只需要简单的nat上网,和增加一个远程vpn(使用cisco vpn 客户端可以拨入内网而已),结果vpn死活不通,无法访问,请高手指点.
' w# N! _7 z6 ^) R( i" ? y( a' u或者贴封类似功能的配置给我,谢谢4 q* C/ F5 W' y. f
/ K) x! ?$ O: ~* _& C& w型号:asa5520; e! t7 A" b8 H
8 R8 V3 q; v6 N
, Y+ P6 K2 p2 D0 Y( X) D( K8 G t配置如下:% o3 F! T/ L) W3 N) r- F
! Q% i' u1 ^' A( P
外网地址:202.61.180.100 255.0.0.0
, M# M6 e! a; d( o内网: ip address 10.0.0.1 255.0.0.0 # e0 W B: c5 { ^. U
! C; @9 V. [' y1 G% C$ tASA Version 7.0(8) & K/ k7 {% x+ X5 [. Y" W# }! v
!
3 H" e$ E6 s5 I3 |3 Dhostname ciscoasa5 U5 }( r; N0 I0 Q9 r1 @
domain-name default.domain.invalid$ @: \; H! `3 }; G4 V- e) W
enable password 8Ry2YjIyt7RRXU24 encrypted
( a# a0 ]# R1 i1 D& P, Bpasswd 2KFQnbNIdI.2KYOU encrypted* Q' @6 }0 b% k6 y1 A
names- a0 Z" W4 Q9 `. I
dns-guard2 y- i. c5 p8 _! a9 g) u" B/ X9 J
!
' {6 J% V) o7 X0 p5 ~. I0 iinterface Ethernet0/0
% N+ ]) K& h% a5 \ nameif outside2 {% p% h- j. o3 ? [, E' e: }2 L
security-level 05 ^5 S" b: `; U" e8 A% P/ ]
ip address 202.61.180.100 255.0.0.0 8 C2 K9 ~7 s( k) z9 Y3 [9 G! t) q/ ^7 p
!
: {) _; l7 w: ~/ a6 linterface Ethernet0/1
5 d2 M1 x! d8 R% X nameif inside* q' u; m0 s: ? f9 H y0 W
security-level 100$ K( y3 T$ U, A4 d \ ~/ s
ip address 10.0.0.1 255.0.0.0
% U- c9 K$ W& j( w# C. I* U!' _5 d) b( V8 y6 f8 z0 ?
interface Ethernet0/2
% r: M7 ]6 k* K& Z: o$ I9 c nameif dmz
9 C, Z: v# D' ?0 L security-level 505 h5 Y3 n2 M4 i/ \* A
ip address 192.168.10.1 255.255.255.0 + X! k& R2 m. K. z; U6 r
!+ `5 }3 }/ \8 P7 L R0 ?
interface Management0/0# n' l: i2 R. U) t# m
nameif management" W5 s" {! M) q/ r( [ _5 M: H" n
security-level 100
$ v4 e6 V1 ~/ M# C ip address 192.168.1.1 255.255.255.0
' g3 D1 m& L3 _# o, L management-only! ]4 p& T4 L, S% J. T5 C5 t& v. o
!7 b& s6 S/ Q6 h% @' Q' j
ftp mode passive
, p1 L: u% A. `access-list 101 extended permit ip any any - M1 D( ^ n' A2 o
access-list 101 extended permit icmp any any
& G3 M! Z1 G! a x' t# y, Taccess-list 102 extended permit icmp any any
, [2 V0 [* }# X5 E' A5 ]2 Y8 Eaccess-list tunnellist standard permit 10.0.0.0 255.0.0.0
, s+ B9 M7 \9 \% Qpager lines 245 n: ?/ e( h$ a: `" |- Z
logging asdm informational- s8 I+ A5 C& J# p- n
mtu management 1500: Y& c- R: {3 _6 B( g% `7 v8 w
mtu outside 1500
% I+ k3 N' h/ H# w5 E# I: R, G+ mmtu inside 1500
6 d m' L3 @& ~- Z3 bmtu dmz 1500
/ g5 S- M7 p* L. B% T% jip local pool vpn-pool 10.10.10.1-10.10.10.10 mask 255.0.0.0
4 N- ?3 K/ h5 nasdm image disk0:/asdm-508.bin( ~$ k# a3 P2 c |! |
no asdm history enable
r8 G8 j$ h; f# c* [: _# Jarp timeout 14400
" a+ j1 j: H5 `. mnat-control, @! M& }) ^7 R. c# L: W
global (outside) 1 interface# c$ X% f# o0 w# W* c- |9 A
nat (inside) 1 0.0.0.0 0.0.0.0
, A. r- e# i, N+ y0 S1 d: Naccess-group 101 in interface outside5 x) ~0 Z: O7 w* R/ D. c P9 p# Q
access-group 102 in interface inside
: F s I* x: ?# D! N, f' w& Froute outside 219.120.0.0 255.255.0.0 203.71.1.101 1* N, A+ S, N. {) I# O+ u
timeout xlate 3:00:00
; J* Z: V P+ F x1 Etimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
8 d, D% I6 ?9 l% ltimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00$ t8 K+ `& o$ n- R
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
9 A8 e* b$ m1 N1 p5 }6 P9 Y/ Wtimeout uauth 0:05:00 absolute; B- y7 _; [1 V0 G6 A \
group-policy scad internal
$ O. L& ?8 a0 z+ I# M% rgroup-policy scad attributes! M s3 Y, M) W1 j7 z
split-tunnel-policy tunnelspecified/ O+ C& y$ Z) \( H. j) Z, L9 Y
split-tunnel-network-list value tunnellist6 r7 Q/ q9 M/ k" O; r" D
webvpn- |( S& Y; R- N& J2 N2 W
username test password P4ttSyrm33SV8TYp encrypted
/ o; H" P+ _3 L: ], W. Wusername cisco password 3USUcOPFUiMCO4Jk encrypted2 S$ J3 h7 Y) o- k6 y' |- `" @
http server enable
4 q+ Z* M" S* Xhttp 192.168.1.0 255.255.255.0 management
! j' `& d( a* {$ @$ }7 b2 h0 Kno snmp-server location
" B8 V! p3 q3 Y9 q* k* Tno snmp-server contact
