ASA配置
默认路由一条
ciscoasa(config)# route outside 0 0 192.168.1.1
允许其他人ping
ciscoasa(config)# access-list 100 extended permit icmp any any
ciscoasa(config)# access-group 100 in interface outside
配置管理连接策略
ciscoasa(config)# crypto isakmp enable outside
ciscoasa(config)# crypto isakmp policy 1
ciscoasa(config-isakmp-policy)# encryption 3des
ciscoasa(config-isakmp-policy)# hash md5
ciscoasa(config-isakmp-policy)# authentication pre-share
ciscoasa(config-isakmp-policy)# group 2
配置预共享密钥
ciscoasa(config)# tunnel-group 200.0.0.1 type ipsec-l2l
ciscoasa(config)# tunnel-group 200.0.0.1 ipsec-attributes
ciscoasa(config-tunnel-ipsec)# pre-shared-key vpn
配置加密流量
ciscoasa(config)#access-list vpn extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
交换数据连接的传输集
ciscoasa(config)# crypto ipsec transform-set vpn-set esp-aes esp-sha-hmac
配置crypto map
ciscoasa(config)# crypto map vpn-map 1 match address vpn
ciscoasa(config)# crypto map vpn-map 1 set peer 200.0.0.1
ciscoasa(config)# crypto map vpn-map 1 set transform-set vpn-set
将crypto map应用到接口
ciscoasa(config)# crypto map vpn-map interface outside
启用nat穿越
ciscoasa(config)# crypto isakmp nat-traversal
R1配置
路由表设置
R1(config)#ip route 192.168.2.0 255.255.255.0 192.168.1.2
R1(config)#ip route 0.0.0.0 0.0.0.0 100.0.0.2
正常PAT转换
R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)#access-list 1 permit 192.168.2.0 0.0.0.255
R1(config)#ip nat inside source list 1 interface ethernet 0/1 overload
IPSec VPN发布转换
R1(config)#ip nat inside source static udp 192.168.1.2 500 100.0.0.1 500 extendable
R1(config)#ip nat inside source static udp 192.168.1.2 4500 100.0.0.1 4500 extendable
R1(config)#interface ethernet 0/0
R1(config-if)#ip nat inside
R1(config)#interface ethernet 0/1
R1(config-if)#ip nat outside
R3配置
配置路由表
R3(config)#ip route 0.0.0.0 0.0.0.0 200.0.0.2
管理连接配置
R3(config)#crypto isakmp policy 1
R3(config-isakmp)#encryption 3des
R3(config-isakmp)#hash md5
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#group 2
预共享密钥配置
R3(config)#crypto isakmp key 0 vpn address 100.0.0.1
数据交换传输集配置
R3(config)#crypto ipsec transform-set vpn-set esp-aes esp-sha-hmac
配置加密流量列表
R3(config)#access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
配置Crypt map
R3(config)#crypto map vpn-map 1 ipsec-isakmp
R3(config-crypto-map)#set peer 100.0.0.1
R3(config-crypto-map)#set transform-set vpn-set
R3(config-crypto-map)#match address 100
将映射应用在接口
R3(config)#interface ethernet 0/0
R3(config-if)#crypto map vpn-map
验证结果
nat端口转换成功
管理连接建立成功
数据连接有流量通过
