cisco asa 5525 思科防火墙设置拨号访问内网以及外网

 

WZ-2A10-SAS5525-0938# show running-config 
: Saved

: 
: Serial Number: FCH17307098
: Hardware:   ASA5525, 8192 MB RAM, CPU Lynnfield 2394 MHz, 1 CPU (4 cores)
:
ASA Version 9.8(2) 
!
hostname WZ-2A10-SAS5525-0938
enable password $sha512$5000$HztVSx0o3cSsFEoY7TKS8A==$lJrGN+VDV6hYZDCSxnx4SQ== pbkdf2
names
ip local pool vpnpool 10.254.232.1-10.254.232.254 mask 255.255.255.0
ip local pool idcicpvpnpool 192.168.41.100-192.168.41.199 mask 255.255.255.0     ######vpn本地地址池，自定义名字和ip段

!
interface GigabitEthernet0/0
 description To:2A10-0457-G1/0/41  
 nameif outside                                       ###定义为外部区域外网
 security-level 0                                       ###level  0-100 ，值越大，区域代表越安全，这是外网区域所以是0
 ip address 173.248.xxx.xx 255.255.xxx.xxx 
!
interface GigabitEthernet0/1
 description To:2A10-0457-G1/0/42
 nameif inside                                         ###定义为内部区域内网，
 security-level 100
 ip address 10.2.32.1 255.255.255.0 
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 nameif management                    ###这是管理口，网线口
 security-level 100
 ip address 192.168.232.1 255.255.255.0 
!
ftp mode passive
same-security-traffic permit intra-interface      ####默认防火墙是不允许同个接口（比如outside进outside出，会被定义为异常流量），这命令开启同个接口区域进出
object network in-net
 subnet 10.2.32.0 255.255.255.248
object network remote-net1
object network vpn-net
 subnet 10.254.232.0 255.255.255.0
object network idcicpvpn-net                               ###这些是nat地址段
 subnet 192.168.41.0 255.255.255.0
access-list vpn-traffic standard permit 10.2.32.0 255.255.255.0 
access-list topnet extended permit ip any host 10.2.32.2 
access-list topnet extended permit ip any host 10.2.32.3 
access-list topnet extended permit ip any host 10.2.32.4 
access-list topnet extended permit icmp any any 
access-list no-nat extended permit ip 10.2.32.0 255.255.255.0 192.168.41.0 255.255.255.0     ###创建兴趣流（即inside内网口访问vpn-pool地址池网段），对应到不做nat规则。相当于inside内网网段可以直接访问从vpn拨入进来的地址网段
pager lines 24
logging enable
logging timestamp
logging buffer-size 102400
logging buffered warnings
logging asdm informational
logging host outside 173.248.xxx.xxx ##这个地址设置和snmp一致
mtu outside 1500
mtu inside 1500
mtu management 1500
no failover
no monitor-interface service-module 
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source static in-net in-net destination static vpn-net vpn-net route-lookup
nat (inside,outside) source static in-net in-net destination static idcicpvpn-net idcicpvpn-net route-lookup   ###将之前定义的兴趣流设置为不NAT，这样才能保证正常访问内网网段，设置到这vpn拨号后获得vpn-pool地址池ip已经可以和inside内网通讯了
!
object network in-net
 nat (inside,outside) dynamic interface
object network idcicpvpn-net
 nat (outside,outside) dynamic interface    ####需要拨号访问外网google的设置都是outside，进出都是外网。
access-group topnet in interface outside
route outside 0.0.0.0 0.0.0.0 173.248.xxx.xxx 1   ###这是默认路由
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL 
aaa authentication login-history
snmp-server host outside 173.248.xx.xx community ***** version 2c   ###设置指定ip可以snmp
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set vpnset esp-3des esp-md5-hmac 
crypto ipsec ikev1 transform-set idcicpvpnset esp-3des esp-md5-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map dymap 50000 set ikev1 transform-set vpnset
crypto dynamic-map dymap 50000 set security-association lifetime seconds 86400    
crypto dynamic-map dymap 50000 set reverse-route
crypto dynamic-map idcicpdymap 50001 set ikev1 transform-set idcicpvpnset
crypto dynamic-map idcicpdymap 50001 set security-association lifetime seconds 86400    ###备默认配置
crypto dynamic-map idcicpdymap 50001 set reverse-route                                                          ###代表这个路由从哪里就从哪里去
crypto map vpnmap 10000 ipsec-isakmp dynamic dymap
crypto map vpnmap 10001 ipsec-isakmp dynamic idcicpdymap                                         #### 静态map只能一个，不像上面动态地图随意创建，这边创建了vpnmap后，优先级ID为10，静态地图可对应多个动态的地图，设立不同优先级即可。
crypto map vpnmap interface outside                                                                             ##将静态地图应用到出接口outside
crypto ca trustpool policy
crypto ikev1 enable outside                                                                                           ## 出接口使能ikev1(或者其他版本isakmp)
crypto ikev1 policy 10
 authentication pre-share                                                                                       #### 认证方式预共享密钥
 encryption 3des
 hash md5
 group 2
 lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 173.248.x.0 255.255.255.0 outside 设置指定段可以ssh远程
ssh 0.0.0.0 0.0.0.0 management
ssh timeout 10
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy mygroup internal                                  //隧道分离的策略，有三种，这里选择隧道指定分离
group-policy mygroup attributes
 dns-server value 8.8.8.8
 vpn-idle-timeout 720
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value vpn-traffic                        //与前面acl列表匹配的流量，才会加入到VPN隧道中。
group-policy idcicpgrouppolicy internal                           ##建立组策略mygrouppolicy
group-policy idcicpgrouppolicy attributes
 dns-server value 8.8.8.8                                                       ###定义分配dns参数
 vpn-idle-timeout 1800
 split-tunnel-policy tunnelall                                                      ###设置隧道不分流，指所有流量j加入隧道，这个组策略用来上外网的，不同于另一个组策略mygroup 
dynamic-access-policy-record DfltAccessPolicy
username test01 password $sha512$5000$fmWat2hp9BXoMCdrxH3O2g==$4P78z0G/ZPXZKTdVusCP3A== pbkdf2
username hydz01 password $sha512$5000$BwTlllmTZC6K7xQrHAAYyg==$gOgaxlaxp2q7BVD8t/l58w== pbkdf2
username admin password $sha512$5000$kVWg+pCWjCdGFWJ74Z+Uew==$2ra3lBuFlpAdEJjsxT0sIg== pbkdf2
username topdata password $sha512$5000$/LpLPZcYgLv9U0t4jI2yeA==$s1wfz4vTvKhj35NLgv7lxQ== pbkdf2 privilege 15
tunnel-group hangyidianzi type remote-access
tunnel-group hangyidianzi general-attributes
 address-pool vpnpool
 default-group-policy mygroup
tunnel-group hangyidianzi ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 300 retry 5
tunnel-group idcicpmygroup type remote-access                      ###创建隧道组
tunnel-group idcicpmygroup general-attributes                        
 address-pool idcicpvpnpool                                                    ### 指定关联到之前定义的地址池
 default-group-policy idcicpgrouppolicy                                    ####默认组策略引用idcicpgrouppolicy                                    
tunnel-group idcicpmygroup ipsec-attributes
 ikev1 pre-shared-key *****                                                         ###组密钥，登录的时候需要用到
 isakmp keepalive threshold 301 retry 5
!
!             
prompt hostname context 
no call-home reporting anonymous
Cryptochecksum:888d6f380050265e5c38fb64a5d4b5cb
: end
WZ-2A10-SAS5525-0938#  

