asa vpn（ASA VPN）.docVIP

asa vpn（ASA VPN） A.Site-to-site VPN 1. the first phase parameter configuration 1) ISAKMP policy configuration Crypto ISAKMP policy 1 Authentication pre-share Encryption 3DES Hash Sha Group 2 2) pre shared authentication configuration is automatically converted to tunnel-group (Tunnel Group) Tunnel-group 201.1.1.1 type ipsec-l2l (L2L tunnel type) Tunnel-group 201.1.1.1 ipsec-attributes Pre-shared-key * (authentication key) 3) the first phase of ISAKMP and related export association Crypto ISAKMP enable outside 2. the second phase parameter configuration 1) conversion set configuration (second stage configuration) Crypto IPSec transform-set Mytrans esp-3des esp-sha-hmac 2) static encryption configuration (without the crypto map configuration mode, but directly in the crypto map call) Crypto map mymap 1 match address 100 (interest rate) Crypto map mymap 1 set peer 201.1.1.1 (peer address) Crypto map mymap 1 set transform-set Mytrans (call transfer set) 3) applied to the network outlet Crypto map mymap interface outside (application to outside interface) Two on the issue of site-to-site VPN dynamic tunnel construction. 1) on the first stage configuration verification Create default group tunnel-group (* DefaultL2LGroup must be strictly case sensitive) (DefaultRAgroup is the default for tunnel group EZvpn) (DefaultWEBVPNGroup for the default WEBVPN Tunnel Group) 2) the second stage configuration Create dynamic encryption map, on the site address using the dynamic detection mechanism Three, about EZvpn (configuration and router IOS configuration similar) 1) the 1.5 phase of the expansion test By creating a tunnel-group group configuration Create a A. named g2myway EZvpn Tunnel Group Tunnel-group g2myway type ipsec-ra (on behalf of EZVPN Tunnel Group) B. mode configuration strategy defined group (assigned to the users address, DNS, tunnel separation) Hostname (config) tunnel-group g2myway general-attributes # Hostname (config-general) address-pool testpool (# for user defi