扫一扫
分享文章到微信
扫一扫
关注官方公众号
至顶头条
这个文档说明了在路由器和思科防火墙之间的IPSec配置。在总部和分公司之间的流量使用的是私有IP地址,当分公司的局域网用户访问互联网时,需要进行地址转换。
网络拓扑
配置
定义去路由器的流量:
access-list ipsec permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
!--- 去路由器的流量不做地址转换
access-list nonat permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
ip address outside 172.17.63.213 255.255.255.240
ip address inside 10.1.1.1 255.255.255.0
global (outside) 1 172.17.63.210
!--- 去路由器的流量不做地址转换
nat (inside) 0 access-list nonat
nat (inside) 1 10.1.1.0 255.255.255.0 0 0
conduit permit icmp any any
route outside 0.0.0.0 0.0.0.0 172.17.63.209 1
!--- IPSec 策略:
sysopt connection permit-ipsec
crypto ipsec transform-set avalanche esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600
crypto map forsberg 21 ipsec-isakmp
crypto map forsberg 21 match address ipsec
crypto map forsberg 21 set peer 172.17.63.230
crypto map forsberg 21 set transform-set avalanche
crypto map forsberg interface outside
!--- IKE 策略:
isakmp enable outside
isakmp key westernfinal2000 address 172.17.63.230 netmask 255.255.255.255
isakmp identity address
isakmp policy 21 authentication pre-share
isakmp policy 21 encryption des
isakmp policy 21 hash md5
isakmp policy 21 group 1
: end
Branch Router
hostname Branch_Router
!--- IKE策略:
crypto isakmp policy 11
hash md5
authentication pre-share
crypto isakmp key westernfinal2000 address 172.17.63.213
!--- IPSec策略:
crypto ipsec transform-set sharks esp-des esp-md5-hmac
crypto map nolan 11 ipsec-isakmp
set peer 172.17.63.213
set transform-set sharks
match address 120
!
interface Ethernet0
ip address 172.17.63.230 255.255.255.240
ip nat outside
crypto map nolan
!
interface Ethernet1
ip address 10.2.2.1 255.255.255.0
ip nat inside
!
ip nat pool branch 172.17.63.230 172.17.63.230 netmask 255.255.255.240
ip nat inside source route-map nonat pool branch overload
ip route 0.0.0.0 0.0.0.0 172.17.63.225
access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 130 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 130 permit ip 10.2.2.0 0.0.0.255 any
route-map nonat permit 10
match ip address 130
end
如果您非常迫切的想了解IT领域最新产品与技术信息,那么订阅至顶网技术邮件将是您的最佳途径之一。
现场直击|2021世界人工智能大会
直击5G创新地带,就在2021MWC上海
5G已至 转型当时——服务提供商如何把握转型的绝佳时机
寻找自己的Flag
华为开发者大会2020(Cloud)- 科技行者