1、网络拓扑图
网络拓扑图
2、ASA具体配置
部分已经省略
ASA5510# show run
: Saved
:
ASA Version 7.2(3)
!
hostname ASA5510
domain-name zqy.com
enable password oQMJ3TXqSC.skFhg encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address …… 255.255.255.252
!
interface Ethernet0/1
nameif dmz
security-level 50
ip address 192.168.100.254 255.255.255.0
!
interface Ethernet0/2
nameif inside2
security-level 100
ip address 10.0.0.5 255.255.255.252
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone HKST 8
dns server-group DefaultDNS
domain-name zqy.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list in-out-nat extended deny ip host 192.168.1.188 any
access-list in-out-nat extended permit ip 192.168.1.0 255.255.255.0 any
……………………这是省略一万字
ip local pool ezvpn_pool 172.16.10.100-172.16.10.200 mask 255.255.255.0
no failover
nat-control
global (outside) ……
nat (dmz) 1 0.0.0.0 0.0.0.0
nat (inside2) 1 0.0.0.0 0.0.0.0
static (inside2,outside) ……
……省略一万字
access-group out-in in interface outside
access-group dmz-out-nat in interface dmz
access-group in-out-nat in interface inside2
route outside ……
!
aaa-server vpn_radius protocol radius
aaa-server vpn_radius (inside2) host 192.168.1.7
timeout 5
key ASA5510
aaa authentication enable console vpn_radius
aaa accounting enable console vpn_radius
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
console timeout 0
!
group-policy vpngroup internal
group-policy vpngroup attributes
wins-server value 172.16.10.100 172.16.10.100
dns-server value 192.168.1.13 192.168.1.14
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ezvpn_splitTunnelAcl
default-domain value ipgchina.com
username zqy password O0qvlbgGwBBckWRt encrypted privilege 15
tunnel-group vpngroup type ipsec-ra
tunnel-group vpngroup general-attributes
address-pool ezvpn_pool
authentication-server-group vpn_radius
default-group-policy vpngroup
tunnel-group vpngroup ipsec-attributes
pre-shared-key *
smtp-server 192.168.0.155 192.168.0.156
prompt hostname context
Cryptochecksum:e53fcc41c616ae28c746da88e6d1e65a
: end
