您的位置：360文档中心› 51CTO下载-ASA+SSL配置文档

51CTO下载-ASA+SSL配置文档

合集下载

51CTO下载-PIX+IOS及Key

51CTO下载-PIX+IOS及Key

c3640-jk9o3s-mz.124-7a.bin
http://dl.dbBiblioteka /c0k1rlyy6q
c3660-ik9o3s-mz.124-15.T6.BIN
/c01gvrc64f
c3725-adventerprisek9-mz.124-15.T5
Activation Key:0xd2390d2c 0x9fc4b36d 0x98442d99 0xeef7d8b1
Serial Number:0x301D10D9
Activation Key:0x5236f5a7 0x97def6da 0x732a91f5 0xf5deef57
以下ASDM配合PIX使用
Activation Key:0xd2390d2c 0x9fc4b36d 0x98442d99 0xeef7d8b1
Serial Number:0x1c9f971c
Activation Key:0xa94b7db5,0x17d768ea,0x63f6e081,0x6d9fadd5
Serial Number:808102688
以下2个IPS一起使用,登陆用户:cisco 密码:net527
ips-disk1.img
/file/785655
ips-disk2.img
/file/785659
PIX序列号
Serial Number:0x302aab20
第一次使用的启动脚本,如果无法直接进入ASA的配置界面,就使用如下命令,使用一次就行了,下次就可以直接进入
cp /asa/bin/lina /mnt/disk0/lina
cp /asa/bin/lina_monitor /mnt/disk0/lina_monitor

