实验拓朴图

 




实验目的：总部ASA5520与分支机构CISCO2911建立起IPSEC ×××，实现10.10.10.0/24与172.16.1.0/24两个子网的互访。即PC1与PC2能够互相PING通。

实验环境搭建工具：使用的工具有dynmips工大瑞普CCNP版 、 vmware+ASA镜像。除ASA外，其它设备全由dynmips路由器模拟。包括PC1，PC2，ASA与dynmips的连接采用虚拟网卡的桥接。

使的拓朴为：控制台 ×××.cmd

下面为各个设备键入的配置：

R1

R1模拟的是一台PC，因此只需给他配置一个IP，指定一个网关就可以了。

interface Serial1/1
 ip address 10.10.10.2 255.255.255.0
no sh
exit

no ip routing                  //关闭路由
ip default-gateway 10.10.10.1        //网关指定为10.10.10.1

 

R2

 R2模拟的是一台3560三层交换机，如果是真实的设备，肯定还要配VLAN等其它的配置，现在就省略了。我现在只要它能通。
只需配置接口IP，与默认路由

interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 no sh
interface Serial1/0
 ip address 10.10.10.1 255.255.255.0
no sh

ip route 0.0.0.0 0.0.0.0 192.168.1.1                  //下一跳指向防火墙inside口

 

ASA

ASA需要配置IP，划分区域，设置权限，路由，设置IPSEC×××

interface Ethernet0/0
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/1
 nameif outside
 security-level 0
 ip address 1.1.1.1 255.255.255.0 

access-list outside extended permit ip any any 
access-group outside in interface outside

route outside 0.0.0.0 0.0.0.0 1.1.1.2 1
route inside 10.10.10.0 255.255.255.0 192.168.1.2 1


access-list ipsec*** extended permit ip host 10.10.10.2 host 172.16.1.2 
 crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
 pre-shared-key  cisco

crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto map l2l 1 match address ipsec***
crypto map l2l 1 set peer 2.2.2.2
crypto map l2l 1 set transform-set myset
crypto map l2l interface outside
crypto isakmp enable outside

 

 R3

R3模拟了ISP的路由器，只需要配置接口IP就行了。

interface FastEthernet0/0
 ip address 1.1.1.2 255.255.255.0
no sh
interface Serial1/1
 ip address 2.2.2.1 255.255.255.0
no sh

 

R4

R4作为分支机构边界路由器，需要配置IP，默认路由，IPSEC×××

interface Serial1/0
 ip address 2.2.2.2 255.255.255.0
 crypto map mymap
no sh

interface Serial1/2
 ip address 172.16.1.1 255.255.255.0
no sh

 

ip route 0.0.0.0 0.0.0.0 2.2.2.1

access-list 100 permit ip host 172.16.1.2 host 10.10.10.2

 

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco address 1.1.1.1
!
!        
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map mymap 1 ipsec-isakmp
 set peer 1.1.1.1
 set transform-set myset
 match address 100

 

R5

R5是模拟的一台PC，和R1是一样的，只需配置IP和指定网关。

interface Serial1/3
 ip address 172.16.1.2 255.255.255.0
no sh
exit

no ip routing

ip default-gateway 172.16.1.1

 

 

到现在配置完成了。。

IPSEC成功建立，但是遇到一个问题，如果配置了NAT，则IPSEC SA关系则建立不了，R1与R5也是PING不通的，

我搜索了很多解决办法，没有一个完善的，后来终于想明白了，现在就分享给大家吧。。

解决办法：去往ipsec ***目的的流量不经过NAT，其它流量才经过NAT，是不是太简单了吧!!!!!!!!!!

