IPSec VPN ASA(NAT-T)配置

《IPSec VPN ASA(NAT-T)配置》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、IPSecVPN基于ASA(NAT-T)的配置设计目标：总公司与子公司之间的流量，必须通过IPSecVPN实现加密传输。拓扑如下两台ASA防火墙之间建立IPSecVPN，连接穿过NAT设备。两台ASA防火墙的E0/1接口作为Outside接口，IP地址分别为192.168.0.1/24、200.0.0.1/30，E0/0接口作为Inside接口，IP地址分别为172.16.10.0.254/24、10.10.10.254/24。NAT_T设备需配置PAT，以实现NAT穿越。（注：管理连接端口为UDP500、数据连接管理端口为UDP4500）实施步骤：一、Router和ASA的基础配置R1(

2、NAT_T):enconfthostnameNAT-Tintf0/0ipadd100.0.0.1255.255.255.252noshintf1/0ipadd192.168.0.254255.255.255.0noshend!R2(ISP):enconfthostnameISPintf0/0ipadd100.0.0.2255.255.255.252noshintf1/0ipadd200.0.0.2255.255.255.252noshend!ASA1:conftbootconfigdisk0:/.private/startup-configcopyrunning-configdisk0:/

3、.private/startup-confighostnameASA1inte0/0nameifinsidesecurity-level100ipadd172.16.10.254255.255.255.0noshinte0/1nameifoutsidesecurity-level0ipadd192.168.0.1255.255.255.0noshexit!ASA2:conftbootconfigdisk0:/.private/startup-configcopyrunning-configdisk0:/.private/startup-confighostnameASA2inte0/0na

4、meifinsidesecurity-level100ipadd10.10.10.254255.255.255.0noshinte0/1nameifoutsidesecurity-level0ipadd200.0.0.1255.255.255.252noshexit!二、ASA配置ISAKMP/IKEASA1:cryptoisakmpenableoutsidecryptoisakmppolicy1encryptionaeshashshaauthenticationpre-sharegroup1exitisakmpkeyciscoaddress200.0.0.1cryptoisakmpnat

5、-traversalASA2:cryptoisakmpenableoutsidecryptoisakmppolicy1encryptionaeshashshaauthenticationpre-sharegroup1exitisakmpkeyciscoaddress100.0.0.1（注：1.ASA防火墙默认关闭了的ISAKMP/IKE，需使用命令cryptoisakmpenableoutside启用2.ASA防火墙默认不启用NAT穿越，需使用命令cryptoisakmpnat-traversal启用）三、ASA配置IPSecASA1：access-listqosvpnextendedpe

6、rmitip172.16.10.0255.255.255.010.10.10.0255.255.255.0cryptoipsectransform-setqos-setesp-aesesp-sha-hmaccryptomapqos-map1matchaddressqosvpncryptomapqos-map1setpeer200.0.0.1cryptomapqos-map1settransform-setqos-setcryptomapqos-mapinterfaceoutsideASA2:access-listqosvpnextendedpermitip10.10.10.0255.255

7、.255.0172.16.10.0255.255.255.0cryptoipsectransform-setqos-setesp-aesesp-sha-hmaccryptomapqos-map1matchaddressqosvpncryptomapqos-map1setpeer100.0.0.1cryptomapqos-map1settransform-setqos-setcryptomapqos-mapinterfac