PC1-----asash------Internet------asawh-----PC2
asawh配置
1.asawh接口配置
 interface GigabitEthernet0/0
 no sh
 security-level 0
 nameif Outside
 ip address 119.97.225.246 255.255.255.252
 exit
 interface GigabitEthernet0/1
 no sh
 security-level 100
 nameif Inside
 ip address 192.168.102.1 255.255.255.0
2.路由设置
  route Outside 0.0.0.0 0.0.0.0 119.97.225.245
3.Internet接口配置
  Internet不需要内网的路由,配置接口即可
4.asash配置
 interface GigabitEthernet0/0
 no sh
 security-level 0
 nameif Outside
 ip address 112.99.225.246 255.255.255.252
 exit
 interface GigabitEthernet0/1
 no sh
 security-level 100
 nameif Inside
 ip address 192.168.201.1 255.255.255.0
5.路由设置
  route Outside 0.0.0.0 0.0.0.0 112.99.225.245
6.asawh ipsec ***配置
 crypto isakmp policy 10
 encryption des
 hash sha
 authentication pre-share ---认证方式
 group 2 ---密钥算法 1024位
 lifetime 86400
 exit
 isakmp key my*** address 112.99.225.246 ---定义认证标识
 crypto ipsec transform-set myset esp-des esp-md5-hmac
 crypto map newmap 2 match address 110
 crypto map newmap 2 set pfs
 crypto map newmap 2 set peer 112.99.225.246
 crypto map newmap 2 set transform-set myset
 crypto map newmap interface Outside
 crypto isakmp enable Outside
 
7.asash ipsec ***配置
 rypto isakmp policy 10
 encryption des
 hash sha
 authentication pre-share ---认证方式
 group 2 ---密钥算法 1024位
 lifetime 86400
 exit
 isakmp key my*** address 119.97.225.246 ---定义认证标识
 crypto ipsec transform-set myset esp-des esp-md5-hmac
 crypto map newmap 2 match address 110
 crypto map newmap 2 set pfs
 crypto map newmap 2 set peer 119.97.225.246
 crypto map newmap 2 set transform-set myset
 crypto map newmap interface Outside
 crypto isakmp enable Outside
8.定义流量
 asawh内网到asash内网
 access-list 110 extended permit ip 192.168.100.0 255.255.255.0 192.168.1.0
 255.255.255.0
 asash内网到asawh内网
 access-list 110 extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0
 255.255.255.0

注:对于做了NAT转换的,***流量需要绕过NAT nat (Inside)