! s/ V, Q5 l. t3 ^) Z9 Csnmp-server enable traps snmp authentication linkup linkdown coldstart
2 d. |2 [* i' ^7 M8 L& R+ Kcrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ' w9 c+ |# n3 j, ~/ `* q
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac % X( G( r/ l8 r: R5 k9 i1 h
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac ' { h, K6 I: ?% u
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
& P0 o) c1 ?/ v, wcrypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
+ x' E( v+ A4 V c: {' Ncrypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac . C$ E% k4 O4 ]4 M
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
, x: O6 V, p, _7 Ncrypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac , S- X @$ ^% J: A: e$ \$ v; C
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac , `8 [$ ~& r& y: `4 l( g
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
) s, _- ~# m$ |2 |1 `1 wcrypto ipsec transform-set SCADA esp-des esp-md5-hmac 1 g; f) q9 R0 I! V, |$ x8 J \% n
crypto ipsec security-association lifetime seconds 28800
5 Y: |& ?7 u/ icrypto ipsec security-association lifetime kilobytes 4608000
% x9 c" d2 @9 ]/ Y# V3 mcrypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA
. q* L2 P3 l2 }3 G" V: ?crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
& p& i% d* D1 f# C" R2 ?1 Ccrypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 46080009 M' b+ a5 p& T1 P# ]- \
crypto dynamic-map SCADA_MAP 20 set transform-set SCAD* y |5 B: ~2 {( F! f# Z
crypto dynamic-map SCADA_MAP 20 set security-association lifetime seconds 28800$ R+ H; G$ k" P) u$ [
crypto dynamic-map SCADA_MAP 20 set security-association lifetime kilobytes 46080000 w$ A4 ] ~; m, k3 ]( f1 R
crypto map outside_map 20 ipsec-isakmp dynamic SCAD_MAP/ n+ q8 d2 r' ]. q7 M( i
crypto map outside_map interface outside6 z4 L; `2 Y2 C
isakmp enable outside
: k# H5 O* p1 V6 J risakmp policy 10 authentication pre-share
- ~ T* b Y. C7 [ Xisakmp policy 10 encryption 3des
1 o* L# o& b$ z4 J6 Misakmp policy 10 hash md57 C* X/ ?! a# N F7 f8 Q/ u
isakmp policy 10 group 18 s1 ^6 `$ l6 R( I, d2 x
isakmp policy 10 lifetime 86400/ G* X; {( q \# H5 P2 o' G B
tunnel-group scad type ipsec-ra
3 L" \. i7 g8 L% y. K! s/ qtunnel-group scad general-attributes B3 }! w/ W: T
address-pool vpn-pool' O" ]* s1 W0 q2 p
default-group-policy scad
1 l- z5 k% `% l# Htunnel-group scad ipsec-attributes8 Q8 |6 l4 Y- g- r0 ^
pre-shared-key cisco
2 D& z! J' J, Ctelnet timeout 5
( m; x% o) _2 R9 F" }ssh timeout 5! O$ R( x! y( S$ i5 ^( b7 h
console timeout 0" P1 W& b. U4 O( m1 Y: t# `) E
dhcpd address 192.168.1.2-192.168.1.254 management
F9 n" Y1 b# [9 H' R1 `dhcpd lease 3600! x$ ` j9 T* x: U; J6 B! t
dhcpd ping_timeout 50
$ S W6 _& G# } e! U. |. `dhcpd enable management' S8 b' I0 ? H v3 `8 m
!$ X! w' j' O s2 k
class-map inspection_default
# s3 ?+ x2 \( y0 D match default-inspection-traffic
2 L3 p2 a- I% w& A1 N# I!2 o2 A- e, U# U0 R3 f
!" `5 M7 m7 I: e( Z
policy-map global_policy
' |( N* O) F+ m class inspection_default
5 O: F% n, t: d2 _; _* E inspect dns maximum-length 512
, i( B1 B$ k' e" c: m4 P) m inspect ftp
0 f+ N. H9 a/ N! D, H inspect h323 h225 . i& V; {4 R2 I8 N- r% y a
inspect h323 ras / c) e+ _. e5 J5 X
inspect rsh * ]7 W" o9 t3 }6 S! ]
inspect rtsp # J& b7 |& V9 h K% v( U
inspect esmtp ! I/ B4 i$ a: u! a0 M: V! {
inspect sqlnet ; u% k r/ d" b/ }' p
inspect skinny % C8 Z2 i! Q+ }' c- n2 e0 E' T$ ^
inspect sunrpc 3 a! L+ |" i9 v: F* h9 `
inspect xdmcp
$ r9 Y A9 z1 `& N- P4 j inspect sip ( O Q3 i5 }( ~5 x5 o. ]& L
inspect netbios - L, h% v' K8 b+ @# t0 @( Z
inspect tftp . g0 Z- I/ o; J" Z9 x/ z
!
% J( |( z# z% L4 \0 Nservice-policy global_policy global6 {( b5 o" v8 u8 ^8 `5 h
ssl encryption des-sha1 rc4-md54 i+ V5 j, `3 n K
Cryptochecksum:b192decb040edf1415bd2cea984cd113
9 j$ i$ X1 R' l" j: end |
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
