ASA84 VPN试验系列四诡异的IKEv2 L2L VPN.docx
- 文档编号:22779462
- 上传时间:2023-04-27
- 格式:DOCX
- 页数:27
- 大小:37.52KB
ASA84 VPN试验系列四诡异的IKEv2 L2L VPN.docx
《ASA84 VPN试验系列四诡异的IKEv2 L2L VPN.docx》由会员分享,可在线阅读,更多相关《ASA84 VPN试验系列四诡异的IKEv2 L2L VPN.docx(27页珍藏版)》请在冰豆网上搜索。
ASA84VPN试验系列四诡异的IKEv2L2LVPN
ASA8.4 VPN试验系列四:
诡异的IKEv2 L2L VPN
我想了很久这篇博文的名字,在IKEv2L2LVPN前面加上“诡异的”三个字比较贴切,因为IKEv2的认证方式与IKEv1相比确实显得非常的诡异!
因为两个ASA分别可以使用不同的预共享密钥进行认证,还能一方使用预共享密钥,另一方使用证书认证。
传统的双方使用证书认证也是可以实现的。
在后面的实验中我都会给出相应的配置!
ASA8.4VPN实验这个系列博文就到此结束了,我还会继续深入的研究IKEv2VPN技术,会在后续的CCNPSecurityVPNv1.0课程中继续进行介绍,希望大家继续关注。
顺便说一个事,我花了几个月的时间对我的书做了第二次修改,现在已经交稿给编辑了,编辑对我这次上交的稿件很满意,可能不久就能进入出版流程了。
实验拓扑:
=======================================预共享密钥认证================================
hostnameASA1
enablepassword8Ry2YjIyt7RRXU24encrypted
passwd2KFQnbNIdI.2KYOUencrypted
names
!
interfaceEthernet0/0
nameifOutside
security-level0
ipaddress202.100.1.10255.255.255.0
!
interfaceEthernet0/1
nameifInside
security-level100
ipaddress10.1.1.10255.255.255.0
!
interfaceEthernet0/2
shutdown
nonameif
nosecurity-level
noipaddress
!
interfaceEthernet0/3
shutdown
nonameif
nosecurity-level
noipaddress
!
interfaceManagement0/0
shutdown
nonameif
nosecurity-level
noipaddress
management-only
!
ftpmodepassive
access-listyeslab-vpnextendedpermitip10.1.1.0255.255.255.0192.168.1.0255.255.255.0
pagerlines24
loggingenable
mtuOutside1500
mtuInside1500
nofailover
icmpunreachablerate-limit1burst-size1
noasdmhistoryenable
arptimeout14400
routeOutside0.0.0.00.0.0.0202.100.1.11
timeoutxlate3:
00:
00
timeoutconn1:
00:
00half-closed0:
10:
00udp0:
02:
00icmp0:
00:
02
timeoutsunrpc0:
10:
00h3230:
05:
00h2251:
00:
00mgcp0:
05:
00mgcp-pat0:
05:
00
timeoutsip0:
30:
00sip_media0:
02:
00sip-invite0:
03:
00sip-disconnect0:
02:
00
timeoutsip-provisional-media0:
02:
00uauth0:
05:
00absolute
timeouttcp-proxy-reassembly0:
01:
00
dynamic-access-policy-recordDfltAccessPolicy
nosnmp-serverlocation
nosnmp-servercontact
snmp-serverenabletrapssnmpauthenticationlinkuplinkdowncoldstartwarmstart
cryptoipsecikev2ipsec-proposalyeslab-proposal
protocolespencryption3des
protocolespintegritysha-1
cryptomapyeslab-map10matchaddressyeslab-vpn
cryptomapyeslab-map10setpeer202.100.2.10
cryptomapyeslab-map10setikev2ipsec-proposalyeslab-proposal
cryptomapyeslab-mapinterfaceOutside
cryptoikev2policy10
encryption3des
integritysha
group2
prfsha
lifetimeseconds86400
cryptoikev2enableOutside
telnettimeout5
sshtimeout5
consoletimeout0
threat-detectionbasic-threat
threat-detectionstatisticsaccess-list
nothreat-detectionstatisticstcp-intercept
tunnel-group202.100.2.10typeipsec-l2l
tunnel-group202.100.2.10ipsec-attributes
ikev2remote-authenticationpre-shared-key0asa1-remote
ikev2local-authenticationpre-shared-key0asa1-local
!
class-mapinspection_default
matchdefault-inspection-traffic
!
