CISCO IPSEC对接AZURE云实例记录(点到点-静态)

本地环境：
CISCO ASA5525

Cisco Adaptive Security Appliance Software Version 9.7(1)4 
Firepower Extensible Operating System Version 2.1(1.66)
Device Manager Version 7.7(1)151
Hardware:   ASA5525, 8192 MB RAM, CPU Lynnfield 2394 MHz, 1 CPU (4 cores)
            ASA: 4192 MB RAM, 1 CPU (1 core)

对端环境AZURE云

配置代码

crypto ikev1 enable outside //打开ikev1并应用在outsdie接口

    object-group network ***-pat
 network-object 192.160.51.0 255.255.255.0
 network-object 192.160.99.0 255.255.255.0      //定义本地子网
object-group network ***-azure-local
 network-object 192.168.0.0 255.255.0.0            //定义对端子网

 access-list ***-acl extended permit ip object-group ***-pat object-group ***-azure-local  //匹配感兴趣流量

 nat (inside,outside) 1 source static ***-pat ***-pat destination static ***-azure-local ***-azure-local
 //创建NAT 转换列表

 crypto ikev1 policy 5
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 28800
//配置ikev1

crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac 
crypto ipsec security-association lifetime seconds 3600
crypto ipsec security-association lifetime kilobytes 102400000
crypto ipsec security-association pmtu-aging infinite
//创建加密集合

tunnel-group azure-ip type ipsec-l2l
tunnel-group azure-ip ipsec-attributes
 ikev1 pre-shared-key *****
 //隧道配置  注：azure-ip=对端ip地址，配置时要替换

crypto map mymap 1 match address ***-acl
crypto map mymap 1 set peer azure-ip
crypto map mymap 1 set ikev1 transform-set myset
crypto map mymap interface outside
//创建加密映射

转载于:https://blog.51cto.com/11367366/2055957