Cisco SSL VPN 配置实例.docx
- 文档编号:6460056
- 上传时间:2023-01-06
- 格式:DOCX
- 页数:14
- 大小:431.62KB
Cisco SSL VPN 配置实例.docx
《Cisco SSL VPN 配置实例.docx》由会员分享,可在线阅读,更多相关《Cisco SSL VPN 配置实例.docx(14页珍藏版)》请在冰豆网上搜索。
CiscoSSLVPN配置实例
CiscoSSLVPN配置实例
2009-7-27星期一8:
33
注意:
这里的配置是SSLVPN的隧道模式
一、网络拓扑图
二、SSLVPNServer配置
软件版本:
CiscoIOSSoftware,7200Software(C7200-ADVSECURITYK9-M),Version12.4(9)T1,RELEASESOFTWARE(fc2)
VPN客户端软件:
sslclient-win-1.1.2.169.pkg
1、格式化disk0
R1#formatdisk0:
Formatoperationmaytakeawhile.Continue?
[confirm]
Formatoperationwilldestroyalldatain"disk0:
". Continue?
[confirm]
Format:
Drivecommunication&1stSectorWriteOK...
WritingMonlibsectors.
..............................................................................................................................................
Monlibwritecomplete
Format:
Allsystemsectorswritten.OK...
Format:
Totalsectorsinformattedpartition:
8009
Format:
Totalbytesinformattedpartition:
4100608
Format:
Operationcompletedsuccessfully.
Formatofdisk0complete
2、上传软件
R1#copytftpdisk0:
Addressornameofremotehost[]?
192.168.10.100
Sourcefilename[]?
sslclient-win-1.1.2.169.pkg
Destinationfilename[sslclient-win-1.1.2.169.pkg]?
Accessingtftp:
//192.168.10.100/sslclient-win-1.1.2.169.pkg...
Loadingsslclient-win-1.1.2.169.pkgfrom192.168.10.100(viaFastEthernet0/0):
!
!
[OK-415090bytes]
415090bytescopiedin12.892secs(32197bytes/sec)
3、安装client软件
R1(config)#webvpninstallsvcdisk0:
/sslclient-win-1.1.2.169.pkg
SSLVPNPackageSSL-VPN-Client:
installedsuccessfully
4、配置SSLVPN
R1(config)#aaanew-model
R1(config)#aaaauthenticationlogindefaultlocal //为防止控制台超时而造成无法进入Exec
R1(config))#aaaauthenticationloginwebvpnlocal
R1(config)#iplocalpoolssl-add11.1.1.1011.1.1.20
R1(config)#usernameuser1password123 //定义WebVPN本地认证用户名,密码
R1(config))#webvpngatewayvpngateway//定义WebVPN在哪个接口上进行监听,此时IOS会自动产生自签名证书。
R1(config-webvpn-gateway)#ipaddress192.168.10.10port443
R1(config-webvpn-gateway)#inservice//启用webvpngateway配置
R1(config)#webvpncontextwebcontext //定义webvpn的相关配置,相当于ASA的tunnel-group,在这里可以定义
R1(config-webvpn-context)#gatewayvpngateway//将context和gateway相关联
R1(config-webvpn-context)#aaaauthenticationlistwebvpn
R1(config-webvpn-context)#inservice//启用webvpncontext配置
R1(config-webvpn-context)#policygroupsslvpn-policy//进入sslvpn策略组
R1(config-webvpn-group)#functionssvc-enabled
R1(config-webvpn-group)#svcaddress-poolssl-add//分配svc使用的地址池
R1(config-webvpn-group)#svcsplitinclude192.168.20.0255.255.255.0//定义隧道分离的目标地址,如果不配置,则默认为0.0.0.0
R1(config-webvpn-group)#exit
R1(config-webvpn-context)#default-group-policysslvpn-policy//当配置了多个policygroup后,默认使用的策略组
注意:
在IOS中,如果地址池不和内网在一个段,则需创建一个和地址池在同一网段的loopback接口作为vpn客户端的网关。
还可以在context中指定virtual-host,类似于iis中的文件头,允许多个主机映射到同一个IP地址
同时context中还可以设置web登陆框的样式,比如logo,title等5、完整配置
R1#showrunning-config
Buildingconfiguration...
Currentconfiguration:
3223bytes
!
version12.4
servicetimestampsdebugdatetimemsec
servicetimestampslogdatetimemsec
noservicepassword-encryption
!
hostnameR1
!
boot-start-marker
boot-end-marker
!
!
aaanew-model
!
!
aaaauthenticationlogindefaultlocal
aaaauthenticationloginwebvpnlocal
!
aaasession-idcommon
!
resourcepolicy
!
ipcef
!
!
!
cryptopkitrustpointTP-self-signed-4294967295
enrollmentselfsigned
subject-namecn=IOS-Self-Signed-Certificate-4294967295
revocation-checknone
rsakeypairTP-self-signed-4294967295
!