Asa配置大全

Asa配置大全

1、ASA基本配置静态路由：route outside 192.168.100.0 255.255.255.0 192.168.1.99配置允许telnet：telnet 192.168.10.0 255.255.255.0 inside配置telnet超时时间：telnet timeout 5配置本地认证telnet与console：aaa authentication telnet console LOCAL配置SSH生成密钥对：aaa authentication ssh console LOCALciscoasa(config)# crypto key generate rsaINFO: The name for the keys will be: <Default-RSA-Key>Keypair generation process begin. Please wait...ciscoasa(config)#配置允许SSH：ssh 192.168.10.0 255.255.255.0 inside配置允许ASDM管理：http server enablehttp 192.168.10.0 255.255.255.0 insideasdm image disk0:/asdm-602.binusername cisco password cisco privilege 15配置PAT：nat (inside) 1 192.168.10.0 255.255.255.0global (outside) 1 interface配置端口映射：access-list to_server extended permit tcp any host 192.168.1.99 eq wwwaccess-group to_server in interface outsidestatic (inside,outside) tcp interface www 192.168.10.98 www netmask 255.255.255.255配置ACL：access-list to_server extended permit tcp any host 192.168.1.99 eq wwwaccess-group to_server in interface outside配置允许ICMP穿越：policy-map global_policyclass inspection_defaultinspect icmp配置URL过滤：url-server (outside) vendor websense host 192.168.1.100 timeout 30 protocol TCP version 1 connections 5filter url http 192.168.10.0 255.255.255.0 0.0.0.0 0.0.0.0 allow日志管理：开启logging：logging enable开启console日志：logging console 7将日志发送到日志服务器：logging trap 7logging host inside 192.168.10.98配置IPS：ip audit name zxd info action alarmip audit name cisco attack action alarmip audit interface outside zxdip audit interface outside cisco2、VPN配置ASA IPSec L2L配置：access-list nonat extended permit ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0 nat (inside) 0 access-list nonatcrypto ipsec transform-set cisco esp-des esp-nonecrypto map cisco 10 match address nonatcrypto map cisco 10 set peer 192.168.1.96crypto map cisco 10 set transform-set ciscocrypto map cisco interface outsidecrypto isakmp enable outsidecrypto isakmp policy 1authentication pre-shareencryption deshash shagroup 1tunnel-group 192.168.1.96 type ipsec-l2ltunnel-group 192.168.1.96 ipsec-attributespre-shared-key ciscoASA Remote VPN Server配置：ip local pool vpnpool 192.168.2.250-192.168.2.254group-policy vpntest internalgroup-policy vpntest attributesvpn-tunnel-protocol IPSecusername zhong password xiaodongtunnel-group vpntest type remote-accesstunnel-group vpntest general-attributesaddress-pool vpnpooldefault-group-policy vpntesttunnel-group vpntest ipsec-attributespre-shared-key ciscocrypto ipsec transform-set cisco esp-des esp-md5-hmac crypto dynamic-map vpntest 1 set transform-set cisco crypto dynamic-map vpntest 1 set reverse-route crypto map cisco 1 ipsec-isakmp dynamic vpntest crypto map cisco interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10authentication pre-shareencryption aeshash shagroup 2RADIUS认证用户：aaa-server vpntest protocol radiusaaa-server vpntest (outside) host 192.168.1.100key ciscotunnel-group vpntest general-attributes authentication-server-group (outside) vpntestASA SSL VPN配置ip local pool vpnpool 192.168.2.200-192.168.2.210 username zhong password xiaodongwebvpnenable outsidesvc image disk0:/sslclient-win-1.1.3.173.pkgsvc enabletunnel-group-list enablegroup-policy webvpn internalgroup-policy webvpn attributesvpn-tunnel-protocol svc webvpnwebvpnsvc ask enabletunnel-group webvpn type remote-accesstunnel-group webvpn general-attributesaddress-pool vpnpooldefault-group-policy webvpntunnel-group webvpn webvpn-attributesgroup-alias hnebony enableIOS SSL VPN配置aaa new-modelaaa authentication login vpnauthen localusername zhong password xiaodongip local pool vpnpool 192.168.20.200 192.168.20.254interface loopback 0ip address 192.168.20.1 255.255.255.0exitwebvpn install svc disk0:/webvpn/svc.pkgwebvpn gateway outip address 192.168.1.99inservicewebvpn context vpntestpolicy group vpntestfunctions svc-enabledsvc address-pool vpnpoolsvc split include 192.168.0.0 255.255.0.0exitdefault-group-policy vpntestaaa authentication list vpnauthengateway outinserviceIOS Easy VPN Server配置:aaa new-modelaaa authentication login vpnauthen localaaa authorization network vpnauthor localusername zhong password xiaodongip local pool vpnpool 192.168.20.200 192.168.20.254ip access-list extended splitpermit ip 192.168.0.0 0.0.255.255 192.168.20.0 0.0.0.255 crypto isakmp policy 1authentication pre-sharehash md5group 2crypto isakmp client configuration group vpntestkey ciscopool vpnpoolacl splitcrypto ipsec transform-set cisco esp-aes esp-sha-hmac crypto dynamic-map vpndymap 1set transform-set ciscoreverse-routecrypto map vpntest client authentication list vpnauthen crypto map vpntest client configuration address respond crypto map vpntest isakmp authorization list vpnauthor crypto map vpntest 10 ipsec-isakmp dynamic vpndymap inter f0/0crypto map vpntest使用ACS认证与授权：aaa authentication login vpnauthen group radiusaaa authorization network vpnauthor group radiusradius-server host 192.168.1.100 auth-port 1645 acct-port 1646 key ciscoRADIUS (IETF)选中6、64、65、69、81.建立用户：vpntest（vpn组路由器配置crypto isakmp client configuration group vpntest可以取消）然后建立用户IOS Easy VPN Client配置:crypto ipsec client ezvpn vpntestmode clientconnect autopeer 192.168.10.1group vpntest key ciscousername zhong password xiaodonginterface f0/0crypto ipsec client ezvpn vpntestinterface f1/0crypto ipsec client ezvpn vpntest inside R1#crypto ipsec client ezvpn xauthUsername: zhongPassword:3、802.1X认证aaa new-modelaaa authentication dot1x default group radius aaa authorization network default group radius radius-server host 192.168.1.100 key cisco dot1x system-auth-controlinterface f0/1dot1x port-control auto指定VLAN：4、RSTPAlternate port—Offers an alternate path toward the root switch to that provided by the current root port.Backup port—Acts as a backup for the path provided by a designated port toward the leaves of the spanning tree. A backup port can exist only when two ports are connected in a loopback by a point-to-point link or when a switch has two or more connections to a shared LAN segment.Edge ports—If you configure a port as an edge port on an RSTP switch by using the spanning-tree portfast interface configuration command, the edge port immediately transitions to the forwarding state. An edge port is the same as a Port Fast-enabled port, and you should enable it only on ports that connect to a single end station.Root ports—If the RSTP selects a new root port, it blocks the old root port and immediately transitions the new root port to the forwarding state.Point-to-point links—If you connect a port to another port through a point-to-point link and the local port becomes a designated port, it negotiates a rapid transition with the other port by using the proposal-agreement handshake to ensure a loop-free topology. As shown in Figure 18-4, Switch A is connected to Switch B through a point-to-point link, and all of the ports are in the blocking state. Assume that the priority of Switch A is a smaller numerical value than the priority of Switch B. Switch A sends a proposal message (a configuration BPDU with the proposal flag set) to Switch B, proposing itself as the designated switch. After receiving theproposal message, Switch B selects as its new root port the port from which the proposalmessage was received, forces all nonedge ports to the blocking state, and sends an agreement message (a BPDU with the agreement flag set) through its new root port. After receiving Switch B’s agreement message, Switch A also immediately transitions its designated port to the forwarding state. No loops in the network are formed because Switch B blocked all of its nonedge ports and because there is a point-to-point link between Switches A and B. When Switch C is connected to Switch B, a similar set of handshaking messages are exchanged.Switch C selects the port connected to Switch B as its root port, and both ends immediately transition to the forwarding state. With each iteration of this handshaking process, one more switch joins the active topology. As the network converges, this proposal-agreement handshaking progresses from the root toward the leaves of the spanning tree. The switch learns the link type from the port duplex mode: a full-duplex port is considered to have a point-to-point connection; a half-duplex port is considered to have a shared connection. You can override the default setting that is controlled by the duplex setting by using the spanning-tree link-type interface configuration command.5、时间访问列表time-range zxdabsolute start 08:30 24 August 2009 end 18:00 01 September 2009time-range ciscoperiodic daily 8:00 to 18:00access-list 110 permit ip any any time-range cisco6、QOSCAR：rate-limit input access-group 101 1000000 3000 4000 conform-action transmit exceed-action dropGTS：class-map match-all ciscomatch access-group 101!!policy-map ciscoclass ciscopolice cir 500000 bc 10000 pir 1000000 be 10000conform-action transmitexceed-action set-prec-transmit 2violate-action dropinterface f1/0service-policy output ciscoCBWFQ:class-map match-all cbwfqmatch access-group 101policy-map cbwfqclass cbwfqpriority percent 60interface f1/0service-policy output cbwfq7、NA T-T8、标准化产品特色：1定位准确，以就业为导向。

