ASA842 L2L***没有配置隧道分离，分支机构从总部上公网测试

一.测试拓扑：

二.测试思路：

A.总部ASA不配置隧道分离，分支机构所有流量都走***

B.总部ASA配置NAT允许分支网段PAT上公网

----因为分支流量会从outside接口反弹流量，需要配置same-security-traffic permit intra-interface

三.基本配置：
A.Inside路由器：
interface Ethernet0/0
ip address 10.1.1.2 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 10.1.1.1
B.Center_ASA842防火墙：
interface GigabitEthernet0
nameif inside
security-level 100
ip address 10.1.1.1 255.255.255.0
interface GigabitEthernet1
nameif outside
security-level 0
ip address 202.100.1.1 255.255.255.0
route outside 0.0.0.0 0.0.0.0 202.100.1.10
access-list outside extended permit icmp any any
access-group outside in interface outside
C.Internet路由器：
interface Loopback0
ip address 61.1.1.1 255.255.255.0
interface Ethernet0/0
ip address 202.100.1.10 255.255.255.0
no shutdown
interface Ethernet0/1
ip address 202.100.2.10 255.255.255.0
no shutdown
D.Branch路由器：
interface Loopback0
ip address 61.1.1.1 255.255.255.0
interface Ethernet0/0
ip address 202.100.1.10 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 202.100.2.10
四.Site-to-Site ***配置：
A.Branch路由器：
①第一阶段策略：
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 202.100.1.1
②第二阶段转换集：
crypto ipsec transform-set transet esp-des esp-md5-hmac
③配置感兴趣流：
ip access-list extended ***
permit ip 192.168.1.0 0.0.0.255 any
④配置并应用crypto map：
crypto map crymap 10 ipsec-isakmp
set peer 202.100.1.1
set transform-set transet
match address ***
crypto map crymap 10 ipsec-isakmp
match address ***
B.Center_ASA842防火墙：
①第一阶段策略：
crypto ikev1 policy 10
authentication pre-share
encryption des
hash md5
group 2
crypto isakmp identity address
tunnel-group 202.100.2.1 type ipsec-l2l
tunnel-group 202.100.2.1 ipsec-attributes
ikev1 pre-shared-key cisco
②第二阶段转换集：
crypto ipsec ikev1 transform-set transet esp-des esp-md5-hmac
③配置感兴趣流：
access-list *** extended permit ip any 192.168.1.0 255.255.255.0
④配置并应用crypto map：
crypto map crymap 10 match address ***
crypto map crymap 10 set peer 202.100.2.1
crypto map crymap 10 set ikev1 transform-set transet
crypto map crymap 10 set reverse-route
crypto map crymap interface outside
⑤在外部接口启用IKEV1：
crypto ikev1 enable outside
五.Center_ASA842防火墙NAT配置：
A.内部PAT出公网：
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
B.***流量NAT免除：
object network obj-10.1.1.0
subnet 10.1.1.0 255.255.255.0
object network obj-192.168.1.0
subnet 192.168.1.0 255.255.255.0
nat (inside,any) source static obj-10.1.1.0 obj-10.1.1.0 destination static obj-192.168.1.0 obj-192.168.1.0 no-proxy-arp
C.Hairpin NAT使得分支机构PAT上公网：
same-security-traffic permit intra-interface
object network obj-192.168.1.0
nat (outside,outside) dynamic interface