!
policy-maptypeinspectdnspreset_dns_map
parameters
message-lengthmaximumclientauto
message-lengthmaximum512
policy-mapglobal_policy
classinspection_default
inspectdnspreset_dns_map
inspectftp
inspecth323h225
inspecth323ras
inspectrsh
inspectrtsp
inspectesmtp
inspectsqlnet
inspectskinny
inspectsunrpc
inspectxdmcp
inspectsip
inspectnetbios
inspecttftp
inspectip-options
!
service-policyglobal_policyglobal
prompthostnamecontext
Cryptochecksum:
2f71706149011ae8036c4bb3edd8d6f6
:
end
----------------------------------------------------------------
hostnameASA2
enablepassword8Ry2YjIyt7RRXU24encrypted
passwd2KFQnbNIdI.2KYOUencrypted
names
!
interfaceEthernet0/0
nameifOutside
security-level0
ipaddress202.100.2.10255.255.255.0
!
interfaceEthernet0/1
nameifInside
security-level100
ipaddress192.168.1.10255.255.255.0
!
interfaceEthernet0/2
shutdown
nonameif
nosecurity-level
noipaddress
!
interfaceEthernet0/3
shutdown
nonameif
nosecurity-level
noipaddress
!
interfaceManagement0/0
shutdown
nonameif
nosecurity-level
noipaddress
management-only
!
ftpmodepassive
access-listyeslab-vpnextendedpermitip192.168.1.0255.255.255.010.1.1.0255.255.255.0
pagerlines24
loggingenable
mtuOutside1500
mtuInside1500
nofailover
icmpunreachablerate-limit1burst-size1
noasdmhistoryenable
arptimeout14400
routeOutside0.0.0.00.0.0.0202.100.2.11
timeoutxlate3:
00:
00
timeoutconn1:
00:
00half-closed0:
10:
00udp0:
02:
00icmp0:
00:
02
timeoutsunrpc0:
10:
00h3230:
05:
00h2251:
00:
00mgcp0:
05:
00mgcp-pat0:
05:
00
timeoutsip0:
30:
00sip_media0:
02:
00sip-invite0:
03:
00sip-disconnect0:
02:
00
timeoutsip-provisional-media0:
02:
00uauth0:
05:
00absolute
timeouttcp-proxy-reassembly0:
01:
00
dynamic-access-policy-recordDfltAccessPolicy
nosnmp-serverlocation
nosnmp-servercontact
snmp-serverenabletrapssnmpauthenticationlinkuplinkdowncoldstartwarmstart
cryptoipsecikev2ipsec-proposalyeslab-proposal
protocolespencryption3des
protocolespintegritysha-1
cryptomapyeslab-map10matchaddressyeslab-vpn
cryptomapyeslab-map10setpeer202.100.1.10
cryptomapyeslab-map10setikev2ipsec-proposalyeslab-proposal
cryptomapyeslab-mapinterfaceOutside
cryptoikev2policy10
encryption3des
integritysha
group2
prfsha
lifetimeseconds86400
cryptoikev2enableOutside
telnettimeout5
sshtimeout5
consoletimeout0
threat-detectionbasic-threat
threat-detectionstatisticsaccess-list
nothreat-detectionstatisticstcp-intercept
webvpn
anyconnect-essentials
tunnel-group202.100.1.10typeipsec-l2l
tunnel-group202.100.1.10ipsec-attributes
ikev2remote-authenticationpre-shared-key0asa1-local
ikev2local-authenticationpre-shared-key0asa1-remote
!
class-mapinspection_default
matchdefault-inspection-traffic
!
!
policy-maptypeinspectdnspreset_dns_map
parameters
message-lengthmaximumclientauto
message-lengthmaximum512
policy-mapglobal_policy
classinspection_default
inspectdnspreset_dns_map
inspectftp
inspecth323h225
inspecth323ras
inspectrsh
inspectrtsp
inspectesmtp
inspectsqlnet
inspectskinny
inspectsunrpc
inspectxdmcp
inspectsip
inspectnetbios
inspecttftp
inspectip-options
!
service-policyglobal_policyglobal
prompthostnamecontext
Cryptochecksum:
f25f81615f8341e85e95b9a8eb459e74
:
end
======================================预共享密钥加证书认证============================
hostnameASA1
enablepassword8Ry2YjIyt7RRXU24encrypted
passwd2KFQnbNIdI.2KYOUencrypted
names
!