asa配置步骤

asa配置步骤

思科防火墙已经从PIX发展到ASA了，IOS也已经从早期的6.0发展到7.2。

但总体的配置思路并没有多少变化。

只是更加人性化，更加容易配置和管理了。

下面是我工作以来的配置总结，有些东西是6.3版本的，但不影响在7.*版本的配置。

一：6个基本命令： nameif、 interface、 ip address 、nat、 global、 route。

二：基本配置步骤：step1: 命名接口名字nameif ethernet0 outside security0nameif ethernet1 inside security100nameif ethernet2 dmz security50**7版本的配置是先进入接口再命名。

step2：配置接口速率interface ethernet0 10full autointerface ethernet1 10full autointerface ethernet2 10fullstep3：配置接口地址ip address outside 218.106.185.82ip address inside 192.168.100.1 255.255.255.0ip address dmz 192.168.200.1 255.255.255.0step4：地址转换(必须)* 安全高的区域访问安全低的区域(即内部到外部)需NAT和global;nat(inside) 1 192.168.1.1 255.255.255.0global(outside) 1 222.240.254.193 255.255.255.248*** nat (inside) 0 192.168.1.1 255.255.255.255 表示192.168.1.1这个地址不需要转换。

直接转发出去。

* 如果内部有服务器需要映射到公网地址(外网访问内网)则需要static和conduit或者acl.static (inside, outside) 222.240.254.194 192.168.1.240static (inside, outside) 222.240.254.194 192.168.1.240 10000 10后面的10000为限制连接数，10为限制的半开连接数。

