多厂商***系列之十二：ASA Dynamic site-to-site IPSec ***

说明

1. 拓扑： 总部为固定IP ，分部为ADSL 拨号上网
2. 要求： 分部要与总部实现IPSec *** 总部经过dynamic map配置，分部静态配置便可

拓扑

3. 总部 *** 配置：

global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
【配置NAT ，内部用户能够上网】

access-list ***acl extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list ***acl extended permit ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0
nat (inside) 0 access-list nonat
【配置***的感兴趣流量以及，NAT旁路，让***的流量不走NAT】

crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400

crypto ipsec transform-set myset esp-des esp-md5-hmac

tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key ccieh3c.com
【红色部分为系统默认的组，动态L2L，必须在这下面配置】

crypto dynamic-map cisco 10 match address ***acl
crypto dynamic-map cisco 10 set transform-set myset
crypto dynamic-map cisco 10 set reverse-route
crypto map mp 10 ipsec-isakmp dynamic cisco
crypto map mp interface outside
crypto isakmp enable outside

4 . 分部*** 配置

access-list *** extended permit ip 192.168.20.0 255.255.255.0 host 192.168.1.254
access-list nonat extended permit ip 192.168.20.0 255.255.255.0 host 192.168.1.254

global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0

crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2

tunnel-group 120.1.1.1 type ipsec-l2l
tunnel-group 120.1.1.1 ipsec-attributes
pre-shared-key ccieh3c.taobao.com

crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto isakmp key cisco address 100.1.1.1

crypto map mp 1 match address ***
crypto map mp 1 set peer 100.1.1.1
crypto map mp 1 set transform-set myset
crypto map mp interface outside
crypto isakmp enable outside

基于8.4的实现与NAT旁路【只给出了重要的配置，大部分跟8.0一致】

crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
说明：与传统的8.0相同，多了一个IKEV1的参数，由于8.4之后支持IKEV2了，因此区分开来。

tunnel-group DefaultL2LGroup ipsec-attributes
ikev1 pre-shared-key ccieh3c.taobao.com
说明：这里必须使用系统默认的组来作动态L2L。

crypto ipsec ikev1 transform-set trans esp-des esp-md5-hmac
crypto dynamic-map dyl2l 1000 set ikev1 transform-set trans
crypto map l2l 1000 ipsec-isakmp dynamic dyl2l
crypto map l2l interface outside
说明：这里必须用动态map调用转换集，而后用静态map关联动态。

配置内部网络访问Internet的NAT 
object network inside
subnet 2.2.2.0 255.255.255.0
nat (inside,outside) dynamic interface

NAT旁路【让***的流量不通过NAT转换】
object network inside-***
subnet 192.168.1.0 255.255.255.0
object network outside-***1
subnet 192.168.20.0 255.255.255.0
object network outside-***2
subnet 192.168.10.0 255.255.255.0

nat (inside,outside) source static inside-*** inside-*** destination static outside-***1 outside-***1
nat (inside,outside) source static inside-*** inside-*** destination static outside-***2 outside-***2

本文转载于公众号：网络之路博客