ASA配置VPN

VPN

拨号用户

username username password S3DyQpSmL

YSiQHIi encrypted privilege 0

username username attributes

vpn-group-policy DfltGrpPolicy

vpn-idle-timeout 10

vpn- filter none

vpn-tunnel-protocol IPSec

password-storage disable

group-lock value manager

8

、由于本地防火墙后面接有一个三层交换机，故还需要在三层交换机上添加路由，把

VPN

上使用的

IP Address Poo l

指向防火墙的

inside

口

ip route 100.100.100.0 255.255.255.224 133.x.x.x

9

、 采用

Cisco

的

VPN

拨号软件

VPN Client 5.0

，拨号成功 后，可以在统计信息中看到

VPN

的使用情况

< br>

10

、如果需要禁止对防火墙

Internet

端口的

ping

，可 以使用下面的命令：

icmp deny any Internet

附：

show run

ASA Version 7.2(3)

!

domain-name d

names

!

interface GigabitEthernet0/0

nameif outside

security-level 0

ip address 172.x.x.x

ospf cost 10

!

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 133.x.x.x

ospf cost 10

!

interface GigabitEthernet0/2

nameif Internet

security- level 0

ip address 61.x.x.x

ospf cost 10

!

interface Management0/0

nameif management

security- level 100

ip address 192.168.1.1 255.255.255.0

ospf cost 10

management-only

!

ftp mode passive

dns server- group DefaultDNS

domain-name d

access-list

inside_nat0_outbound

extended

permit

ip

100.100.100.0

255.255.255.0

133.x.x.x

255.255.255.0

access-list split-ssl extended permit ip 133.x.x.x 255.255.255.0 100.100.100.0 255.255.255.224

pager lines 24

logging enable

logging timestamp

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu Internet 1500

mtu management 1500

mtu outbackup 1500

mtu inbackup 1500

ip local pool vpn_pool_100 100.100.100.1-100.100.100.20 mask 255.255.255.224

no failover

icmp unreachable rate-limit 1 burst- size 1

icmp deny any Internet

asdm image disk0:/

no asdm history enable

arp timeout 14400

nat (inside) 0 access- list inside_nat0_outbound

access-group acl-out in interface outside

access- group acl-in in interface inside

route Internet 0.0.0.0 0.0.0.0 61.x.x.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

http server enable

http 192.168.1.0 255.255.255.0 management

http 133.x.x.x 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set myset esp-aes-256 esp-sha-hmac

crypto dynamic-map dymap 1 set transform-set myset

crypto dynamic-map dymap 1 set reverse-route

crypto map mymap 1 ipsec-isakmp dynamic dymap

crypto map mymap interface Internet

crypto isakmp enable Internet

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp nat-traversal 20

telnet 133.x.x.x 255.255.255.255 inside

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

!

class-map inspection_default

match default- inspection-traffic

class-map outside- class

match access-list outside_mpc

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect icmp

policy-map outside-policy

class outside-class

inspect pptp

!

service- policy global_policy global

service- policy outside-policy interface outside

group-policy DfltGrpPolicy attributes

banner none

wins-server none

dns-server none

dhcp- network-scope none

vpn-access-hours none

vpn-simultaneous-logins 3

vpn-idle-timeout 10

vpn- session-timeout none

vpn-filter value inside_nat0_outbound

vpn-tunnel- protocol IPSec

password- storage disable

ip-comp disable

re-xauth disable

group-lock none

pfs disable

ipsec-udp disable

ipsec-udp-port 10000

split- tunnel-policy tunnelspecified

split- tunnel-network-list value split-ssl

default-domain none

split- dns none

intercept-dhcp 255.255.255.255 disable

secure-unit-authentication disable

user-authentication disable

user-authentication-idle-timeout 30

ip-phone-bypass disable

leap-bypass disable

nem disable

backup-servers keep-client- config

msie-proxy server none

msie-proxy method no-modify

msie-proxy except-list none

msie-proxy local-bypass disable

nac disable

nac-sq-period 300

nac-reval-period 36000

nac-default-acl none

address-pools none

smartcard-removal-disconnect enable

client-firewall none

client- access-rule none

webvpn

functions url-entry

html- content-filter none

homepage none

keep-alive-ignore 4

http- comp gzip

filter none

url- list none

customization value DfltCustomization

port-forward none

port-forward-name value Application Access

sso-server none

deny- message value Login was successful, but because certain criteria have not been met or due to

some specific group policy, you do not have permission to use any of the VPN features. Contact

your IT administrator for more information

svc none

svc keep-installer installed

svc keepalive none

svc rekey time none

svc rekey method none

svc dpd-interval client none

svc dpd-interval gateway none

svc compression deflate

username xxxxx password S3DyQpSmL

YSiQHIi encrypted privilege 0

username xxxxx attributes

vpn-group-policy DfltGrpPolicy

vpn-idle-timeout 10

vpn- filter none

vpn-tunnel-protocol IPSec

password-storage disable

group-lock value manager

tunnel-group manager type ipsec-ra

tunnel-group manager general-attributes

address-pool vpn_pool_100

authorization-required

tunnel-group manager ipsec-attributes

pre-shared-key *

prompt hostname context

Cryptochec ksum:c9c8eefb4a85737d156f8b7a5fc7e4fa

: end

回答者：

286531920

|

一级

| 2009-4-15 15:44

一、网络拓扑

|172.x.x.x

|outside

|========|=========|

| |-----Internet 61.x.x.x

|========|=========|

|inside

|133.x.x.x

防火墙分别配置三个端口，端口名称和

IP

地址 分配如上。

VPN Client

的

IP Address Pool

为

100.100.100.0 255.255.255.0

。

二、配置过程

1

、建立动态

map

crypto ipsec transform-set myset esp-aes-256 esp-sha-hmac

crypto dynamic-map dymap 1 set transform-set myset

crypto dynamic-map dymap 1 set reverse-route

crypto map mymap 1 ipsec-isakmp dynamic dymap

crypto map mymap interface Internet

crypto isakmp enable Internet