实验拓朴图
实验目的:总部ASA5520与分支机构CISCO2911建立起IPSEC ×××,实现10.10.10.0/24与172.16.1.0/24两个子网的互访。即PC1与PC2能够互相PING通。
实验环境搭建工具:使用的工具有dynmips工大瑞普CCNP版 、 vmware+ASA镜像。除ASA外,其它设备全由dynmips路由器模拟。包括PC1,PC2,ASA与dynmips的连接采用虚拟网卡的桥接。
使的拓朴为:控制台 ×××.cmd
下面为各个设备键入的配置:
R1
R1模拟的是一台PC,因此只需给他配置一个IP,指定一个网关就可以了。
interface Serial1/1
ip address 10.10.10.2 255.255.255.0
no sh
exit
no ip routing //关闭路由
ip default-gateway 10.10.10.1 //网关指定为10.10.10.1
R2
R2模拟的是一台3560三层交换机,如果是真实的设备,肯定还要配VLAN等其它的配置,现在就省略了。我现在只要它能通。
只需配置接口IP,与默认路由
interface FastEthernet0/0
ip address 192.168.1.2 255.255.255.0
no sh
interface Serial1/0
ip address 10.10.10.1 255.255.255.0
no sh
ip route 0.0.0.0 0.0.0.0 192.168.1.1 //下一跳指向防火墙inside口
ASA
ASA需要配置IP,划分区域,设置权限,路由,设置IPSEC×××
interface Ethernet0/0
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
access-list outside extended permit ip any any
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.2 1
route inside 10.10.10.0 255.255.255.0 192.168.1.2 1
access-list ipsec*** extended permit ip host 10.10.10.2 host 172.16.1.2
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key cisco
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto map l2l 1 match address ipsec***
crypto map l2l 1 set peer 2.2.2.2
crypto map l2l 1 set transform-set myset
crypto map l2l interface outside
crypto isakmp enable outside
R3
R3模拟了ISP的路由器,只需要配置接口IP就行了。
interface FastEthernet0/0
ip address 1.1.1.2 255.255.255.0
no sh
interface Serial1/1
ip address 2.2.2.1 255.255.255.0
no sh
R4
R4作为分支机构边界路由器,需要配置IP,默认路由,IPSEC×××
interface Serial1/0
ip address 2.2.2.2 255.255.255.0
crypto map mymap
no sh
interface Serial1/2
ip address 172.16.1.1 255.255.255.0
no sh
ip route 0.0.0.0 0.0.0.0 2.2.2.1
access-list 100 permit ip host 172.16.1.2 host 10.10.10.2
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 1.1.1.1
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map mymap 1 ipsec-isakmp
set peer 1.1.1.1
set transform-set myset
match address 100
R5
R5是模拟的一台PC,和R1是一样的,只需配置IP和指定网关。
interface Serial1/3
ip address 172.16.1.2 255.255.255.0
no sh
exit
no ip routing
ip default-gateway 172.16.1.1
到现在配置完成了。。
IPSEC成功建立,但是遇到一个问题,如果配置了NAT,则IPSEC SA关系则建立不了,R1与R5也是PING不通的,
我搜索了很多解决办法,没有一个完善的,后来终于想明白了,现在就分享给大家吧。。
解决办法:去往ipsec ***目的的流量不经过NAT,其它流量才经过NAT,是不是太简单了吧!!!!!!!!!!
ASA配置:
access-list ipsec*** permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
nat (inside) 0 access-list ipsec***
nat (inside) 1 0 0
global (outside) 1 interface
路由器配置
ip access-list extended nat
deny ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 172.16.1.0 0.0.0.255 any
ip nat pool natpool 2.2.2.10 2.2.2.10 netmask 255.255.255.0
ip nat inside source list nat pool natpool overload
interface Serial1/0
ip nat outside
interface Serial1/2
ip nat inside
搞定了哈,很开心。。
以下的配置文件不包括NAT配置
R1 配置
Router#sh run
Building configuration...
Current configuration : 1076 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip routing
no ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
no ip route-cache
shutdown
duplex half
!
interface Serial1/0
no ip address
no ip route-cache
shutdown
serial restart-delay 0
!
interface Serial1/1
ip address 10.10.10.2 255.255.255.0
no ip route-cache
serial restart-delay 0
!
interface Serial1/2
no ip address
no ip route-cache
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
no ip route-cache
shutdown
serial restart-delay 0
!
interface FastEthernet2/0
no ip address
no ip route-cache
shutdown
duplex half
!
ip default-gateway 10.10.10.1
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
R2配置
Router#sh run
Building configuration...
Current configuration : 931 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 192.168.1.2 255.255.255.0
duplex half
!
interface Serial1/0
ip address 10.10.10.1 255.255.255.0
serial restart-delay 0
!
interface Serial1/1
no ip address
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet2/0
no ip address
shutdown
duplex half
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
ASA配置
ciscoasa(config)# SH RUN
: Saved
:
ASA Version 8.0(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/5
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list outside extended permit ip any any
access-list ipsec*** extended permit ip host 10.10.10.2 host 172.16.1.2
pager lines 24
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.2 1
route inside 10.10.10.0 255.255.255.0 192.168.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto map l2l 1 match address ipsec***
crypto map l2l 1 set peer 2.2.2.2
crypto map l2l 1 set transform-set myset
crypto map l2l interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:78976a09a67137166096e2849ae0b218
: end
R3配置
Router#sh run
Building configuration...
Current configuration : 921 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 1.1.1.2 255.255.255.0
duplex half
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/1
ip address 2.2.2.1 255.255.255.0
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet2/0
no ip address
shutdown
duplex half
!
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
R4配置
Router#sh run
Building configuration...
Current configuration : 1463 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 1.1.1.1
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map mymap 1 ipsec-isakmp
set peer 1.1.1.1
set transform-set myset
match address 100
!
!
!
!
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface Serial1/0
ip address 2.2.2.2 255.255.255.0
serial restart-delay 0
crypto map mymap
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
ip address 172.16.1.1 255.255.255.0
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet2/0
no ip address
shutdown
duplex half
!
ip route 0.0.0.0 0.0.0.0 2.2.2.1
no ip http server
no ip http secure-server
!
!
ip nat pool cisco 2.2.2.10 2.2.2.20 netmask 255.255.255.0
ip nat inside source list 10 pool cisco overload
!
logging alarm informational
access-list 10 permit 172.16.1.0 0.0.0.255
access-list 100 permit ip host 172.16.1.2 host 10.10.10.2
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
R5配置
Router#sh run
Building configuration...
Current configuration : 1076 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip routing
no ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
no ip route-cache
shutdown
duplex half
!
interface Serial1/0
no ip address
no ip route-cache
shutdown
serial restart-delay 0
!
interface Serial1/1
no ip address
no ip route-cache
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
no ip route-cache
shutdown
serial restart-delay 0
!
interface Serial1/3
ip address 172.16.1.2 255.255.255.0
no ip route-cache
serial restart-delay 0
!
interface FastEthernet2/0
no ip address
no ip route-cache
shutdown
duplex half
!
ip default-gateway 172.16.1.1
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
转载于:https://blog.51cto.com/windows1009/698552