思科ASA防火墙基本配置

思科ASA防火墙基本配置

思科ASA防火墙基本配置思科ASA防火墙基本配置Fire Wall 防火墙，它是一种位于内部网络与外部网络之间的网络安全系统，当然，防火墙也分软件防火墙与硬件防火墙。

硬件防火墙又分为：基于PC架构与基于ASIC芯片今天来聊一聊思科的'硬件防火墙 Cisco ASACisco ASA 防火墙产品线挺多：Cisco ASA5505 Cisco ASA5510 Cisco ASA5520 Cisco ASA5540 Cisco ASA5550 等等ASA 的基本配置步骤如下：配置主机名、域名hostname [hostname]domain-name xx.xxhostname Cisco-ASA 5520domain-name 配置登陆用户名密码password [password]enable password [password]配置接口、路由interface interface_namenameif [name]name 有三种接口类型 insdie outside dmzsecurity-level xx(数值)数值越大接口安全级别越高注：默认inside 100 ,outside 0 ,dmz 介于二者之间静态路由route interface_number network mask next-hop-addressroute outside 0.0.0.0 0.0.0.0 210.210.210.1配置远程管理接入Telnettelnet {network | ip-address } mask interface_nametelnet 192.168.1.0 255.255.255.0 insidetelnet 210.210.210.0 255.255.255.0 outsideSSHcrypto key generate rsa modulus {1024| 2048 }指定rsa系数，思科推荐1024ssh timeout minutesssh version version_numbercrypto key generate rsa modulus 1024ssh timeout 30ssh version 2配置 ASDM(自适应安全设备管理器)接入http server enbale port 启用功能http {networdk | ip_address } mask interface_nameasdm image disk0:/asdm_file_name 指定文件位置username user password password privilege 15NATnat-controlnat interface_name nat_id local_ip maskglobal interface_name nat_id {global-ip [global-ip] |interface} nat-controlnat inside 1 192.168.1.0 255.255.255.0global outside 1 interfaceglobal dmz 1 192.168.202.100-192.168.202.150ACLaccess-list list-name standad permit | deny ip maskaccess-list list-name extendad permit | deny protocol source-ip mask destnation-ip mask portaccess-group list-name in | out interface interface_name如果内网服务器需要以布到公网上staic real-interface mapped-interface mapped-ip real-ip staic (dmz,outside) 210.210.202.100 192.168.202.1保存配置wirte memory清除配置clear configure (all)【思科ASA防火墙基本配置】。

ASA型号及配置命令

ASA型号及配置命令

ASA型号及配置命令asa复习笔记一、cisco防火墙1.软件防火墙它用于基于IOS软件的设备。

一般来说，客户端上具有应用层智能的状态检测防火墙引擎占CPU和内存资源的2.5%（可以定期欣赏）硬件防火墙（更多优势）应用在一般企业外部网络：pix500系列安全设备、asa5500系列自适应安全设备、catalyst6500系列交换机和cisco7600系列路由器的防火墙服务模块（不可以定期升值）二、 Ciscosa1常见型号：型号asa5505asa5510asa5520asa5540asa5550asa5580规模作用交换机接小型企业、分公司和企业设备成本低，易于部署、集成8个10/100端口快速口远程办公环境以太网交换机中型企业、分公司企业环设备成本低，易于部署，具有高级安全和网络服务境中型企业具有模块化、高性能网络中的高可用性主动/主动服路(小凡模拟器)务，并能连接千兆以太网设备由大中型企业，服务提供商提供高密度，主动/主动高可用性服务和千兆以太网连器接，设备具有高可靠性和高性能接大型企业、服务提供商网千兆级提供高达1.2gb/s的防火墙吞吐量，具有主动口络的高性能设备/主动高可用性服务、光纤和千兆位以太网连接性大型企业、数据中心、和提供王兆位以太网连接运营商网络型号为asa5580-20、asa5580-402.基本配置配置主机名：ciscoasa>enciscoasa#cinft思科ASA（配置）#主机名ASA802域名：asa802(config)#enablepassword123telnet或ssh密码:Asa802（配置）#passwdciscoasa接口名称和安全级别asa802(config-if)#nameifinside（不起名，ping不通）Asa802（如果配置）#安全级别100（值为0-100，值越大，安全级别越高）//默认情况下，outside口安全级别为0，inside口安全级别为100，防火墙允许数据从高安全级别流向低安全级别的接口，但不允许流量从低安全级别流向高安全级别的接口，若要放行，必须做策略，acl放行；若接口的安全级别相同，那么它们之间不允许通信，绝对不允许，但有时有这个需要，故意把它们设成一样。

