ASA防火墙上配置IPSEC-VPN和SSL-VPN

ASA防火墙上配置IPSECVPN和SSLVPN

一:实验拓扑:

二:实验要求:

1:PC1属于上海分公司内网主机,PC2属于总公司主机.要求上海分公司的用户直接可以喝总公司的PC2通信.(Site-to-SiteIPSECVPN实现)

2:公网上用户可以访问总公司的OA服务器PC2.(SSLVPN实现)

三:配置过程:

1:基本配置:

ASA1(config)#inte0/1

ASA1(config-if)#nameifinside

INFO:Securitylevelfor"inside"setto100bydefault.

ASA1(config-if)#ipadd172.16.1.254255.255.255.0

ASA1(config-if)#nosh

ASA1(config-if)#inte0/0

ASA1(config-if)#nameifoutside

INFO:Securitylevelfor"outside"setto0bydefault.

ASA1(config-if)#ipadd12.0.0.1255.255.255.0

ASA1(config-if)#nosh

ASA1(config-if)#

ASA1#ping172.16.1.1

Typeescapesequencetoabort.

Sending5,100-byteICMPEchosto172.16.1.1,timeoutis2seconds:

!!!!!

Successrateis100percent(5/5),round-tripmin/avg/max=10/344/1670ms

R1(config)#intf0/0

R1(config-if)#ipadd12.0.0.2255.255.255.0

R1(config-if)#nosh

R1(config-if)#intf1/0

R1(config-if)#ipadd23.0.0.2255.255.255.0

R1(config-if)#nosh

R1(config-if)#intf2/0

R1(config-if)#ipadd1.1.1.254255.255.255.0

R1(config-if)#noshASA2(config)#inte0/0

ASA2(config-if)#nameifoutside

INFO:Securitylevelfor"outside"setto0bydefault.

ASA2(config-if)#ipadd23.0.0.3255.255.255.0

ASA2(config-if)#nosh

ASA2(config-if)#inte0/1

ASA2(config-if)#nameifinside

INFO:Securitylevelfor"inside"setto100bydefault.

ASA2(config-if)#ipadd192.168.1.254255.255.255.0

ASA2(config-if)#nosh配置路由,NAT,ACLASA1(config)#routeoutside0012.0.0.2

ASA1(config)#nat-control

ASA1(config)#nat(inside)100

ASA1(config)#global(outside)1interface

INFO:outsideinterfaceaddressaddedtoPATpool

ASA1(config)#access-listhahapermiticmpanyany

ASA1(config)#access-grouphahaininterfaceoutside

ASA2(config)#routeoutside0023.0.0.2

ASA2(config)#nat-con

ASA2(config)#nat-control

ASA2(config)#nat(inside)100

ASA2(config)#global(outside)1interface

INFO:outsideinterfaceaddressaddedtoPATpool

ASA2(config)#access-listhahapermiticmpanyany

ASA2(config)#access-grouphahaininterfaceoutside私网上公网没问题,但两个私网无法互通

2:配置Site-to-SiteVPN

ASA1(config)#access-listno-natpermitip172.16.1.0255.255.255.0192.168.1.0255.255.255.0

ASA1(config)#nat(inside)0access-listno-nat

ASA2(config)#access-listno-natpermitip192.168.1.0255.255.255.0172.16.1.0255.255.255.0

ASA2(config)#nat(inside)1access-listno-natASA1(config)#cryptoisakmpenableoutside

ASA1(config-isakmp-policy)#authenticationpre-share

ASA1(config-isakmp-policy)#encryptiondes

ASA1(config-isakmp-policy)#hashmd5

ASA1(config-isakmp-policy)#group2

ASA1(config-isakmp-policy)#exit

ASA1(config)#isakmpkeyciscoaddress23.0.0.3

ASA1(config)#cryptoipsectransform-setmytransesp-desesp-md

ASA1(config)#cryptoipsectransform-setmytransesp-desesp-md5-hmac

ASA1(config)#cryptomapmymap10setpeer23.0.0.3

ASA1(config)#cryptomapmymap10settransform-setmytrans

ASA1(config)#cryptomapmymap10matchaddressno-nat

ASA1(config)#cryptomapmymapinterfaceoutside

ASA2(config)#cryptoisakmpenableoutside

ASA2(config-isakmp-policy)#authenticationpre-share

ASA2(config-isakmp-policy)#encryptiondes

ASA2(config-isakmp-policy)#hashmd5

ASA2(config-isakmp-policy)#group2

ASA2(config-isakmp-policy)#exit

ASA2(config)#isakmpkeyciscoaddress12.0.0.1

ASA2(config)#cryptoipsectransform-setmytransesp-desesp-md

ASA2(config)#cryptoipsectransform-setmytransesp-desesp-md5-hmac

ASA2(config)#cryptomapmymap10setpeer12.0.0.1

ASA2(config)#cryptomapmymap10settransform-setmytrans

ASA2(config)#cryptomapmymap10matchaddressno-nat

ASA2(config)#cryptomapmymapinterfaceoutsideSite-to-SiteIPSEC配置完成.ASA2(config)#webvpn

ASA2(config-webvpn)#enableoutside

INFO:WebVPNandDTLSareenabledon'outside'.

ASA2(config-webvpn)#svcimagedisk0:/sslclient-win-1.1.3.173.pkg

ASA2(config-webvpn)#svcenable

ASA2(config-webvpn)#exitASA2(config)#usernameciscopasswordcisco

ASA2(config)#iplocalpoolvpn192.168.100.1-192.168.100.200

ASA2(config)#access-list100permitip192.168.1.0255.255.255.0anyASA2(config)#group-policymy10internal

ASA2(config)#group-policymy10attributes

ASA2(config-group-policy)#vpn-tunnel-protocolwebvpnsvc

ASA2(config-group-policy)#split-tunnel-policytunnelspecified

ASA2(config-group-policy)#split-tunnel-network-listvalue100

ASA2(config-group-policy)#webvpn

ASA2(config-group-webvpn)#svcaskenable

ASA2(config-group-webvpn)#exit

ASA2(config-group-policy)#exitASA2(config)#tunnel-groupjishutypewebvpn

ASA2(config)#tunnel-groupjishugeneral-attributes

ASA2(config-tunnel-general)#address-poolvpn

ASA2(config-tunnel-general)#default-group-policymy10

ASA2(config-tunnel-general)#webvpn

ASA2(config-webvpn)#tunnel-group-l