ipsec *** 多对等体

最新推荐文章于 2025-03-07 13:28:44 发布

weixin_34126557

最新推荐文章于 2025-03-07 13:28:44 发布

阅读量224

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/weixin_34126557/article/details/85074495

本文深入探讨了网络架构中的关键组件配置，包括拓扑结构、路由策略、访问控制列表和安全策略设置，旨在为读者提供全面的网络设计与安全管理指南。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

实验拓扑：

---------------------R1------------------------------------------------------

crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key root address 30.1.1.1 255.255.255.0
crypto isakmp key cisco address 20.1.1.1 255.255.255.0
!
!
crypto ipsec transform-set trans esp-des esp-md5-hmac
!
crypto map smap 10 ipsec-isakmp
set peer 20.1.1.1
set transform-set trans
match address ***a
crypto map smap 20 ipsec-isakmp
set peer 30.1.1.1
set transform-set trans
match address ***b
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.0
speed 100
full-duplex
crypto map smap
!
ip route 0.0.0.0 0.0.0.0 10.1.1.10
!
ip access-list extended ***a
permit ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255
ip access-list extended ***b
permit ip 1.1.1.0 0.0.0.255 4.4.4.0 0.0.0.255

---------------------------R2------------------------------

interface FastEthernet0/0
ip address 20.1.1.10 255.255.255.0
!
interface FastEthernet0/1
ip address 30.1.1.10 255.255.255.0
!
interface FastEthernet1/0
ip address 10.1.1.10 255.255.255.0

----------------------ASA1------------------------------------

interface GigabitEthernet0
nameif outside
security-level 0
ip address 20.1.1.1 255.255.255.0
!
interface GigabitEthernet1
nameif inside
security-level 100
ip address 192.168.3.1 255.255.255.0
!
access-list ***a extended permit ip 3.3.3.0 255.255.255.0 1.1.1.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 20.1.1.10 1
route inside 0.0.0.0 0.0.0.0 192.168.3.3 tunneled
crypto ipsec ikev1 transform-set trans esp-des esp-md5-hmac
crypto map smap 10 match address ***a
crypto map smap 10 set peer 10.1.1.1
crypto map smap 10 set ikev1 transform-set trans
crypto map smap interface outside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
tunnel-group 10.1.1.1 type ipsec-l2l
tunnel-group 10.1.1.1 ipsec-attributes
ikev1 pre-shared-key cisco

------------------------------ASA2-------------------------------

interface GigabitEthernet0
nameif outside
security-level 0
ip address 30.1.1.1 255.255.255.0
!
interface GigabitEthernet1
nameif inside
security-level 100
ip address 192.168.4.1 255.255.255.0
!
access-list ***b extended permit ip 4.4.4.0 255.255.255.0 1.1.1.0 255.255.255.0

route outside 0.0.0.0 0.0.0.0 30.1.1.10 1
route inside 0.0.0.0 0.0.0.0 192.168.4.4 tunneled

crypto ipsec ikev1 transform-set trans esp-des esp-md5-hmac
crypto map smap 10 match address ***b
crypto map smap 10 set peer 10.1.1.1
crypto map smap 10 set ikev1 transform-set trans
crypto map smap interface outside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
no threat-detection statistics tcp-intercept
tunnel-group 10.1.1.1 type ipsec-l2l
tunnel-group 10.1.1.1 ipsec-attributes
ikev1 pre-shared-key root

--------------------R3-------------------------------

interface Loopback0
ip address 3.3.3.3 255.255.255.0
!
interface FastEthernet0/0
ip address 192.168.3.3 255.255.255.0
ip route 0.0.0.0 0.0.0.0 192.168.3.1

-------------------------R4----------------------

interface Loopback0
ip address 4.4.4.4 255.255.255.0
!
interface FastEthernet0/0
ip address 192.168.4.4 255.255.255.0

ip route 0.0.0.0 0.0.0.0 192.168.4.1