VPDN的配置.docxVIP

VPDN的配置vpdn分类：系统集成一、防火墙配置：ciscoasa(config)# show run???????????????????????: Saved:ASA Version 7.2(2)!hostname ciscoasadomain-name enable password 2KFQnbNIdI.2KYOU encryptedinterface GigabitEthernet1/0?media-type sfp??? //表示该端口为光纤类型sfp还有如：RJ-45等类型，需要指定?no nameif?no security-level?no ip address!interface GigabitEthernet1/0.2??? //划分子接口，用于MPLS VPN?vlan 3013? //该vlan号要与局方路由器上的vlan号一致。?nameif mplsvpn??? //定义端口名字?security-level 100?? //定义安全界别 0 是安全界别最高的。?ip address 52 ??//定义该子接口的IP地址!interface GigabitEthernet1/0.3??? //划分子接口，用户公网拨入的VPDN用户接口?vlan 3015????nameif outside?security-level 100?ip address 5 52!interface GigabitEthernet1/1?? ?//该接口用户跟SW3750（1）相连接的?media-type sfp?nameif inside1?security-level 100?ip address 52!interface GigabitEthernet1/2?? ?//该接口用户跟SW3750（2）相连接的?media-type sfp?nameif inside2?security-level 100?ip address 0 52boot system disk0:/asa722-k8.bin? ///用户引导系统的IOS镜像文件的语句ftp mode passiveclock timezone GMT 8 ?//定义系统的时钟dns server-group DefaultDNS?domain-name ???? //定义用户域same-security-traffic permit inter-interfaceaccess-list mplsvpn extended permit icmp any anyaccess-list mplsvpn extended permit ip any anyaccess-list 102 extended deny ip host 5 host 2access-list 102 extended deny ip host 5 host access-list 102 extended permit ip host 5 anyaccess-list 111 extended permit udp any eq 1812 anypager lines 24logging console debugginglogging asdm informationalmtu mplsvpn 1500?? //定义传输数据的片单位大小。如果不足1500的数据将做为一片来处理，如果超过1500的数据单元将做为2片来处理。如果该值过小那么数据将被分成过多的单元，影响I/O带宽。mtu outside 1500mtu inside1 1500mtu inside2 1500ip local pool visspool -54 mask ? //划分地址池，用于VPDN用户拨入之后分配的地址。no failovericmp unreachable rate-limit 1 burst-size 1icmp permit any mplsvpn?? ///允许ping入icmp permit any outsideicmp permit any inside1icmp permit any inside2asdm image disk0:/asdm-522.bin? ?//用户图形化管理的界面no asdm history enablearp timeout 14400access-group mplsvpn in interface mplsvpn?? //将访问列表mplsvpn应用于想进入接口mplsvpn的所有IP和用户。access-group mplsvpn out interface mplsvpnaccess-group 111 in interface outside