CISCO LAN TO LAN VPN配置
本实验目的：
1. ASA和R1之间建立preshare-key认证的lan to lan vpn
2. 加密流量为172.16.2.0/24到172.16.1.0/24的流量
3. 同时使得网段172.16.2.0/24也可以上网
4.同时使得网段172.16.1.0/24也可以上网
路由要求：
ASA: route outside 0.0.0.0 0.0.0.0 202.1.1.10
R1: ip route 0.0.0.0 0.0.0.0 201.1.1.10
配置ASA：
第一阶段策略：
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
定义认证的key为cisco：
crypto isakmp key cisco address 201.1.1.1
或是使用第二种方法!
tunnel-group 201.1.1.1 type ipsec-l2l
tunnel-group 201.1.1.1 ipsec-attributes
pre-shared-key cisco
第二阶段策略：
Crypto ipsec transform-set myset esp-des esp-md5-hmac
定义感兴趣流：
Access-list vpn permit ip 172.16.2.0 255.255.255.0 172.16.1.0 255.255.255.0
定义crypto map:
crypto map mymap 10 match address vpn
crypto map mymap 10 set peer 201.1.1.1
crypto map mymap 10 set transform-set myset
应用crypto map到outside接口:
crypto map mymap interface outside
配置PAT，使得172.16.2.0/24可以上网:
access-list nonat extended permit ip 172.16.2.0 255.255.255.0 172.16.1.0 255.255.255.0
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 172.16.2.0 255.255.255.0
配置R1：
crypto isakmp policy 10
hash md5
encryption des
authentication pre-share
group 2
crypto isakmp key cisco address 202.1.1.1
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map mymap 10 ipsec-isakmp
set peer 202.1.1.1
set transform-set myset
match address 100
interface e0/0
ip address 201.1.1.1 255.255.255.0
ip nat outside
crypto map mymap
interface e0/1
ip address 172.16.1.1 255.255.255.0
ip nat inside
ip nat inside source list for.nat interface e0/0 overload
ip route 0.0.0.0 0.0.0.0 201.1.1.10
ip access-list extended for.nat
deny ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255
permit ip 172.16.1.0 0.0.0.255 any
access-list 100 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255