interfaceEthernet0/0
nameifOutside
security-level0
ipaddress202.100.1.10255.255.255.0
!
interfaceEthernet0/1
nameifInside
security-level100
ipaddress10.1.1.10255.255.255.0
!
interfaceEthernet0/2
shutdown
nonameif
nosecurity-level
noipaddress
!
interfaceEthernet0/3
shutdown
nonameif
nosecurity-level
noipaddress
!
interfaceManagement0/0
shutdown
nonameif
nosecurity-level
noipaddress
management-only
!
ftpmodepassive
clocktimezoneGMT8
access-listyeslab-vpnextendedpermitip10.1.1.0255.255.255.0192.168.1.0255.255.255.0
pagerlines24
loggingenable
mtuOutside1500
mtuInside1500
nofailover
icmpunreachablerate-limit1burst-size1
noasdmhistoryenable
arptimeout14400
routeOutside0.0.0.00.0.0.0202.100.1.11
timeoutxlate3:
00:
00
timeoutconn1:
00:
00half-closed0:
10:
00udp0:
02:
00icmp0:
00:
02
timeoutsunrpc0:
10:
00h3230:
05:
00h2251:
00:
00mgcp0:
05:
00mgcp-pat0:
05:
00
timeoutsip0:
30:
00sip_media0:
02:
00sip-invite0:
03:
00sip-disconnect0:
02:
00
timeoutsip-provisional-media0:
02:
00uauth0:
05:
00absolute
timeouttcp-proxy-reassembly0:
01:
00
dynamic-access-policy-recordDfltAccessPolicy
nosnmp-serverlocation
nosnmp-servercontact
snmp-serverenabletrapssnmpauthenticationlinkuplinkdowncoldstartwarmstart
cryptoipsecikev2ipsec-proposalyeslab-proposal
protocolespencryption3des
protocolespintegritysha-1
cryptomapyeslab-map10matchaddressyeslab-vpn
cryptomapyeslab-map10setpeer202.100.2.10
cryptomapyeslab-map10setikev2ipsec-proposalyeslab-proposal
cryptomapyeslab-map10settrustpointCA------注意此配置
cryptomapyeslab-mapinterfaceOutside
cryptocatrustpointCA
enrollmenturlhttp:
//202.100.1.1:
80
subject-namecn=ASA
serial-number
crlconfigure
cryptocacertificatechainCA
certificate02
3082023a308201a3a003020102020102300d06092a864886f70d010104050030
1e311c301a06035504031313496e7465726e65742e7965736c61622e6e657430
1e170d3131303631353038333532345a170d3132303631343038333532345a30
43311830160603550403130f415341312e7965736c61622e6e65743127301106
092a864886f70d01090216044153413130120603550405130b4a4d5831343338
4c31344530819f300d06092a864886f70d010101050003818d00308189028181
00a8e60c5f2a1476da7b421d48416ca1dcb4af20076c83d7de64fa114839e0d1
dee006b1a9de2a64d969bf51528098d1e449e8b5f4267122e4980566c6d84a85
3f0c66aefc3e7b93165f2e9a3b851d82e7a63ceb1859a3a49149a0cb35f38e47
7bc4161e3080720d91ef3587a8f6020ab17fda3ba2cce79353415c299172ea3d
350203010001a3633061300f0603551d1104083006820441534131300e060355
1d0f0101ff0404030205a0301f0603551d23041830168014d0819152f47c8c60
6249149d5818bd1381fed687301d0603551d0e0416041495fe643b27e6a36f3b
63e2043f24db5e2ba45795300d06092a864886f70d0101040500038181007774
18d8057bab15a02a84348fcdaed985d01e6058a1340a50c8c3393150a3810149
dc30141795af943c9cfe848408d3719aba6d5a7989659f0d5337c9a3541b5fe8
60a2beb08d40ab0f5dff2f882ab5bb892953b8f2200e342bda12a162db962bed
f9f738fdc463acfb1a871249649cd2ac1636d675985cc54a7918fa96cb60
quit
certificateca01
308202153082017ea003020102020101300d06092a864886f70d010104050030
1e311c301a060355040313
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- ASA84 VPN试验系列四诡异的IKEv2 L2L VPN 试验 系列 诡异 IKEv2
![提示](https://static.bdocx.com/images/bang_tan.gif)