flm_happy的博客

ASA防火墙上vpn配置技巧

热9已有 295 次阅读 2012-04-28 10:41 标签: 防火墙配置技巧

今天给大家介绍一个ASA防火墙上vpn的配置技巧，

在ASA的全局模式下有个命令，可以产看系统给出的vpn配置步骤及参考命令，命令如下

asa5510(config)# vpnsetup ?

configure mode commands/options:
ipsec-remote-access Display IPSec Remote Access Configuration Commands
l2tp-remote-access   Display L2TP/IPSec Configuration Commands
site-to-site         Display IPSec Site-to-Site Configuration Commands
ssl-remote-access    Display SSL Remote Access Configuration Commands
asa5510(config)# vpnsetup ipsec-remote-access ?

configure mode commands/options:
steps Display VPN Setup Commands
asa5510(config)# vpnsetup ipsec-remote-access steps

asa5510(config)# vpnsetup ipsec-remote-access steps

Steps to configure a remote access IKE/IPSec connection with examples:

1. Configure Interfaces

        interface GigabitEthernet0/0
         ip address 10.10.4.200 255.255.255.0
         nameif outside
         no shutdown

        interface GigabitEthernet0/1
         ip address 192.168.0.20 255.255.255.0
         nameif inside
         no shutdown

2. Configure ISAKMP policy

        crypto isakmp policy 65535
         authentication pre-share
         encryption aes
         hash sha

3. Setup an address pool

ip local pool client-pool 192.168.1.1-192.168.1.254

4. Configure authentication method

        aaa-server MyRadius protocol radius
        aaa-server MyRadius host 192.168.0.254
         key $ecretK3y

5. Define tunnel group

        tunnel-group client type remote-access
        tunnel-group client general-attributes
         address-pool client-pool
         authentication-server-group MyRadius
        tunnel-group client ipsec-attributes
         pre-shared-key VpnUs3rsP@ss

6. Setup ipsec parameters

crypto ipsec transform-set myset esp-aes esp-sha-hmac

7. Setup dynamic crypto map

crypto dynamic-map dynmap 1 set transform-set myset
crypto dynamic-map dynmap 1 set reverse-route

8. Create crypto map entry and associate dynamic map with it

crypto map mymap 65535 ipsec-isakmp dynamic dynmap

9. Attach crypto map to interface

crypto map mymap interface outside

10. Enable isakmp on interface

crypto isakmp enable outside

asa5510(config)#

同样的我们也可以查看ssl vpn 等的配置步骤，有了这个命令我们再也不用担心vpn的配置了。