 

 

ASA5520 remote ipsec vpn配置

 
接口启用ISAKMP：
crypto isakmp enable outside
crypto isakmp enable outside2

创建ISAKMP策略：
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200

定义组策略1：
group-policy vpnclient_policy internal
group-policy vpnclient_policy attributes
dns-server value 10.75.131.65 219.148.204.66
group-lock value it@lncrland
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn-split-tunnel

定义组策略2：
group-policy ipsec_vpn_policy internal
group-policy ipsec_vpn_policy attributes
dns-server value 10.75.131.65 219.148.204.66
group-lock value lncrland
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn-split-tunnel

定义radius服务器：
aaa-server ipsec_vpn_auth protocol radius
aaa-server ipsec_vpn_auth (inside) host 10.75.131.199
key *****

定义地址池：
ip local pool ipsec_vpn_pool 10.75.133.1-10.75.133.254 mask 255.255.254.0
ip local pool it_vpn_pool 10.75.132.101-10.75.132.255 mask 255.255.254.0

定义隧道分离内容：
access-list vpn-split-tunnel standard permit 172.17.0.0 255.255.0.0
access-list vpn-split-tunnel standard permit 172.16.0.0 255.255.0.0
access-list vpn-split-tunnel standard permit 10.0.0.0 255.0.0.0
access-list vpn-split-tunnel standard permit 192.200.40.0 255.255.255.0
access-list vpn-split-tunnel standard permit 172.20.0.0 255.255.0.0
access-list vpn-split-tunnel standard permit 172.18.0.0 255.255.0.0
access-list vpn-split-tunnel standard permit 172.19.0.0 255.255.0.0
access-list vpn-split-tunnel standard permit 172.21.0.0 255.255.0.0

定义隧道组（连接配置文件）1：
tunnel-group it@lncrland type remote-access
tunnel-group it@lncrland general-attributes
address-pool it_vpn_pool
authentication-server-group ipsec_vpn_auth LOCAL
default-group-policy vpnclient_policy
tunnel-group it@lncrland ipsec-attributes
pre-shared-key *****

定义隧道组（连接配置文件）2：
tunnel-group lncrland type remote-access
tunnel-group lncrland general-attributes
address-pool ipsec_vpn_pool
authentication-server-group ipsec_vpn_auth LOCAL
default-group-policy ipsec_vpn_policy
tunnel-group lncrland ipsec-attributes
pre-shared-key *****
!

定义ipsec策略：
crypto ipsec transform-set FirstSet esp-3des esp-md5-hmac

定义动态加密集：
crypto dynamic-map dyn1 1 set transform-set FirstSet
crypto dynamic-map dyn1 1 set reverse-route
定义静态加密集：
crypto map mymap 1 ipsec-isakmp dynamic dyn1
应用静态加密集：
crypto map mymap interface outside
crypto map mymap interface outside2


排故命令：
show vpn-sessiondb detail