA做acl允许外部pingasa1(config)#access-listicmpextendedpermiticmpanyanyasa1(config)#access-groupicmpininterfaceoutsideB区配置同A区，将相应地址更改！IPSECVPN配置ASA1此处仅歹U出asa1的相关配置步骤，asa2配置见ASA2配置说明)定义从A区到B区要走vpn的流量，并且不做natasa1(config)#access-listnonatextendedpermitip192.168.2.0255.255.255.0172.16.

15、2.0255.255.255.0asa1(config)#nat(inside)0access-listnonat启用isakmpasa1(config)#cryptoisakmpenableoutside配置阶段一策略asa1(config)#cryptoisakmppolicy11asa1(config-isakmp-policy)#authenticationpre-shareasa1(config-isakmp-policy)#encryption3desasa1(config-isakmp-policy)#hashshaasa1(config-isakmp-policy)#group

16、2asa1(config-isakmp-policy)#lifetime86400配置IPSECVPN型为LANTOLANasa1(config)#tunnel-group211.81.209.2typeipsec-l2l配置阶段一需要使用的预共享密钥asa1(config)#tunnel-group211.81.209.2ipsec-attributesasa1(config-tunnel-ipsec)#pre-shared-keyxunshi配置需要走vpn的流量asal(config)#access-listvpnextendedpermitip192.168.2.0255.255.25

17、5.0172.16.2.0255.255.255.0配置阶段二策略变换集asa1(config)#cryptoipsectransform-setsetesp-desesp-md5-hmac配置阶段二的相关mapasa1(config)#cryptomapmap111matchaddressvpnasa1(config)#cryptomapmap111setpeer211.81.209.2asa1(config)#cryptomapmap111settransform-setsetasa1(config)#cryptomapmapinterfaceoutside测试：R2#ping172.16.2.1source192.168.2.1Typeescapesequencetoabort.Sending5,100-byteICMPEchosto172.16.2.1,timeoutis2seconds:Packetsentwithasourceaddressof192.168.2.1!Successrateis100