Cisco ASA IPSec ×××隧道分离配置
对通过××× Client访问的终端用户进行组策略隧道分离配置，并限定终端访问主机。
本例中，filtertest组只能访问主机 192.168.2.10，ipsectest组可访问网络192.168.2.0/24。
防火墙： ASA5505 V8.2(5)
×××终端： Windows 7 64bit系统、***client-winx64-msi-5.0.07.0440-k9 客户端
下面以filtertest隧道组配置展开说明，ipsectest组参考filtertest组配置。
1. ×××隧道分离ACL配置
ASA1(config)# show run access-list
access-list acl-outside extended permit icmp any any echo-reply
access-list no-nat extended permit ip 192.168.2.0 255.255.255.0 172.16.1.0 255.255.255.0 access-list ***filter extended permit ip any host 192.168.2.10 //限定×××终端访问主机 access-list split-1 standard permit host 192.168.2.10 //配置×××隧道分离访问网络
2. ×××传输集、动态加密策略配置
crypto ipsec transform-set myset esp-3des esp-sha-hmac crypto dynamic-map dyn1 10 set transform-set myset crypto dynamic-map dyn1 10 set reverse-route
3. ×××静态加密策略、接口启用策略配置
crypto map mymap 10 ipsec-isakmp dynamic dyn1 crypto map mymap interface outside
4. ××× isakmp SA协商参数/策略配置
crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2
lifetime 86400
5. ×××隧道组策略配置
ASA1(config)# show run group-policy
group-policy filtertest internal
group-policy filtertest attributes
***-filter value ***filter //引用ACL列表，限定×××终端访问主机
***-tunnel-protocol IPSec //指定×××隧道协议
split-tunnel-policy tunnelspecified
//开启×××隧道分离（×××终端同时访问Internet和×××网络，未开启只能访问×××网络）
split-tunnel-network-list value split-1 //指定×××隧道分离网络范围
6. ×××隧道组参数配置
ASA1(config)# show run tunnel-group
tunnel-group filtertest type remote-access //声明×××终端连接方式
tunnel-group filtertest general-attributes address-pool client*** //指定×××终端IP地址池
default-group-policy filtertest //调用预配置×××组策略
tunnel-group filtertest ipsec-attributes pre-shared-key ***** //指定×××隧道预共享密钥
7. ×××隧道验证用户配置
ASA1(config)#username test password test
查看防火墙ARP信息
ASA1(config)# show arp
inside 192.168.2.12 94de.8044.22cd 7
inside 192.168.2.10 0030.675c.a4b3 512
附：防火墙配置
ASA1(config)# show run :
Saved :
ASA Version 8.2(5) !
hostname ASA1
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.2 255.255.255.0
!
Cisco ASA IPSec ×××隧道分离配置――ZWD
4 / 11
!
ftp mode passive clock timezone CTS 8
access-list acl-outside extended permit icmp any any echo-reply
access-list ***split standard permit 192.168.2.0 255.255.255.0
access-list testipsec extended permit ip any 192.168.2.0 255.255.255.0
access-list no-nat extended permit ip 192.168.2.0 255.255.255.0 172.16.1.0 255.255.255.0 access-list split-1 standard permit host 192.168.2.10
access-list ***filter extended permit ip any host 192.168.2.10
pager lines 24
logging enable
logging buffered debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu DMZ 1500
ip local pool client*** 172.16.1.1-172.16.1.100 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
access-group acl-outside in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.9 1 timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 10 set transform-set myset
crypto dynamic-map dyn1 10 set reverse-route
crypto map mymap 10 ipsec-isakmp dynamic dyn1
crypto map mymap interface outside crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 30
console timeout 0
management-access inside
dhcpd dns 202.96.128.86 202.96.134.133
dhcpd lease 36000
!
dhcpd address 192.168.2.10-192.168.2.20 inside
dhcpd dns 202.96.128.86 202.96.128.166 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 web***
group-policy ipsectest internal
group-policy ipsectest attributes
***-filter value testipsec
***-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ***split
group-policy filtertest internal
group-policy filtertest attributes
***-filter value ***filter
***-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-1
username test password P4ttSyrm33SV8TYp encrypted
username user password v5P40l1UGvtJa7Nn encrypted privilege 15
tunnel-group ipsectest type remote-access
tunnel-group ipsectest general-attributes
address-pool client***
default-group-policy ipsectest
tunnel-group ipsectest
ipsec-attributes
pre-shared-key *****
tunnel-group filtertest type remote-access
tunnel-group filtertest general-attributes
address-pool client***
default-group-policy filtertest
tunnel-group filtertest ipsec-attributes
pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:300f6df1d1f82232518eced3f653c5f1
: end
防火墙查看××× 阶段1信息
ASA1(config)# show crypto isakmp sa
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1
1 IKE Peer: 192.168.1.220
Type : user Role : responder
Rekey : no State : AM_ACTIVE
防火墙查看××× 阶段2信息
ASA1(config)# show crypto ipsec sa interface: outside
Crypto map tag: dyn1, seq num: 10, local addr: 192.168.1.2
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (172.16.1.7/255.255.255.255/0/0) current_peer: 192.168.1.220, username: test //对端IP、验证用户名
dynamic allocated peer ip: 172.16.1.7 //×××客户端分配IP
#pkts encaps: 8, #pkts encrypt: 8, #pkts digest: 8
#pkts decaps: 8,
#pkts decrypt: 8,
#pkts verify: 8
#pkts compressed: 0,
#pkts decompressed: 0
#pkts comp failed: 0,
#pkts decomp failed: 0
#pre-frag successes: 0,
#pre-frag failures: 0,
#fragments created: 0
#PMTUs sent: 0,
#PMTUs rcvd: 0,
#decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 192.168.1.2, remote crypto endpt.: 192.168.1.220
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 8AA05DF7
current inbound spi : 32062484
inbound esp sas:
spi: 0x32062484 (839263364)
transform: esp-3des esp-sha-hmac no compression
in use settings ={RA, Tunnel, }
slot: 0, conn_id: 1069056, crypto-map: dyn1 //动态加密图
sa timing: remaining key lifetime (sec): 27400
IV size: 8 bytes
Anti replay bitmap:
0x00000000 0x000001FF
outbound esp sas:
spi: 0x8AA05DF7 (2325765623)
transform: esp-3des esp-sha-hmac no compression
in use settings ={RA, Tunnel, }
slot: 0, conn_id: 1069056, crypto-map: dyn1 //动态加密图
sa timing: remaining key lifetime (sec): 27400
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
防火墙查看路由表
ASA1(config)# show route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external,
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 192.168.1.9 to network 0.0.0.0
S 172.16.1.7 255.255.255.255 [1/0] via 192.168.1.220, outside //远程×××连接信息
C 192.168.1.0 255.255.255.0 is directly connected, outside
C 192.168.2.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 192.168.1.9, outside