PIX/ASA 8.x与IOS路由器静态到静态IPSec配置示例

网络图

本文档使用以下网络设置：
ASA 8.2版本

ASA# show run
: Saved
ASA Version 8.2
!
hostname ASA
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
!--- Configure the outside interface.
!
interface Ethernet0/1
nameif outside
security-level 0
ip address 172.16.1.1 255.255.255.0
!--- Configure the inside interface.
!
interface Ethernet0/2
nameif inside
security-level 100
ip address 10.10.10.1 255.255.255.0
!-- Output suppressed
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list 100 extended permit ip any any
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0
10.20.10.0 255.255.255.0
!--- This access list (inside_nat0_outbound) is used
!--- with the nat zero command. This prevents traffic which
!--- matches the access list from undergoing network address translation (NAT).
!--- The traffic specified by this ACL is traffic that is to be encrypted and
!--- sent across the VPN tunnel. This ACL is intentionally
!--- the same as (outside_1_cryptomap).
!--- Two separate access lists should always be used in this configuration.
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0
10.20.10.0 255.255.255.0
!--- This access list (outside_cryptomap) is used
!--- with the crypto map outside_map
!--- to determine which traffic should be encrypted and sent
!--- across the tunnel.
!--- This ACL is intentionally the same as (inside_nat0_outbound).
!--- Two separate access lists should always be used in this configuration.
pager lines 24
mtu inside 1500
mtu outside 1500
no failover
asdm image disk0:/asdm-613.bin
asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 10.10.10.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound
!--- NAT 0 prevents NAT for networks specified in
!--- the ACL inside_nat0_outbound.
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 172.16.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 dmz
no snmp-server location
no snmp-server contact
!--- PHASE 2 CONFIGURATION ---!
!--- The encryption types for Phase 2 are defined here.
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
!--- Define the transform set for Phase 2.
crypto map outside_map 1 match address outside_1_cryptomap
!--- Define which traffic should be sent to the IPsec peer.
crypto map outside_map 1 set peer 172.17.1.1
!--- Sets the IPsec peer
crypto map outside_map 1 set transform-set ESP-DES-SHA
!--- Sets the IPsec transform set "ESP-AES-256-SHA"
!--- to be used with the crypto map entry "outside_map".
crypto map outside_map interface outside
!--- Specifies the interface to be used with
!--- the settings defined in this configuration.
!--- PHASE 1 CONFIGURATION ---!
!--- This configuration uses isakmp policy 10.
!--- The configuration commands here define the Phase
!--- 1 policy parameters that are used.
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 1
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
tunnel-group 172.17.1.1 type ipsec-l2l
!--- In order to create and manage the database of connection-specific
!--- records for ipsec-l2l—IPsec (LAN-to-LAN) tunnels, use the command
!--- tunnel-group in global configuration mode.
!--- For L2L connections the name of the tunnel group MUST be the IP
!--- address of the IPsec peer.
tunnel-group 172.17.1.1 ipsec-attributes
pre-shared-key *
!--- Enter the pre-shared-key in order to configure the
!--- authentication method.
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
!-- Output
username cisco123 password ffIRPGpDSOJh9YLq encrypted privilege 15
Cryptochecksum:be38dfaef777a339b9e1c89202572a7d
: end

cisco路由器：

Building configuration...
Current configuration : 2403 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
no logging buffered
!
username cisco123 privilege 15 password 7 1511021F07257A767B
no aaa new-model
ip subnet-zero
!
!
ip cef
!
!
ip ips po max-events 100
no ftp-server write-enable
!
!--- Configuration for IKE policies.
!--- Enables the IKE policy configuration (config-isakmp)
!--- command mode, where you can specify the parameters that
!--- are used during an IKE negotiation. Encryption and Policy details are hidden
!---as the default values are chosen.
crypto isakmp policy 2
authentication pre-share
!--- Specifies the pre-shared key "cisco123" which should
!--- be identical at both peers. This is a global
!--- configuration mode command.
crypto isakmp key cisco123 address 172.16.1.1
!
!
!--- Configuration for IPsec policies.
!--- Enables the crypto transform configuration mode,
!--- where you can specify the transform sets that are used
!--- during an IPsec negotiation.
crypto ipsec transform-set ASA-IPSEC esp-des esp-sha-hmac
!
!--- Indicates that IKE is used to establish
!--- the IPsec Security Association for protecting the
!--- traffic specified by this crypto map entry.
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to172.16.1.1
!--- Sets the IP address of the remote end.
set peer 172.16.1.1
!--- Configures IPsec to use the transform-set
!--- "ASA-IPSEC" defined earlier in this configuration.
set transform-set ASA-IPSEC
!--- !--- Specifies the interesting traffic to be encrypted.
match address 100
!
!
!
!--- Configures the interface to use the
!--- crypto map "SDM_CMAP_1" for IPsec.
interface FastEthernet0
ip address 172.17.1.1 255.255.255.0
duplex auto
speed auto
crypto map SDM_CMAP_1
!
interface FastEthernet1
ip address 10.20.10.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet2
no ip address
!
interface Vlan1
ip address 10.77.241.109 255.255.255.192
!
ip classless
ip route 10.10.10.0 255.255.255.0 172.17.1.2
ip route 10.77.233.0 255.255.255.0 10.77.241.65
ip route 172.16.1.0 255.255.255.0 172.17.1.2
!
!
ip nat inside source route-map nonat interface FastEthernet0 overload
!
ip http server
ip http authentication local
ip http secure-server
!
!--- Configure the access-lists and map them to the Crypto map configured.
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 10.20.10.0 0.0.0.255 10.10.10.0 0.0.0.255
!
!
!
!--- This ACL 110 identifies the traffic flows using route map
access-list 110 deny ip 10.20.10.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 110 permit ip 10.20.10.0 0.0.0.255 any
route-map nonat permit 10
match ip address 110
!
control-plane
!
!
line con 0
login local
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
end

点击(此处)折叠或打开

清除安全关联 (SA)
在 PIX 的特权模式下使用以下这些命令：
clear [crypto] ipsec sa - 删除活动 IPsec SA。关键字 crypto 是可选的。
clear [crypto] isakmp sa - 删除活动 IKE SA。关键字 crypto 是可选的。
show crypto isakmp sa
show crypto ipsec sa
show crypto engine connections active - 显示有关加密和解密数据包（仅限路由器）的当前连接和信息。
PIX 安全设备 - debug 输出
debug crypto ipsec 7 - 显示第 2 阶段的 IPsec 协商。
debug crypto isakmp 7 - 显示第 1 阶段的 ISAKMP 协商。
远程 IOS 路由器 - debug 输出
debug crypto ipsec - 显示第 2 阶段的 IPsec 协商。
debug crypto isakmp - 显示第 1 阶段的 ISAKMP 协商。

w787815

PIX/ASA 8.x与IOS路由器静态到静态IPSec配置示例