【每日必学】Remote VPN

发布作者：微思网络   发布时间：2017-03-20   浏览量：0次

实验拓扑：

配置R1:

crypto isakmp policy 10

  authentication pre-share

 group 2

 hash md5

 enc 3des

 

crypto isakmp client configuration group ipsecgroup (验证的group名)

key cisco123  (验证的key)

aaa new-model

aaa authentication login noacs line none (线下保护)

line console 0

   login authentication noacs

line vty 0 15

   login authentication noacs

 

aaa authentication login remote local (本地认证)

username cisco password cisco

 

Aaa authorization network remote local (使用本地数据库授权)

 

Ip local pool ippool 10.1.1.1 10.1.1.100   //为vpn客户端分配的IP地址池

 

Crypto isakmp client config group ipsecgroup

   Poop ippool (可以为不同的组分配不同的策略)

   netmask 255.255.255.0

 

配置切分通道split tunneling，只是到172.16.1.0/24的流量要加密.

access-list 100 permit ip 172.16.1.0 0.0.0.255 any

 

Crypto isakmp client config group ipsecgroup

   acl 100

 

Crypto isakmp profile ciscopro

   Match identity group ipsecgroup

   Client configuration address respond

   Client authentication list remote

   isakmp authorization list remote

 

Crypto ipsec transform-set myset esp-3des esp-md5-hmac

 

Crypto dynamic dycisco 10

    Set trans myset

    Set isakmp-profile ciscopro

    Reverse-route

 

Crypto map mymap 10 ipsec-isakmp dynamic dycisco

在接口下应用mymap

Interface f0/1

  Crypto map mymap

 

 

拨号后会弹出1.5阶段认证的用户名和密码: