CISCO ASA L2L VPN PSK
Zur Navigation springen
Zur Suche springen
Accessliste anlegen
- ciscoasa(config)# access-list acl-asa-toc extended permit ip 172.18.122.0 255.255.255.0 192.168.122.0 255.255.255.0
Phase 1
Festlegen das die IP als ID funkiert
- ciscoasa(config)# crypto isakmp identity address
isakmp auf outside interface freischalten
- ciscoasa(config)# crypto isakmp enable if-outside
Transformset festlegen
- ciscoasa(config)# crypto ipsec transform-set AES256-MD5 esp-aes-256 esp-md5-hmac
Zusammenfassen
- ciscoasa(config)# crypto map vpn-asa-toc 10 match address acl-asa-toc
PFS und Diffie-Hellman-Gruppe 5
- ciscoasa(config)# crypto map vpn-asa-toc 10 set pfs group5
Peer setzen
- ciscoasa(config)# crypto map vpn-asa-toc 10 set peer 192.168.252.5
Transformset zuordnen
- ciscoasa(config)# crypto map vpn-asa-toc 10 set ikev1 transform-set AES256-MD5
Vpn Interface freischalten
- ciscoasa(config)# crypto map vpn-asa-toc interface if-outside
Netz zu Netz Vpn
- ciscoasa(config)# tunnel-group 192.168.252.5 type ipsec-l2l
Ipsec Attribute
- ciscoasa(config)# tunnel-group 192.168.252.5 ipsec-attributes
PSK festlegen
- ciscoasa(config-tunnel-ipsec)# pre-shared-key streng-geheim
Vpn pool aus nat nehmen
Festlegen der Ausnahme
- object network no-nat
- subnet 192.168.122.0 255.255.255.0
Ausnahme anwenden
- nat (if-inside,if-outside) source static obj-lan obj-lan destination static no-nat no-nat
Copy and Paste
configure terminal access-list acl-asa-toc extended permit ip 172.18.122.0 255.255.255.0 192.168.122.0 255.255.255.0 crypto isakmp identity address crypto isakmp enable if-outside crypto ipsec transform-set AES256-MD5 esp-aes-256 esp-md5-hmac crypto map vpn-asa-toc 10 match address acl-asa-toc crypto map vpn-asa-toc 10 set pfs group5 crypto map vpn-asa-toc 10 set peer 192.168.252.5 crypto map vpn-asa-toc 10 set ikev1 transform-set AES256-MD5 crypto map vpn-asa-toc interface if-outside tunnel-group 192.168.252.5 type ipsec-l2l tunnel-group 192.168.252.5 ipsec-attributes pre-shared-key streng-geheim object network no-nat subnet 192.168.122.0 255.255.255.0 nat (if-inside,if-outside) source static obj-lan obj-lan destination static no-nat no-nat