010、ccie security v4ikev212年11月附带yeslab现任明教教主secie新版flex6.anyconnect3.0to asa

1、实验拓扑Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect3.0 to ASASecurity CCIE V4系列预先配置（1）hostname Internet!interface FastEthernet0/0ip address 0 no shutdown!interface FastEthernet1/0ip address 0 no shutdownhostname Center-ASA!interface GigabitEthernet1nameif Outsidesecurity-level 0ip address no shutdo

2、wn!interface GigabitEthernet2nameif Inside security-level 100ip address no shutdown!route Outside 0预先配置（2）hostname Inside!interface FastEthernet2/0ip address 0 no shutdown!ip route Anyconnect3.0 to ASASecurity CCIE V4系列配置NTP（时间同步非常重要）Internet上配置：Internet(config)#clock timezone GMT +8 Internet#clock

3、set 11:54:00 14 oct 2012 Internet(config)#ntp masterCenter-ASA上配置：Center-ASA(config)# clock timezone GMT +8Center-ASA(config)# ntp server 0Spoke to Spoke FlexSecurity CCIE V4系列Anyconnect3.0 to ASAInternet上配置服务器ip http server!ipname mingjiao.!, ou=mingjiaocrypto pki server CAdatabase level completeis

4、suer-name cn=Internet.mingjiao.grant auto no shutdownSecurity CCIE V4系列Center-ASA上配置Trustpoint1.配置Trustpoint:-name mingjiao.modulus 1024crypto key generate rsa label Center-ASA.mingjiao.crypto ca trustpoint CAenrollment urlfqdn Center-ASA.mingjiao.subject-name cn=Center-ASA.mingjiao., ou=mingjiaokey

5、pair Center-ASA.mingjiao.认证服务器，获取根:Center-ASA(config)# crypto ca authenticate CA申请个人:Center-ASA(config)# crypto ca enroll CAAnyconnect3.0 to ASASecurity CCIE V4系列Center-ASA上配置Trustpoint1.配置Trustpoint:-name mingjiao.modulus 1024crypto key generate rsa label Center-ASA.mingjiao.crypto ca trustpoint CA

6、enrollment urlfqdn Center-ASA.mingjiao.subject-name cn=Center-ASA.mingjiao., ou=mingjiaokeypair Center-ASA.mingjiao.认证服务器，获取根:Center-ASA(config)# crypto ca authenticate CA申请个人:Center-ASA(config)# crypto ca enroll CAAnyconnect3.0 to ASASecurity CCIE V4系列Anyconnect3.0 to ASA配置SSL使用“CA” 颁发的Center-ASA(c

7、onfig)# ssl trust-point CASecurity CCIE V4系列查看Profile配置Anyconnect3.0 to ASASecurity CCIE V4系列可以通过ASDM和Anyconnect Profile-Editor产生ASDM产生Profile（1）Anyconnect3.0 to ASASecurity CCIE V4系列ASDM产生Profile（2）Anyconnect3.0 to ASASecurity CCIE V4系列ASDM产生Profile（3）Anyconnect3.0 to ASASecurity CCIE V4系列可以配置Anyco

8、nnect Profile Editor产生Profile（1）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect Profile Editor产生Profile（2）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect Profile Editor产生Profile（3）Anyconnect3.0 to ASASecurity CCIE V4系列保存到Anyconnect安装配置WebAnyconnect3.0 to ASASecurity CCIE V4系列webenable Outsideanyco

9、nnect image disk0:/anyconnect-win-3.0.0629-k9.pkg 1 anyconnect profiles Yeslab-Profile disk0:/Yeslab-Profile.xml anyconnect enable配址池Anyconnect3.0 to ASASecurity CCIE V4系列ip local pool Yeslab-Pool 00-00配置Group-Policygroup-policy Yeslab-Policy internal group-policy Yeslab-Policy attributes-tunnel-pro

10、tocol ikev2 ssl-client ssl-clientless address-pools value Yeslab-Poolwebanyconnect profiles value Yeslab-Profile type userAnyconnect3.0 to ASASecurity CCIE V4系列创建用户并关联Group-Policyusername yeslabuser password cisco username yeslabuser attributes-group-policy Yeslab-PolicyAnyconnect3.0 to ASASecurity

11、CCIE V4系列配置IKEv2crypto ikev2 enable Outside client-services port 443crypto ikev2 remote-access trustpoint CAcrypto ikev2 policy 10crypto ipsec ikev2 ipsec-proposal Yeslab-IKEv2-Proposalcrypto dynamic-map Yeslab-Dymap 100 set ikev2 ipsec-proposalYeslab-IKEv2-Proposalcrypto map Yeslab-Map 1000 ipsec-i

12、sakmp dynamic Yeslab-Dymapcrypto map Yeslab-Map interface OutsideAnyconnect3.0 to ASASecurity CCIE V4系列配置主机Anyconnect3.0 to ASASecurity CCIE V4系列解决问题（1）Anyconnect3.0 to ASASecurity CCIE V4系列解决问题（2）Anyconnect3.0 to ASASecurity CCIE V4系列解决问题（3）Anyconnect3.0 to ASASecurity CCIE V4系列解决问题（4）Anyconnect3.0

13、 to ASASecurity CCIE V4系列拨号测试（1）Anyconnect3.0 to ASASecurity CCIE V4系列拨号测试（2）Anyconnect3.0 to ASASecurity CCIE V4系列拨号测试（3）Anyconnect3.0 to ASASecurity CCIE V4系列拨号测试（4）Anyconnect3.0 to ASASecurity CCIE V4系列拨号测试（5）Anyconnect3.0 to ASASecurity CCIE V4系列需要断掉之前的SSL连接，重新拨号IPSec拨号测试（6）Anyconnect3.0 to ASAS

14、ecurity CCIE V4系列6.2 ASDM配置Anyconnect3.0 to ASAAnyconnect3.0 to ASASecurity CCIE V4系列配置ASDMhttp server enablehttp 0 0 outsideusername admin password cisco privilege 15aaa authentication http console LOCALAnyconnect3.0 to ASASecurity CCIE V4系列配置ASDMAnyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（1

15、）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（2）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（3）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（4）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（5）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（6）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（7）Anyconnect3.0 to ASASecurity CCIE V4系列Anyconnect向导（8）Anyconnect3.