ASA5510防火墻VPN配置方式

ASA5510防火墻remoteipsecvpn配置

1、IPSEC

VPN基本配置access-listno-natextendedpermitip

//定義VPN數(shù)據(jù)流nat(inside)0access-listno-nat

//設置IPSECVPN數(shù)據(jù)不作nat翻譯

iplocalpoolvpn-pool-00mask

//劃分地址池，用于VPN用戶撥入之后分配的地址。

cryptoipsectransform-setvpnsetesp-desesp-md5-hmac

//定義一個變換集myset，用esp-md5加密的。(網上一般都是用esp-3desesp-sha-hmac或esp-des

esp-sha-hmac，而我使用的防火墻沒開啟3des，所以只能使用esp-des；至于esp-sha-hmac，不知為什么，使用它隧道組始終無法連接上，所以改用esp-md5-hmac。具體原因不清楚。)(補充：后來利用ASA5520防火墻做了關于esp-3desesp-sha-hmac加密的測試，成功！)cryptodynamic-mapdymap10settransform-setvpnset

//把vpnset添加到動態(tài)加密策略dynmapcryptodynamic-mapdymap10setreverse-routecryptomapvpnmap10ipsec-isakmpdynamicdymap

//把動態(tài)加密策略綁定到vpnmap動態(tài)加密圖上cryptomapvpnmapinterfaceoutside

//把動態(tài)加密圖vpnmap綁定到outside口

address-poolvpn-pool

//將VPNclient地址池綁定到"whjt"隧道組

usernametestpasswordtest

//設定用戶名和密碼

authentication-server-group(outside)LOCAL

//本地認證服務組(本條命令沒用）

default-group-policywhjt

//默認策略組為whjttunnel-groupwhjtipsec-attributes

//定義whjt組IPSec的屬性

pre-shared-key730211

//定義共享密鑰為：730211isakmpnat-traversal20

//每20秒向VPN對端發(fā)送一個包來防止中間PAT設備的PAT超時，就相當于路由器中的isakmpkeepalivethreshold20retry2

在生存時間監(jiān)控前，設備被允許空閑20秒，發(fā)現(xiàn)生存時間沒有響應后，2秒鐘內重試sysoptconnectionpermit-vpn//通過使用sysoptconnect命令，我們告訴ASA準許SSL/IPsec客戶端繞過接口的訪問列表(未加此命令會出現(xiàn)可以ping能內網地址，但不能訪問內網服務，比如23、80等端口。）

2、開啟隧道分離access-listvpnsplitstandardpermit

//注意源地址為ASA的inside網絡地址group-policywhjtattributes

//定義策略組屬性split-tunnel-policytunnelspecified

//建立隧道分離策略為tunnelspecified

split-tunnel-network-listvaluevpnsplit

//與vpnsplit匹配的網絡將全部使用隧道分離

注1：如要實現(xiàn)VPN用戶可以ping通ASA的inside口，即可以防火墻中加入如下命令：

management-accessinside

注2：如果遠程用戶上互聯(lián)網是通過nat方式上網（所有寬帶用戶都通過同一個公網IP訪問外部），那么通過如下命令可穿越natcryptoisakmpnat-traversal

20//缺省keepalives時間20秒

3、客戶端的配置

我使用的客戶端是cisco

VPNClient

5.0，配置如下圖，Host：ASA外網口IP，組賬號：whjt

密碼：730211

配置好后，連接VPN，會彈出下面對話框，輸入遠程用戶的用戶名和密碼，上例均為test

4、ASA5510完全配置test#shrun

:Saved

:

ASAVersion8.0(2)

!

hostnametest

domain-name

enablepassword2KFQnbNIdI.2KYOUencrypted

names

!

interfaceEthernet0/0

nameifoutside

security-level0

ipaddress

!

interfaceEthernet0/1

nameifinside

security-level100

ipaddress

!

interfaceEthernet0/2

shutdown

nonameif

nosecurity-level

noipaddress

!

interfaceEthernet0/3

shutdown

nonameif

nosecurity-level

noipaddress

!

interfaceManagement0/0

shutdown

nonameif

nosecurity-level

noipaddress

!

passwd2KFQnbNIdI.2KYOUencrypted

ftpmodepassive

dnsserver-groupDefaultDNS

domain-name

access-list101extendedpermiticmpanyany

access-listno-natextendedpermitip

access-listvpnsplitstandardpermit

pagerlines24

mtuoutside1500

mtuinside1500

iplocalpoolvpn-pool-00mask

icmpunreachablerate-limit1burst-size1

noasdmhistoryenable

arptimeout14400

global(outside)100netmask

nat(inside)0access-listno-nat

nat(inside)1

access-group101ininterfaceoutside

routeoutside71

timeoutxlate3:00:00

timeoutconn1:00:00half-closed0:10:00udp0:02:00icmp0:00:02

timeoutsunrpc0:10:00h3230:05:00h2251:00:00mgcp0:05:00mgcp-pat0:05:00

timeoutsip0:30:00sip_media0:02:00sip-invite0:03:00sip-disconnect0:02:00

timeoutuauth0:05:00absolute

dynamic-access-policy-recordDfltAccessPolicy

http55inside

nosnmp-serverlocation

nosnmp-servercontact

snmp-serverenabletrapssnmpauthenticationlinkuplinkdowncoldstart

cryptoipsectransform-setvpnsetesp-desesp-md5-hmac

cryptodynamic-mapdymap10settransform-setvpnset

cryptodynamic-mapdymap10setreverse-route

cryptomapvpnmap10ipsec-isakmpdynamicdymap

cryptomapvpnmapinterfaceoutside

cryptoisakmpidentityaddress

cryptoisakmpenableoutside

cryptoisakmpenableinside

cryptoisakmppolicy10

authenticationpre-share

encryptiondes

hashmd5

group2

lifetime86400

telnetinside

telnettimeout5

sshoutside

sshinside

sshtimeout60

sshversion1

consoletimeout0management-accessinside

threat-detectionbasic-threat

threat-detectionstatisticsaccess-list

!

!

group-policywhjtinternal

group-policywhjtattributes

vpn-idle-timeout

1800

//我在實際中一般用3600000，時間長些不易掉線

split-tunnel-policytunnelspecified

split-tunnel-network-listvaluevpnsplit

usernametestpasswordP4ttSyrm33SV8TYpencrypted

tunnel-groupwhjttyperemote-access

tunnel-group