GNS3中模拟ASA详细教程

GNS3中模拟ASA详细教程

注：关于如何控制CPU的使用率，请光临《如何限制GNS3中CPU的使用率（ASA）》GNS3中运行ASA详细步骤如下：备注：GNS3安装目录如下图所示:1、下载：asa802-k8.bin2、将下面压缩文件：然后将unpack文件夹复制到C盘的根目录下（即C：\unpack）。

3、win + R → cmd 回车→cd \unpack回车→4、运行上面的命令后生成了下面2个文件！具体如下图所示：5、GNS3的详细配置如下：(1)General setting：(3)最关键的Qemu核心配置：请看仔细！General Setting:请按照上面所有图的红框中配置好后，下面我们就用SecureCRT连上ASA防火墙：6、在SecureCRT上的设置，如下图所示：至此，GNS3中模拟ASA详细教程完毕！备注：上面所有要用到的软件在51CTO下载中心下载：1、上传权限所限，故共分2部分：/data/171628（第1部分）/data/171626（第2部分）*解惑：1、有朋友问端口是否up?释疑如下，请sailory博友看下面：谢谢sailory博友，欢迎再次光临本博客，谢谢！如何限制GNS3中CPU的使用率（ASA）1、请看下图所示，如果CPU使用100%，那我们还能干么呀？：）办法总比问题多！请继续往下看：2、双击BES.exe，如下图：2、限制CPU使用率：如果不限制qemu，将意味着CPU占用率非常高，限制某个进程的CPU 使用率很简单，安装BES软件，然后运行，把qemu进程的CPU使用率控制一下就OK ^_^，点击“Target…”，选择防火墙模拟器的进程“qemu.exe”点击“Limit this” ，如下图所示：点击“Control…”，限制CPU使用率，如下图所示：例如：将滑块向右移动到下图所示位置，请观察之！思考：举一反三，如果要开启2个ASA呢？^_^BES限制CPU的使用率暂毕！。

思科asa系列常规操作cli配置指南-软件版本9.4说明书

思科asa系列常规操作cli配置指南-软件版本9.4说明书

思科系统公司思科在全球设有 200 多个办事处。

有关地址、电话号码和传真号码信息， 可查阅思科网站：/go/offices 。

思科 ASA 系列常规操作 CLI 配置指南软件版本 9.4适用于 ASA 5506-X 、ASA 5506H-X 、ASA 5506W-X 、ASA 5508-X 、ASA 5512-X 、ASA 5515-X 、ASA 5516-X 、ASA 5525-X 、ASA 5545-X 、ASA 5555-X 、ASA 5585-X 、ASA 服务模块和自适应安全虚拟设备首次发行日期：2015 年 3 月 23 日最后更新日期：2015 年 4 月 7 日文本部件号： 不适用，仅在线提供本手册中有关产品的规格和信息如有更改，恕不另行通知。

本手册中的所有声明、信息和建议均准确可靠，但我们不为其提供任何明示或暗示的担保。

用户必须承担使用产品的全部责任。

随附产品的软件许可和有限担保在随产品一起提供的信息包中提供，且构成本文的一部分。

如果您无法找到软件许可或有限担保，请与思科代表联系以获取副本。

思科所采用的 TCP 信压缩是加州大学伯克莱分校 (UCB) 开发的一个程序的改版，是 UCB 的 UNIX 操作系统公共域版本的一部分。

保留所有权利。

版权所有 © 1981，加州大学董事会。

无论在该手册中是否作出了其他担保，来自这些供应商的所有文档文件和软件都按“原样”提供且仍有可能存在缺陷。

思科和上述供应商不承诺所有明示或暗示的担保，包括（但不限于）对特定用途的适销性、适用性、非侵权性以及因交易、使用或商业惯例所衍生的担保。

在任何情况下，对于任何间接、特殊、连带发生或偶发的损坏，包括（但不限于）因使用或无法使用本手册而导致的任何利润损失或数据损失或损坏，思科及其供应商概不负责，即使思科及其供应商已获知此类损坏的可能性也不例外。

