Cisco ASA 5500 系列版本 7.x 运行类似 PIX 版本 7.x 的软件版本。本文档中的配置适用于这两个产品系列。
在 PIX 上，access-list 和 nat 0 命令协同工作。当 10.1.1.0 网络上的用户访问 10.2.1.0 网络时，将使用访问列表允许 10.1.1.0 网络数据流在没有 NAT 的情况下进行加密。在路由器上，将使用 access-list 命令允许 10.2.1.0 网络数据流在没有 NAT 的情况下进行加密。然而，当同样用户去别处(类似互联网)时，他们翻译对外部接口IP地址通过端口地址转换(PAT)。
要使通过隧道的数据流不经过 PAT，而使到达 Internet 的数据流经过 PAT，则必须在 PIX 安全设备上使用以下配置命令。
access-list nonat permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
nat (inside) 0 access-list nonat
nat (inside) 1 10.1.1.0 255.255.255.0 0 0
pix 7.0以上版本
- pixfirewall#show running-config
- PIX Version 7.2(2)
- !
- hostname pixfirewall
- enable password 8Ry2YjIyt7RRXU24 encrypted
- names
- !
- !--- The interface dynamically learns its IP address
- !--- from the service provider.
- interface Ethernet0
- nameif outside
- security-level 0
- ip address dhcp
- !
- interface Ethernet1
- nameif inside
- security-level 100
- ip address 10.1.1.2 255.255.255.0
- !
- !
- !-- Output is suppressed.
- !
- passwd 2KFQnbNIdI.2KYOU encrypted
- ftp mode passive
- !--- This is the access list (IPsec-traffic) used for the VPN interesting traffic
- !--- to be encrypted.
- access-list IPSec-traffic extended permit ip 10.1.1.0 255.255.255.0 10.2.1.0 255.255.255.0
- !--- This access list (nonat) is used for a nat zero command that prevents
- !--- traffic which matches the access list from undergoing NAT.
- access-list NO-NAT extended permit ip 10.1.1.0 255.255.255.0 10.2.1.0 255.255.255.0
- pager lines 24
- mtu inside 1500
- mtu outside 1500
- no failover
- icmp unreachable rate-limit 1 burst-size 1
- no asdm history enable
- arp timeout 14400
-
- !--- NAT 0 prevents NAT for networks specified in the ACL - nonat.
- !--- The nat 1 command specifies PAT using the
- !--- outside interface for all other traffic.
- global (outside) 1 interface
- nat (inside) 0 access-list NO-NAT
- nat (inside) 1 0.0.0.0 0.0.0.0
- route outside 0.0.0.0 0.0.0.0 172.16.1.2 1
- timeout xlate 3:00:00
- timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
- timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
- timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
- timeout uauth 0:05:00 absolute
- no snmp-server location
- no snmp-server contact
- snmp-server enable traps snmp authentication linkup linkdown coldstart
- !--- PHASE 2 CONFIGURATION ---!
- !--- The encryption types for Phase 2 are defined here.
- !--- A triple single DES encryption with
- !--- the md5 hash algorithm is used.
- crypto ipsec transform-set DYN-TS esp-des esp-md5-hmac
- !--- Define which traffic should be sent to the IPsec peer.
- crypto map IPSEC 10 match address IPSec-traffic
- !--- Sets the IPsec peer.
- crypto map IPSEC 10 set peer 192.168.1.2
- !--- Sets the IPsec transform set "DYN-TS"
- !--- to be used with the crypto map entry "IPSEC".
- crypto map IPSEC 10 set transform-set DYN-TS
- !--- Specifies the interface to be used with
- !--- the settings defined in this configuration.
- crypto map IPSEC interface outside
- !--- Enables IPsec on the outside interface.
- crypto isakmp enable outside
- !--- PHASE 1 CONFIGURATION ---!
- !--- This configuration uses isakmp policy 10.
- !--- Policy 65535 is included in the configuration by default.
- !--- The configuration commands here define the Phase
- !--- 1 policy parameters that are used.
- crypto isakmp policy 10
- authentication pre-share
- encryption des
- hash md5
- group 1
- lifetime 86400
- crypto isakmp policy 65535
- authentication pre-share
- encryption 3des
- hash sha
- group 2
- lifetime 86400
- !--- In order to create and manage the database of connection-specific records
- !--- for IPsec-L2L—IPsec tunnels, use the tunnel-group
- !--- command in global configuration mode.
- !--- For L2L connections the name of the tunnel group MUST be the IP
- !--- address of the IPsec peer.
