IPSec site-PIX-site

最新推荐文章于 2017-11-15 14:46:00 发布

原创最新推荐文章于 2017-11-15 14:46:00 发布 · 684 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#interface #authentication #cisco

cisco 专栏收录该内容

122 篇文章

订阅专栏

本文配置了R4与R5之间的IPSec隧道，使用Loopback0接口的地址进行身份验证，并通过PIX防火墙进行中转。配置包括ISAKMP策略、IPSec转换集、访问控制列表等。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Lab Target: Site-to-Site between R4 and R5 Lo0 over PIX

hostname r4

crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 45.1.1.5
!
!
crypto ipsec transform-set test esp-aes esp-md5-hmac
!
crypto map test 10 ipsec-isakmp
set peer 45.1.1.5
set transform-set test
match address 100

interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface Ethernet0/0
ip address 47.1.1.4 255.255.255.0
half-duplex
crypto map test

ip route 20.1.1.0 255.255.255.0 47.1.1.7
ip route 45.1.1.0 255.255.255.0 47.1.1.7
!

access-list 100 permit ip 10.1.1.0 0.0.0.255 20.1.1.0 0.0.0.255
!
----------------------------------------------
hostname r5

crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 45.1.1.10
!
!
crypto ipsec transform-set test esp-aes esp-md5-hmac
!
crypto map test 1 ipsec-isakmp
set peer 45.1.1.10
set transform-set test
match address 100
!
!
!
!
interface Loopback0
ip address 20.1.1.1 255.255.255.0
!
interface Ethernet1/0
ip address 45.1.1.5 255.255.255.0
half-duplex
crypto map test

access-list 100 permit ip 20.1.1.0 0.0.0.255 10.1.1.0 0.0.0.255
------------------------------------------
hostname pix
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 45.1.1.7 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 47.1.1.7 255.255.255.0

passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list test extended permit udp host 45.1.1.5 host 45.1.1.10 eq isakmp
access-list test extended permit esp host 45.1.1.5 host 45.1.1.10
access-list test extended permit udp host 45.1.1.5 host 45.1.1.10 eq 4500

static (inside,outside) 45.1.1.10 47.1.1.4 netmask 255.255.255.255
access-group test in interface outside
route outside 20.1.1.0 255.255.255.0 45.1.1.5 1
route inside 10.1.1.0 255.255.255.0 47.1.1.4 1