VPN的配置实例1.docx

1、VPN的配置实例1一、Pix-PixPIX CentralBuilding configuration.: Saved:PIX Version 6.3(3)interface ethernet0 autointerface ethernet1 autonameif ethernet0 outside security0nameif ethernet1 inside security100enable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptedhostname pix-centralfixup prot

2、ocol dns maximum-length 512fixup protocol ftp 21fixup protocol h323 h225 1720fixup protocol h323 ras 1718-1719fixup protocol http 80fixup protocol rsh 514fixup protocol rtsp 554fixup protocol sip 5060fixup protocol sip udp 5060fixup protocol skinny 2000fixup protocol smtp 25fixup protocol sqlnet 152

3、1fixup protocol tftp 69names !- This is traffic to PIX 2.access-list 120 permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 !- This is traffic to PIX 3.access-list 130 permit ip 10.1.1.0 255.255.255.0 10.3.3.0 255.255.255.0 !- Do not do Network Address Translation (NAT) on traffic to other PIXe

4、s.access-list 100 permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0 access-list 100 permit ip 10.1.1.0 255.255.255.0 10.3.3.0 255.255.255.0 pager lines 24logging onmtu outside 1500mtu inside 1500ip address outside 172.18.124.153 255.255.255.0ip address inside 10.1.1.1 255.255.255.0ip audit inf

5、o action alarmip audit attack action alarmpdm history enablearp timeout 14400!- Do not do NAT on traffic to other PIXes.nat (inside) 0 access-list 100route outside 0.0.0.0 0.0.0.0 172.18.124.1 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00timeout

6、h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absoluteaaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local no snmp-server locationno snmp-server contactsnmp-server community publicsnmp-server enable trapsfloodguard enabl

7、esysopt connection permit-ipseccrypto ipsec transform-set myset esp-des esp-md5-hmac !- This is traffic to PIX 2.crypto map newmap 20 ipsec-isakmpcrypto map newmap 20 match address 120crypto map newmap 20 set peer 172.18.124.154crypto map newmap 20 set transform-set myset!- This is traffic to PIX 3.

8、crypto map newmap 30 ipsec-isakmpcrypto map newmap 30 match address 130crypto map newmap 30 set peer 172.18.124.157crypto map newmap 30 set transform-set mysetcrypto map newmap interface outside 应用MAP到outsideisakmp enable outside 开启IKEisakmp key * address 172.18.124.154 netmask 255.255.255.255 no-xa

9、uth no-config-mode isakmp key * address 172.18.124.157 netmask 255.255.255.255 no-xauth no-config-mode isakmp identity addressisakmp policy 10 authentication pre-shareisakmp policy 10 encryption desisakmp policy 10 hash md5isakmp policy 10 group 1isakmp policy 10 lifetime 1000telnet timeout 5ssh tim

10、eout 5console timeout 0terminal width 80Cryptochecksum:d41d8cd98f00b204eecf8427e: endPIX 2Building configuration.: Saved:PIX Version 6.3(3)interface ethernet0 autointerface ethernet1 autonameif ethernet0 outside security0nameif ethernet1 inside security100enable password 8Ry2YjIyt7RRXU24 encryptedpa

11、sswd 2KFQnbNIdI.2KYOU encryptedhostname pix2fixup protocol dns maximum-length 512fixup protocol ftp 21fixup protocol h323 h225 1720fixup protocol h323 ras 1718-1719fixup protocol http 80fixup protocol rsh 514fixup protocol rtsp 554fixup protocol sip 5060fixup protocol sip udp 5060fixup protocol skin

12、ny 2000fixup protocol smtp 25fixup protocol sqlnet 1521fixup protocol tftp 69names !- This is traffic to PIX Central.access-list 110 permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0 !- Do not do NAT on traffic to PIX Central.access-list 100 permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.25

13、5.0 pager lines 24logging onmtu outside 1500mtu inside 1500ip address outside 172.18.124.154 255.255.255.0ip address inside 10.2.2.1 255.255.255.0ip audit info action alarmip audit attack action alarmno failoverfailover timeout 0:00:00failover poll 15no failover ip address outsideno failover ip addr

14、ess insidepdm history enablearp timeout 14400!- Do not do NAT on traffic to PIX Central.nat (inside) 0 access-list 100route outside 0.0.0.0 0.0.0.0 172.18.124.1 1aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local no snmp-server locationno snmp-serve

15、r contactsnmp-server community publicno snmp-server enable trapsfloodguard enablesysopt connection permit-ipseccrypto ipsec transform-set myset esp-des esp-md5-hmac !- This is traffic to PIX Central.crypto map newmap 10 ipsec-isakmpcrypto map newmap 10 match address 110crypto map newmap 10 set peer 172.18.124.153crypto map newmap 10 set transform-set mysetcrypto map newmap interface outsideisakmp enable outsideisakmp key * address 172.18