關于pix站到站點ipsecVPN配置
前提：沒有加密通道前，數據能夠正常交流。
Step1: 允許pix 外口進來的ipsec數據流
Pix(config)#access-list out_in permit 50 any host 222.254.240.193
Pix(config)#access-list out_in permit 51 any host 222.254.240.193
Pix(config)#access-list out_in permit udp any host 222.254.240.193 eq 500
Sysopt connection permit-ipsec 更簡略的方式，只需一條
Step2: 外口啟用ISAKMP
Pix1(config)#isakmp enable outside
Pix2(config)#isakmp enable outside
Step3: 配置IKE策略參數
Isakmp policy 10 encryption 3des
Isakmp policy 10 hash md5
Isakmp policy 10 group 2
Isakmp policy 10 lifetime 2400
Isakmp policy 10 autentication pre-share
(Isakmp policy 10 autentication rsa-sig) 啟用RSA數字簽名認證(缺省)
pix#show isakmp policy 查看策略
step4: 定義預共享密鑰
pix1(config)#isakmp key mykey address 202.103.96.112 netmask 255.255.255.255
pix2(config)#isakmp key mykey address 222.254.240.193 netmask 255.255.255.255
pix(config)#isakmp key pubkey address 0.0.0.0 netmask 0.0.0.0 ( 所有通道peer都共享同一密鑰)
step5: 定義加密數據流ACL
pix1(config)#
access-list crypto_date permit 192.168.1.1 255.255.255.0 192.168.2.0 255.255.255.0
pix2(config)#
access-list crypto_date permit 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
step6: 定義轉換集合 transform set 兩邊配置一樣
pix1(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac
pix2(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac
pix1(config)# show crypto ipsec transform-set
step7: NAT 的問題
pix1(config)# nat 0 access-list cryto_date
pix2(config)# nat 0 access-list cryto_date
step8: 配置加密圖 連接policy+transform-set+peer address
pix1(config)# crypto map pix1map 10 ipsec-isakmp
pix1(config)# crypto map pix1map 10 match address crypto_date
pix1(config)# crypto map pix1map 10 set peer 202.103.96.112
pix1(config)# crypto map pix1map 10 set transform-set myset
pix2(config)# crypto map pix2map 10 ipsec-isakmp
pix2(config)# crypto map pix1map 10 match address crypto_date
pix2(config)# crypto map pix1map 10 set peer 222.240.254.193
pix2(config)# crypto map pix1map 10 set transform-set myset
step 9: 綁定加密圖到接口
pix1(config)# crypto map pix1map interface outside
pix2(config)# crypto map pix2map interface outside
pix1#show crypto map
pix1#show crypto ipsec sa
【pix站到站點ipsecVPN配置】相關文章：
和弦配置的基本方法09-23
歌曲和弦配置法09-17
如何正確的配置網絡09-16
辦公電腦配置推薦11-26
正確的配置網絡的步驟11-27
人生的站點作文500字10-31
每個站點都有風景作文12-15
每個站點都有風景作文02-22
查看電腦主板配置的方法12-23
網絡配置基礎知識10-14