带有NAT的PIX实现IPSec VPN连接(2)

　　interface gb-ethernet0 1000auto shutdown

　　interface gb-ethernet1 1000auto shutdown

　　interface ethernet0 10baset

　　interface ethernet1 10baset

　　mtu spare1 1500

　　mtu spare2 1500

　　mtu outside 1500

　　mtu inside 1500

　　ip address spare1 127.0.0.1 255.255.255.255

　　ip address spare2 127.0.0.1 255.255.255.255

　　!

　　!--- IP addresses on the interfaces

　　ip address outside 203.1.1.1 255.255.255.0

　　ip address inside 10.2.2.1 255.255.255.0

　　!

　　ip audit info action alarm

　　ip audit attack action alarm

　　ip local pool clientpool 10.3.3.1-10.3.3.10

　　no failover

　　failover timeout 0:00:00

　　failover poll 15

　　failover ip address spare1 0.0.0.0

　　failover ip address spare2 0.0.0.0

　　failover ip address outside 0.0.0.0

　　failover ip address inside 0.0.0.0

　　pdm history enable

　　arp timeout 14400

　　!--- global (outside) 1 203.1.1.10-203.1.1.15

　　!--- Change from NAT to PAT on DHCP interface

　　global (outside) 1 interface

　　!

　　!--- Binding ACL 100 to the NAT statement to avoid NAT on the IPSec packets

　　nat (inside) 0 access-list 100

　　!

　　nat (inside) 1 0.0.0.0 0.0.0.0 0 0

　　conduit permit icmp any any

　　!

　　!--- Default route to the Internet

　　route outside 0.0.0.0 0.0.0.0 203.1.1.2 1

　　!

　　timeout xlate 3:00:00

　　timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip

　　0:30:00 sip_media 0:02:00

　　timeout uauth 0:05:00 absolute

　　aaa-server TACACS+ protocol tacacs+

　　aaa-server RADIUS protocol radius

　　no snmp-server location

　　no snmp-server contact

　　snmp-server community public

　　no snmp-server enable traps

　　floodguard enable

　　!

　　!--- The sysopt command avoids conduit on the IPSec encrypted traffic

　　sysopt connection permit-ipsec

　　!

　　no sysopt route dnat

　　!

　　!--- Phase 2 encryption type

　　crypto ipsec transform-set myset esp-des esp-md5-hmac

　　crypto dynamic-map cisco 1 set transform-set myset

　　crypto map dyn-map 20 ipsec-isakmp dynamic cisco

　　!

　　!--- Binding the IPSec engine on the outside interface

　　crypto map dyn-map interface outside

　　!

　　!--- Enabling ISAKMP key-exchange

　　isakmp enable outside

　　!

　　!--- ISAKMP Policy for accepting dynamic connections from remote PIX

　　isakmp key ******** address 0.0.0.0 netmask 0.0.0.0

　　!--- ISAKMP Policy for Cisco VPN Client 2.x

　　isakmp policy 10 authentication pre-share

　　isakmp policy 10 encryption des

　　isakmp policy 10 hash md5

　　isakmp policy 10 group 1

　　isakmp policy 10 lifetime 1000

　　!

　　!--- ISAKMP Policy for Cisco VPN Client 3.x

　　isakmp policy 20 authentication pre-share

　　isakmp policy 20 encryption des

　　isakmp policy 20 hash sha

　　isakmp policy 20 group 2

　　isakmp policy 20 lifetime 86400

　　!

　　!--- IPSec group configuration for either client

　　vpngroup unityclient address-pool clientpool

　　vpngroup unityclient dns-server 10.1.1.3

　　vpngroup unityclient wins-server 10.1.1.3

　　vpngroup unityclient default-domain cisco.com

　　vpngroup unityclient idle-time 1800

　　vpngroup unityclient password ********

　　!

　　telnet timeout 5

　　ssh timeout 5

　　terminal width 80

　　Cryptochecksum:d6fe92db883a052c5765be21a74e7c8d

　　: end

　　[OK]

　　Tiger配置

　　Building configuration...

　　: Saved

　　:

　　PIX Version 5.3(1)

　　nameif gb-ethernet0 spare1 security10

　　nameif gb-ethernet1 spare2 security15

　　nameif ethernet0 outside security0

　　nameif ethernet1 inside security100

　　enable password 8Ry2YjIyt7RRXU24 encrypted

　　passwd 2KFQnbNIdI.2KYOU encrypted

　　hostname tiger

　　fixup protocol ftp 21

　　fixup protocol http 80

　　fixup protocol h323 1720

　　fixup protocol rsh 514

　　fixup protocol smtp 25

　　fixup protocol sqlnet 1521

　　fixup protocol sip 5060

　　names

　　!

　　!--- ACL to avoid Network Address Translation (NAT) on the IPSec packets

　　access-list 101 permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

　　!

　　pager lines 24

　　logging on

　　no logging timestamp

　　no logging standby

　　no logging console

　　no logging monitor

　　logging buffered debugging

　　no logging trap

　　no logging history

　　logging facility 20

　　logging queue 512

　　interface gb-ethernet0 1000auto shutdown

　　interface gb-ethernet1 1000auto shutdown

　　interface ethernet0 10baset

　　interface ethernet1 10baset

　　mtu spare1 1500

　　mtu spare2 1500

　　mtu outside 1500

　　mtu inside 1500

　　ip address spare1 127.0.0.1 255.255.255.255

　　ip address spare2 127.0.0.1 255.255.255.255

　　!

　　ip address outside dhcp

　　ip address inside 10.1.1.1 255.255.255.0

　　!

　　ip audit info action alarm

　　ip audit attack action alarm

　　no failover

　　failover timeout 0:00:00

　　failover poll 15

　　failover ip address spare1 0.0.0.0

　　failover ip address spare2 0.0.0.0

　　failover ip address outside 0.0.0.0

　　failover ip address inside 0.0.0.0