思科和思科徽标是思科和/或其附属公司在美国和其他国家/地区的商标或注册商标。

asa虚拟机下载及使用教程

asa虚拟机下载及使用教程

asa虚拟机下载及使用教程1.
安装vmware6.5以上版本。

2.
nptp(附件下载)
然后是nptp的设置
打开nptp
点EDIT,选择新建：
这里要注意的是pipe的设置，端口可以设置任意系统未用的，pipe后面的ASA（即：\\.\pipe\ASA）要和虚拟机加载的名字一致。

还有最后注意的一点是先开启nptp ，一定要一直开着。

接下来是vmware 的设置
首先是加载vmware 版本的ASA ，下载地址的连接：
/file/f2a35d86a1#
ASA.rar
启动虚拟机，开始的时候提示让你选择启动的系统，这里直接选择启动ASA就可以了，等出现下面图像的时候就表示成功了。

最后要做的就是telnet到ASA，我用的是secureCRT,相信大家都会用的
今天再弄个ASDM的实验，成功了也拿来给大家share！
共享asa1.4的vmware文件：/file/f2b08a14e2# asa_1.4.exe
1、1.4的好处是可以不用nptp，可以直接运行start_gw.bat，不要关闭
2、打开connect.bat，OK
3、这个版本可以wr保存配置。

不好的就是命令敲错不能回退，也不使用TAB键补全。

  1. 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
  2. 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
  3. 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。