 

ASA配置：

access-list ipsec*** permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0

nat (inside) 0  access-list ipsec***

nat (inside) 1 0 0

global (outside) 1 interface

路由器配置

ip access-list extended nat
 deny   ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
 permit ip 172.16.1.0 0.0.0.255 any

ip nat pool natpool 2.2.2.10 2.2.2.10 netmask 255.255.255.0
ip nat inside source list nat pool natpool overload

interface Serial1/0
 ip nat outside
interface Serial1/2
 ip nat inside
 

搞定了哈，很开心。。

 

 

 

 

 

 

 

 

 

以下的配置文件不包括NAT配置

 

R1 配置

 

Router#sh run
Building configuration...

Current configuration : 1076 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip routing
no ip cef
!
!
!
!
!
multilink bundle-name authenticated
!        
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 no ip route-cache
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 no ip route-cache
 shutdown
 serial restart-delay 0
!
interface Serial1/1
 ip address 10.10.10.2 255.255.255.0
 no ip route-cache
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 no ip route-cache
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 no ip route-cache
 shutdown
 serial restart-delay 0
!
interface FastEthernet2/0
 no ip address
 no ip route-cache
 shutdown
 duplex half
!
ip default-gateway 10.10.10.1
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!        
!
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

R2配置

Router#sh run
Building configuration...

Current configuration : 931 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!        
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 duplex half
!        
interface Serial1/0
 ip address 10.10.10.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/1
 no ip address
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface FastEthernet2/0
 no ip address
 shutdown
 duplex half
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

ASA配置

ciscoasa(config)# SH RUN
: Saved
:
ASA Version 8.0(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/1
 nameif outside
 security-level 0
 ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/3
 shutdown    
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list outside extended permit ip any any
access-list ipsec*** extended permit ip host 10.10.10.2 host 172.16.1.2
pager lines 24
mtu inside 1500
mtu outside 1500
no failover  
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.2 1
route inside 10.10.10.0 255.255.255.0 192.168.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto map l2l 1 match address ipsec***
crypto map l2l 1 set peer 2.2.2.2
crypto map l2l 1 set transform-set myset
crypto map l2l interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
 pre-shared-key *
prompt hostname context
Cryptochecksum:78976a09a67137166096e2849ae0b218
: end

 R3配置

Router#sh run
Building configuration...

Current configuration : 921 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!        
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 1.1.1.2 255.255.255.0
 duplex half
!        
interface Serial1/0
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/1
 ip address 2.2.2.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface FastEthernet2/0
 no ip address
 shutdown
 duplex half
!
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
 shutdown
!
!        
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

R4配置

Router#sh run
Building configuration...

Current configuration : 1463 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!        
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco address 1.1.1.1
!
!        
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map mymap 1 ipsec-isakmp
 set peer 1.1.1.1
 set transform-set myset
 match address 100
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex half
!
interface Serial1/0
 ip address 2.2.2.2 255.255.255.0
 serial restart-delay 0
 crypto map mymap
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 ip address 172.16.1.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface FastEthernet2/0
 no ip address
 shutdown
 duplex half
!
ip route 0.0.0.0 0.0.0.0 2.2.2.1
no ip http server
no ip http secure-server
!
!
ip nat pool cisco 2.2.2.10 2.2.2.20 netmask 255.255.255.0
ip nat inside source list 10 pool cisco overload
!
logging alarm informational
access-list 10 permit 172.16.1.0 0.0.0.255
access-list 100 permit ip host 172.16.1.2 host 10.10.10.2
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end

 

R5配置

Router#sh run
Building configuration...

Current configuration : 1076 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip routing
no ip cef
!
!
!
!
!
multilink bundle-name authenticated
!        
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 no ip route-cache
 shutdown
 duplex half
!
interface Serial1/0
 no ip address
 no ip route-cache
 shutdown
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 no ip route-cache
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 no ip route-cache
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 ip address 172.16.1.2 255.255.255.0
 no ip route-cache
 serial restart-delay 0
!
interface FastEthernet2/0
 no ip address
 no ip route-cache
 shutdown
 duplex half
!
ip default-gateway 172.16.1.1
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!        
!        
!        
!        
!        
!        
gatekeeper
 shutdown
!
!
line con 0
 stopbits 1
line aux 0
line vty 0 4
!
!
end