使用Dynamips、ASA模拟器和VMWare搭建网络环境汇.docVIP

网络安全机试题实验 如图所示，使用Dynamips、ASA模拟器和VMWare搭建网络环境，路由器Web模拟Web服务器，ACS服务器上安装ACS软件，PC机安装Windows XP系统，路由器R1模拟客户端。 1、在ASA1和ASA2之间配置IPSec VPN，使R1能够telnet到Web。 2、在ASA1上配置SSL VPN，使PC能够通过IE访问Web。配置分离隧道，使PC在访问Web的同时可以ping通。 3、在ACS上配置RADIUS服务器，SSL VPN使用的地址池为～54，添加用户名benet密码123456，添加组group1，配置Downloadable IP ACLs使PC只能通过IE访问Web。在ACS上进行相关配置，关闭SSL VPN页面的地址输入栏。 4、实现在R1上可ping通PC的IP地址。 ASA2 conf t int e0/1 nameif inside security-level 100 ip add 54 no sh int e0/0 nameif outside security-level 0 ip add 52 no sh exit route outside 0 0 nat-control nat (inside) 1 0 0 global (outside) 1 int access-list nonat extended permit ip nat (inside) 0 access-list nonat access-list 111 permit icmp any any access-group 111 in int outside end conf t crypto isakmp enable outside crypto isakmp policy 1 encryption 3des hash sha group 1 authentication pre-share exit isakmp key benet address access-list kfvpn permit ip crypto ipsec transform-set benet-set esp-aes esp-sha-hmac crypto map benet-map 1 match address kfvpn crypto map benet-map 1 set peer crypto map benet-map 1 set transform-set benet-set crypto map benet-map interface outside end ------------------------------- ISP en conf t int f1/0 ip add 52 no sh int f0/0 ip add 52 no sh int f2/0 ip add 52 no sh exit ---------------------------------- ASA1 conf t int e0/1 nameif inside security-level 100 ip add 54 no sh int e0/0 nameif outside security-level 0 ip add 52 no sh exit route outside 0 0 nat-control nat (inside) 1 0 0 global (outside) 1 int access-list nonat extended permit ip nat (inside) 0 access-list nonat access-list 111 permit icmp any any access-group 111 in int outside end conf t crypto isakmp enable outside crypto isakmp policy 1 encryption 3des hash sha group 1 authentication pre-share exit isakmp key benet address access-list kfvpn permit ip crypto ipsec transform-set benet-set esp-aes esp-sha-hmac crypto map benet-map 1 match address kfvpn crypto map benet-map 1 set peer crypto map benet-map 1 set transform-se