- tunnel-group 192.168.1.2 type ipsec-l2l
- !--- Enter the pre-shared-key in IPsec-attribute parameters
- !--- in order to configure the authentication method.
- tunnel-group 192.168.1.2 ipsec-attributes
- pre-shared-key *
- telnet timeout 5
- ssh timeout 5
- console timeout 0
- !
- class-map inspection_default
- match default-inspection-traffic
- !
- !
- policy-map type inspect dns preset_dns_map
- parameters
- message-length maximum 512
- policy-map global_policy
- class inspection_default
- inspect dns preset_dns_map
- inspect ftp
- inspect h323 h225
- inspect h323 ras
- inspect netbios
- inspect rsh
- inspect rtsp
- inspect skinny
- inspect esmtp
- inspect sqlnet
- inspect sunrpc
- inspect tftp
- inspect sip
- inspect xdmcp
- !
- service-policy global_policy global
- prompt hostname context
- Cryptochecksum:d609c9eaf51c154f147b3b4ba3c834e0
- : end
- pixfirewall#
- Router#show running-config
- Current configuration : 1354 bytes
- !
- version 12.4
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- !
- hostname Router
- !
- boot-start-marker
- boot-end-marker
- !
- !
- no aaa new-model
- !
- resource policy
- !
- !
- !
- ip cef
- !
- !--- Configuration for IKE policies.
- !--- Enables the IKE policy configuration (config-isakmp)
- !--- command mode, where you can specify the parameters that
- !--- are used during an IKE negotiation.
- crypto isakmp policy 10
- hash md5
- authentication pre-share
- !--- Specifies the preshared key "cisco123" which should
- !--- be identical at both peers. This is a global
- !--- configuration mode command. It accepts any peer which matches
- !--- the pre-shared key.
- crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
- !
- !--- Configuration for IPsec policies.
- !--- Enables the crypto transform configuration mode,
- !--- where you can specify the transform sets that are used
- !--- during an IPsec negotiation.
- crypto ipsec transform-set DYN-TS esp-des esp-md5-hmac
- !--- IPsec policy, Phase 2.
- crypto dynamic-map DYN 10
- !--- Configures IPsec to use the transform-set
- !--- "DYN-TS" defined earlier in this configuration.
- set transform-set DYN-TS
- crypto map IPSEC 10 ipsec-isakmp dynamic DYN
- !
- interface Ethernet0/0
- ip address 192.168.1.2 255.255.255.0
- ip nat outside
- ip virtual-reassembly
- half-duplex
- !--- Configures the interface to use the
- !--- crypto map "IPSEC" for IPsec.
- crypto map IPSEC
- !
- interface FastEthernet1/0
- ip address 10.2.1.1 255.255.255.0
- ip nat inside
- ip virtual-reassembly
- duplex auto
- speed auto
- !
- interface Serial2/0
- no ip address
- shutdown
- no fair-queue
- !
- interface Serial2/1
- no ip address
- shutdown
- !
- interface Serial2/2
- no ip address
- shutdown
- !
- interface Serial2/3
- no ip address
- shutdown
- !
- ip http server
- no ip http secure-server
- !
- ip route 0.0.0.0 0.0.0.0 192.168.1.1
- !
- ip nat inside source list 100 interface Ethernet0/0 overload
- !
- !--- This ACL 100 identifies the traffic flows and be PATed
- !--- via the outside interface( Ethernet0/0).
- access-list 100 deny ip 10.2.1.0 0.0.0.255 10.1.1.0 0.0.0.255
- access-list 100 permit ip 10.2.1.0 0.0.0.255 any
- control-plane
- !
- !
- line con 0
- line aux 0
- line vty 0 4
- !
- !
- end
- 清除安全关联 (SA)
- 在 PIX 的特权模式下使用以下这些命令：
- clear [crypto] ipsec sa - 删除活动 IPsec SA。关键字 crypto 是可选的。
- clear [crypto] isakmp sa - 删除活动 IKE SA。关键字 crypto 是可选的。
- show crypto isakmp sa
- show crypto ipsec sa
- PIX 安全设备 - debug 输出
- debug crypto ipsec 7 - 显示第 2 阶段的 IPsec 协商。
- debug crypto isakmp 7 - 显示第 1 阶段的 ISAKMP 协商。
- 远程 IOS 路由器 - debug 输出
- debug crypto ipsec - 显示第 2 阶段的 IPsec 协商。
- debug crypto isakmp - 显示第 1 阶段的 ISAKMP 协商。