您的位置:计世网>软件>>安全/网络>pix站到站点ipsecVPN配置

pix站到站点ipsecVPN配置

发布时间:2013-04-25 13:08:59 来源:中国IT实验室

pix站到站点ipsecVPN配置

  前提:没有加密通道前,数据能够正常交流。

  Step1: 允许pix 外口进来的ipsec数据流

  Pix(config)#access-list out_in permit 50 any host 222.254.240.193

  Pix(config)#access-list out_in permit 51 any host 222.254.240.193

  Pix(config)#access-list out_in permit udp any host 222.254.240.193 eq 500

  Sysopt connection permit-ipsec 更简略的方式,只需一条

  Step2: 外口启用ISAKMP

  Pix1(config)#isakmp enable outside

  Pix2(config)#isakmp enable outside

  Step3: 配置IKE策略参数

  Isakmp policy 10 encryption 3des

  Isakmp policy 10 hash md5

  Isakmp policy 10 group 2

  Isakmp policy 10 lifetime 2400

  Isakmp policy 10 autentication pre-share

  (Isakmp policy 10 autentication rsa-sig) 启用RSA数字签名认证(缺省)

  pix#show isakmp policy 查看策略

  step4: 定义预共享密钥

  pix1(config)#isakmp key mykey address 202.103.96.112 netmask 255.255.255.255

  pix2(config)#isakmp key mykey address 222.254.240.193 netmask 255.255.255.255

  pix(config)#isakmp key pubkey address 0.0.0.0 netmask 0.0.0.0 ( 所有通道peer都共享同一密钥)

  step5: 定义加密数据流ACL

  pix1(config)#

  access-list crypto_date permit 192.168.1.1 255.255.255.0 192.168.2.0 255.255.255.0

  pix2(config)#

  access-list crypto_date permit 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

  step6: 定义转换集合 transform set 两边配置一样

  pix1(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac

  pix2(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac

  pix1(config)# show crypto ipsec transform-set

  step7: NAT 的问题

  pix1(config)# nat 0 access-list cryto_date

  pix2(config)# nat 0 access-list cryto_date

  step8: 配置加密图 连接policy+transform-set+peer address

  pix1(config)# crypto map pix1map 10 ipsec-isakmp

  pix1(config)# crypto map pix1map 10 match address crypto_date

  pix1(config)# crypto map pix1map 10 set peer 202.103.96.112

  pix1(config)# crypto map pix1map 10 set transform-set myset

  pix2(config)# crypto map pix2map 10 ipsec-isakmp

  pix2(config)# crypto map pix1map 10 match address crypto_date

  pix2(config)# crypto map pix1map 10 set peer 222.240.254.193

  pix2(config)# crypto map pix1map 10 set transform-set myset

  step 9: 绑定加密图到接口

  pix1(config)# crypto map pix1map interface outside

  pix2(config)# crypto map pix2map interface outside

  pix1#show crypto map

  pix1#show crypto ipsec sa

本文关键词:pix,ipsecVPN配置