!
cryptopkicertificatechainTP-self-signed-4294967295
certificateself-signed01
3082023A308201A3A003020102020101300D06092A864886F70D010104050030
31312F302D06035504031326494F532D53656C662D5369676E65642D43657274
696669636174652D34323934393637323935301E170D30383132313531393039
30335A170D3230303130313030303030305A3031312F302D0603550403132649
4F532D53656C662D5369676E65642D43657274696669636174652D3432393439
363732393530819F300D06092A864886F70D010101050003818D003081890281
8100C6F2B499879D1CEB3638BA59B459A72167BBFDD2CD733E3E6FB6
D1347E43
8CC21C65BAC01E285001349771CF8062C54F254CA6DB2D5ACDDB864D
CFF71A50
F3C205661405E49B18CE2DAB469C58E85B4A1FD659DCBCA512A34543
4F6842B6
24B9A7BDCE36E98AA5463EB32D2C5BC0FAA247C1E44DB4554537465F
18895A14
66D10203010001A3623060300F0603551D130101FF040530030101FF300D0603
551D110406300482025231301F0603551D230418301680149F7F1B46F6903BC5
803F4AD72433EBD05813E29D301D0603551D0E041604149F7F1B46F6
903BC580
3F4AD72433EBD05813E29D300D06092A864886F70D01010405000381
81002516
3F75E2AA335441139A9179DBDFED2529DF5A972FC2BFDE0E0279D1F5
8D30CAC7
59BE79C685825281AB2D0B082CA84D0185A4DB198977BC829E59F764
ADE75E22
9A7FF37A9D83819A2287BE75773FAA32D38DD3C22C0DF23F7D45D7A3
E8006C1A
6B9E0540124832416EEAA0FFB31240F394044BCB75210037FEF5AD15F49B
quit
usernameuser1password0123
!
!
!
!
!
!
interfaceLoopback0
ipaddress11.1.1.1255.255.255.0
!
interfaceFastEthernet0/0
ipaddress192.168.10.10255.255.255.0
duplexhalf
!
interfaceSerial1/0
ipaddress10.1.1.1255.255.255.0
serialrestart-delay0
!
interfaceSerial1/1
noipaddress
shutdown
serialrestart-delay0
!
interfaceSerial1/2
noipaddress
shutdown
serialrestart-delay0
!
interfaceSerial1/3
noipaddress
shutdown
serialrestart-delay0
!
routerrip
version2
network10.0.0.0
network11.0.0.0
network192.168.10.0
noauto-summary
!
iplocalpoolssl-add11.1.1.1011.1.1.20
noiphttpserver
noiphttpsecure-server
!
!
!
loggingalarminformational
!
!
!
!
!
control-plane
!
!
linecon0
exec-timeout00
stopbits1
lineaux0
stopbits1
linevty04
!
!
webvpngatewayvpngateway
ipaddress192.168.10.10port443
ssltrustpointTP-self-signed-4294967295
inservice
!
webvpninstallsvcdisk0:
/webvpn/svc.pkg
!
webvpncontextwebcontext
sslauthenticateverifyall
!
!
policygroupsslvpn-policy
functionssvc-enabled
svcaddress-pool"ssl-add"
svcsplitinclude192.168.20.0255.255.255.0
default-group-policysslvpn-policy
aaaauthenticationlistwebvpn
gatewayvpngatewaydomainsshvpn
inservice
!
!
end
R2#showrunning-config
Buildingconfiguration...
Currentconfiguration:
973bytes
!
version12.4
servicetimestampsdebugdatetimemsec
servicetimestampslogdatetimemsec
noservicepassword-encryption
!
hostnameR2
!
boot-start-marker
boot-end-marker
!
!
noaaanew-model
!
resourcepolicy
!
ipcef
!
!
!
!
!
!
interfaceLoopback1
ipaddress22.1.1.1255.255.255.0
!
interfaceFastEthernet0/0
ipaddress192.168.20.10255.255.255.0
duplexhalf
!
interfaceSerial1/0
ipaddress10.1.1.2255.255.255.252
serialrestart-delay0
!
interfaceSerial1/1
noipaddress
shutdown
serialrestart-delay0
!
interfaceSerial1/2
noipaddress
shutdown
serialrestart-delay0
!
interfaceSerial1/3
noipaddress
shutdown
serialrestart-delay0
!
routerrip
version2
network10.0.0.0
network22.0.0.0
network192.168.20.0
noauto-summary
!
noiphttpserver
noiphttpsecure-server
!
!
!
loggingalarminformational
!
!
!
!
!
control-plane
!
!
linecon0
exec-timeout00
stopbits1
lineaux0
stopbits1
linevty04
!
!
end
三、客户端配置
在浏览器中输入https:
//192.168.10.10/访问WebVPN,这时会弹出提示信息,点击“确定”
需要安装证书,点击“是”,这里第一个感叹号是因为这个证书只路由器自签发的,没有经过验证,而第二个感叹号是因为配置WebVPN时应该注意证书颁发后的证书的有效期,往往颁发证书时的有有效期限时间会比当前时间晚一二天
这时会弹出网页,输入用户和密码,点击login
这时会自动安装SSLVPNClient软件
需要点击允许安装ACTIVE控件,会弹出安装界面,点击安装
正在进行SSLVPNClient
点击安装证书
安装证书之后,这样VPN连接就建立起来,在屏幕的右下部会显示出黄色的小钥匙的标志
四、验证配置
在客户端上可以查看VPN的状态。
可以查看VPN隧道的分离子网。
使用ipconfig命令可以查看到获得的地址。
查看路由表,可以看到一条指向192.168.20.0的路由条目
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- Cisco SSL VPN 配置实例 配置 实例