asa remote-access vpn ezvpn配置

《asa remote-access vpn ezvpn配置》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、Remote-accessvpnconfig配置的核心（EasyVPNRemoteclient）拓扑要求：R1R2配置默认路由，R3不用配置路由ASA的E0为inside口E1为outside口在ASA上配置一条指向R3的路由。R1上配置一个loopback address。Ø配置的核心是easyvpnremoteclient把ASA配置为server端R1配置为client端Ø配置步骤u先配置ASA---serveru定义IKEpolicyCryptoisakmppolicy1Authenticationpreu定义用

2、户名及密码用于clinet访问Usernamexxxpasswordxxxxu定义一个地址池（可以理解为供clientnat的地址）ciscoasa(config)#iplocalpoolp6?configuremodecommands/options:WORDSpecifyanIPaddressorarangeofIPaddresses:start[-end]u定义tunnel-groupTunnel-group(name)typeipsec-ra定义tunnel组的访问方式及名字（ra）为远程访问Tunnel-gro

3、up(name)ipsec-attributes进入ipsec的属性设置pre-shared-keycisco配置ipsec的共享密码tunnel-groupmy_groupgeneral-attributes进入组的一般属性设置authentication-server-groupLOCAL设置认证server组为ASAaddress-poolp6添加定义给client使用的poolu定义转换集（加密方式）cryptoipsectransform-setmysetesp-desesp-sha-hmacu定义mapcry

4、ptodynamic-mapdy1settransform-setmyset定义动态map并加上相应的加密方式cryptomapvpn10ipsec-isakmpdynamicdy把动态map应用到隧道里u把map应用到相应的接口上cryptomapvpninterfaceoutsideu在相应的接口上开启IKEcryptoisakmpenableoutsideu在ASA上使用add标记做为认证（目的是配合路由器，路由器是使用地址做为认证）cryptoisakmpidentityaddress²路由器配置为clinet端

5、²cryptoipsecclientezvpntest配置ipsecezvpn客户端的名为testgroupmy_groupkeycisco定义tunnel- group组的共享密码这里的组名是ASA上定义的tunnel-group的名字²把ipsecclientezvpntest应用到相应的接口intf0/0cryptoipsecclientezvpntestoutsideintlo0cryptoipsecclientezvpntestinside实际配置如下：R2配置上相关IP及默认路由、R3配置相关接口IP无需配置

6、路由。此省略R1配置：R1#R1#conftEnterconfigurationcommands,oneperline.EndwithCNTL/Z.R1(config)#intf0/0R1(config-if)#ipadd20.1.1.20255.255.255.0R1(config-if)#noshR1(config)#intloopback0R1(config-if)#ipadd1.1.1.1255.255.255.0R1(config-if)#noshR1(config)#iproute0.0.0.00.0.0.0

7、20.1.1.10R1(config)#cryptoipsecclient?ezvpnConfigureanEzVPNclientR1(config)#cryptoipsecclienteR1(config)#cryptoipsecclientezvpn?WORDcrypto-ezvpnnameR1(config)#cryptoipsecclientezvpnsheng?R1(config-crypto-ezvpn)#groupmy_group?keyGroupKeyR1(config-crypto-ezvpn)

8、#groupmy_groupkeyciscoR1(config-crypto-ezvpn)#peer10.1.1.20R1(config)#intf0/0R1(config-if)#cryptoipsecclientezvpnsheng?insideinsideoutsideoutsideR1(config-