FreeBSD —- CISCO ASA 5540 (IPsec VPN 隧道模式) CISCO ASA 5540配置 1、 端口配置 IP 地址 ciscoasa(config)# interface GigabitEthernet0/0 ciscoasa(config-if)# nameif outside ciscoasa(config-if)# security-level 0 ciscoasa(config-if)# ip addre
FreeBSD —- CISCO ASA 5540 (IPsec VPN 隧道模式)
CISCO ASA 5540配置
1、端口配置IP地址
ciscoasa(config)# interface GigabitEthernet0/0
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# ip address 61.49.29.x 255.255.255.x
ciscoasa(config-if)# q
ciscoasa(config)# interface GigabitEthernet0/1
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 10.1.32.5 255.255.255.0
ciscoasa(config-if)# q
2、添加路由
ciscoasa(config)# route outside 0.0.0.0 0.0.0.0 61.49.29.x
ciscoasa(config)# route inside 10.1.10.0 255.255.255.0 10.1.5.1
ciscoasa(config)# route inside 10.1.254.101 255.255.255.255 10.1.32.1
ciscoasa(config)# route inside 172.16.31.0 255.255.255.0 10.1.5.1
3、配置IKE
ciscoasa(config)# crypto isakmp identity auto
ciscoasa(config)# crypto isakmp enable outside
ciscoasa(config)# crypto isakmp policy 10
ciscoasa(config-isakmp-policy)# authentication pre-share
ciscoasa(config-isakmp-policy)# encryption 3des
ciscoasa(config-isakmp-policy)# hash sha
ciscoasa(config-isakmp-policy)# group 2
ciscoasa(config-isakmp-policy)# lifetime 86400
ciscoasa(config-isakmp-policy)# q
ciscoasa(config)# crypto isakmp nat-traversal 20
4、配置Keys
ciscoasa(config)# crypto isakmp key Umessage-vpn address 60.247.57.x
5、配置IPSec
ciscoasa(config)# crypto ipsec transform-set xVPN esp-3des esp-sha-hmac
ciscoasa(config)# crypto ipsec security-association lifetime seconds 28800
ciscoasa(config)# crypto ipsec security-association lifetime kilobytes 4608000
ciscoasa(config)# crypto ipsec security-association replay window-size 64
ciscoasa(config)# crypto ipsec fragmentation before-encryption outside
ciscoasa(config)# crypto ipsec fragmentation before-encryption inside
ciscoas
本文来源gao!%daima.com搞$代*!码9网(
a(config)# crypto ipsec df-bit copy-df outside
ciscoasa(config)# crypto ipsec df-bit copy-df inside
6、配置访问控制列表
ciscoasa(config)# object-group network local-lan
ciscoasa(config-network)# network-object host 10.1.5.0
ciscoasa(config-network)# q
ciscoasa(config)# object-group network remote-lan
ciscoasa(config-network)# network-object host 192.168.190.20
ciscoasa(config-network)# q
ciscoasa(config)# access-list vpnacl extended permit ip object-group local-lan object-group remote-lan
7、配置IPSec加密映射
ciscoasa(config)# crypto map vpnmap 10 match address vpnacl
ciscoasa(config)# crypto map vpnmap 10 set pfs group2
ciscoasa(config)# crypto map vpnmap 10 set connection-type bi-directional
ciscoasa(config)# crypto map vpnmap 10 set peer 60.247.57.x
ciscoasa(config)# crypto map vpnmap 10 set transform-set xVPN
ciscoasa(config)# crypto map vpnmap 10 set inheritance rule
ciscoasa(config)# crypto map vpnmap 10 set phase1-mode main
ciscoasa(config)# crypto map vpnmap interface outside
seven
转载请注明原文链接：IPsec VPN （下）