升级ASA 5500系列防火墙软件及ASDMASA 软件8.x版本及ASDM6.x版本相比7.x,ASDM5.x有一些新的功能，使用界面更友好，此次上海的ASA5520软件已经升级到8.0.4 ASDM升级到了6.15.下面介绍ASA软件升级的两种方法：方法一：通过ASDM界面升级把ASA随机光盘中的文件复制到使用电脑硬盘中选择要升级的ASA软件版本同样的方式升级ASDM方法二：通过CLI升级在电脑上安装TFTP软件（如3CDaemon）；安装完成后设置3Cdaemon TFTP upload/download 目录；检查用于升级的电脑与ASA之间的网络连通性（在ASA的CLI界面通过ping的方式测试）Copy tftp://10.0.3.5/asa821-k8.bin disk0:升级完成后，按同样的方法升级ASDMCopy tftp://10.0.3.5/asdm-621.bin disk0:指定ASA下次启动时使用的软件和ASDM版本Boot system disk0:/asa821-k8.bin \\指定系统启动时使用的软件Asdm image disk0:/asdm-621.bin \\指定ASDM版本Write \\保存配置Reload \\重启ASA（重启ASA会导致网络中断，请在合适的时间进行软件升级，并重启ASA，使升级生效）使用以上拓扑环境模拟正大真实环境（避免因修改ASA配置影响网络）需求如下：●上海、北海两地通过ASA建立L2L VPN，实现上海内网10.109.67.0/24 10.109.66.0/24与北海内网10.0.3.0/24互通；●上海ASA配置SSL VPN ，SSL VPN用户获得192.168.5.0网段IP可以访问上海内网10.109.67.0/24 10.109.66.0/24网段，也能访问北海内网10.0.3.0/24；配置L2L VPN方法一：通过ASDM界面配置配置北海ASA配置上海ASA方法二：通过CLI配置配置北海ASAobject-group network DM_INLINE_NETWORK_1 network-object 10.109.66.0 255.255.255.0 network-object 10.109.67.0 255.255.255.0 network-object 192.168.5.0 255.255.255.0access-list icmp extended permit icmp any anyaccess-list inside_nat0_outbound extended permit ip 10.0.3.0 255.255.255.0 object-group DM_INLINE_NETWORK_1access-list outside_1_cryptomap extended permit ip 10.0.3.0 255.255.255.0 object-group DM_INLINE_NETWORK_1crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmaccrypto ipsec security-association lifetime seconds 28800crypto ipsec security-association lifetime kilobytes 4608000crypto map outside_map 1 match address outside_1_cryptomapcrypto map outside_map 1 set pfs group1crypto map outside_map 1 set peer 218.78.218.182crypto map outside_map 1 set transform-set ESP-DES-SHAcrypto map outside_map interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10authentication pre-shareencryption deshash shagroup 2lifetime 86400crypto isakmp policy 65535authentication pre-shareencryption 3deshash shagroup 2lifetime 86400tunnel-group 218.78.218.182 type ipsec-l2ltunnel-group 218.78.218.182 ipsec-attributespre-shared-key *!配置上海ASAobject-group network DM_INLINE_NETWORK_1network-object 10.109.66.0 255.255.255.0network-object 10.109.67.0 255.255.255.0object-group network DM_INLINE_NETWORK_2network-object 10.0.3.0 255.255.255.0network-object 192.168.5.0 255.255.255.0access-list inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_INLINE_NETWORK_2access-list inside_nat0_outbound extended permit ip 192.168.5.0 255.255.255.0 10.0.3.0255.255.255.0access-list outside_1_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1object-group DM_INLINE_NETWORK_2access-list outside_1_cryptomap extended permit ip 192.168.5.0 255.255.255.0 10.0.3.0 255.255.255.0access-list Internalnetwork standard permit 10.109.66.0 255.255.255.0access-list Internalnetwork standard permit 10.109.67.0 255.255.255.0access-list Internalnetwork standard permit 10.0.3.0 255.255.255.0crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmaccrypto ipsec security-association lifetime seconds 28800crypto ipsec security-association lifetime kilobytes 4608000crypto map outside_map 1 match address outside_1_cryptomapcrypto map outside_map 1 set pfs group1crypto map outside_map 1 set peer 58.25.36.73crypto map outside_map 1 set transform-set ESP-DES-SHAcrypto map outside_map 1 set security-association lifetime seconds 28800crypto map outside_map 1 set security-association lifetime kilobytes 4608000crypto map outside_map interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10authentication pre-shareencryption deshash shagroup 2lifetime 86400crypto isakmp policy 65535authentication pre-shareencryption 3deshash shagroup 2lifetime 86400tunnel-group 58.25.36.73 type ipsec-l2ltunnel-group 58.25.36.73 ipsec-attributespre-shared-key *!配置SSL VPN方法一：通过ASDM配置Apply方法二：通过CLI配置access-list Internalnetwork standard permit 10.109.66.0 255.255.255.0 access-list Internalnetwork standard permit 10.109.67.0 255.255.255.0 access-list Internalnetwork standard permit 10.0.3.0 255.255.255.0ip local pool ssl-pool 192.168.5.1-192.168.5.50 mask 255.255.255.0 webvpnenable outsidesvc image disk0:/anyconnect-win-2.3.0254-k9.pkg 1svc enablegroup-policy ssl-group internalgroup-policy ssl-group attributesvpn-tunnel-protocol svcsplit-tunnel-policy tunnelspecifiedsplit-tunnel-network-list value Internalnetwork address-pools value ssl-poolwebvpnsvc dtls enablesvc keep-installer installedsvc ask none default svcusername ssluser attributesvpn-group-policy ssl-groupservice-type remote-accessSSL用户登录打开浏览器输入https://218.78.128.182如何让SSL VPN用户访问L2L VPN远端的内网如果按照前面的步骤完成了L2L和SSL的配置，SSL Client还不能访问L2L远端的内网（SSL 用户无法访问北海内网）需要在上海ASA CLI界面输入以下命令：Config tsame-security-traffic permit intra-interface用ASDM添加SSL VPN用户关于ASA 双ISP接入做负载均衡（网通走网通，电信走电信）Q. Does ASA support ISP load balancing?A. No. Load balancing must be handled by a router that passes traffic to the security appliance/en/US/products/hw/vpndevc/ps2030/products_qanda_ item09186a00805b87d8.shtml#q6i/en/US/products/hw/vpndevc/ps2030/products_config uration_example09186a00806e880b.shtml。

相关文档
最新文档