配置 IPSec - 路由器到PIX防火墙(页 1) - [ Hardware & Equipment ] 硬件设备 - 岁月联盟 - 技术社区 - BBS.SYUE.COM 中国信息安全论坛,黑客网站,红客网站

admin 发表于 2006-5-11 21:35

配置 IPSec - 路由器到PIX防火墙

这个文档说明了在路由器和思科防火墙之间的IPSec配置。
在总部和分公司之间的流量使用的是私有IP地址，当分公司的局域网用户访问互联网时，需要进行地址转换。
网络拓扑
<a title="点击图片看全图" href="http://www.315safe.com/uploadfile/2005212716436.gif" target="_blank"><img height="189" alt="" hspace="0" src="http://syue.com/Firewall/UploadFiles_4544/200602/20060222154414625.gif" width="540" border="0" style="FILTER: ; WIDTH: 540px; HEIGHT: 189px;"/> </a> 配置<table cellspacing="1" cellpadding="0" width="100%" border="0" style="WIDTH: 100%; mso-cellspacing: .7pt; mso-padding-alt: 0cm 0cm 0cm 0cm;"><tbody><tr style="HEIGHT: 13.5pt;"><td style="PADDING-RIGHT: 0cm; PADDING-LEFT: 0cm; BACKGROUND: #ccccff; PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm; HEIGHT: 13.5pt;">Headquarters PIX
</td></tr><tr><td style="PADDING-RIGHT: 0cm; PADDING-LEFT: 0cm; BACKGROUND: #fffef4; PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm;">!--- 定义去路由器的流量: access-list ipsec permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 !--- 去路由器的流量不做地址转换 access-list nonat permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 ip address outside 172.17.63.213 255.255.255.240 ip address inside 10.1.1.1 255.255.255.0 global (outside) 1 172.17.63.210 !--- 去路由器的流量不做地址转换 nat (inside) 0 access-list nonat nat (inside) 1 10.1.1.0 255.255.255.0 0 0 conduit permit icmp any any route outside 0.0.0.0 0.0.0.0 172.17.63.209 1 !--- IPSec 策略: sysopt connection permit-ipsec crypto ipsec transform-set avalanche esp-des esp-md5-hmac crypto ipsec security-association lifetime seconds 3600 crypto map forsberg 21 ipsec-isakmp crypto map forsberg 21 match address ipsec crypto map forsberg 21 set peer 172.17.63.230 crypto map forsberg 21 set transform-set avalanche crypto map forsberg interface outside !--- IKE 策略: isakmp enable outside isakmp key westernfinal2000 address 172.17.63.230 netmask 255.255.255.255 isakmp identity address isakmp policy 21 authentication pre-share isakmp policy 21 encryption des isakmp policy 21 hash md5 isakmp policy 21 group 1 : end </td></tr></tbody></table><table cellspacing="1" cellpadding="0" width="100%" border="0" style="WIDTH: 100%; mso-cellspacing: .7pt; mso-padding-alt: 0cm 0cm 0cm 0cm;"><tbody><tr style="HEIGHT: 13.5pt;"><td style="PADDING-RIGHT: 0cm; PADDING-LEFT: 0cm; BACKGROUND: #ccccff; PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm; HEIGHT: 13.5pt;">Branch Router
</td></tr><tr><td style="PADDING-RIGHT: 0cm; PADDING-LEFT: 0cm; BACKGROUND: #fffef4; PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm;">hostname Branch_Router !--- IKE策略: crypto isakmp policy 11 hash md5 authentication pre-share crypto isakmp key westernfinal2000 address 172.17.63.213 !--- IPSec策略: crypto ipsec transform-set sharks esp-des esp-md5-hmac crypto map nolan 11 ipsec-isakmp set peer 172.17.63.213 set transform-set sharks match address 120 ! interface Ethernet0 ip address 172.17.63.230 255.255.255.240 ip nat outside crypto map nolan ! interface Ethernet1 ip address 10.2.2.1 255.255.255.0 ip nat inside ! ip nat pool branch 172.17.63.230 172.17.63.230 netmask 255.255.255.240 ip nat inside source route-map nonat pool branch overload ip route 0.0.0.0 0.0.0.0 172.17.63.225 access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255 access-list 130 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255 access-list 130 permit ip 10.2.2.0 0.0.0.255 any route-map nonat permit 10 match ip address 130 end </td></tr></tbody></table>

页: [1]

岁月联盟 - 技术社区 - BBS.SYUE.COM's Archiver

配置 IPSec - 路由器到PIX防火墙