ASA 5505和ASA5515点对点VPN

dakaiyan

1、ASA5515配置：
access-list vpn extended permit ip 172.31.15.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list vpn extended permit icmp 172.31.15.0 255.255.255.0 192.168.15.0 255.255.255.0


route outside 0.0.0.0 0.0.0.0 2.2.2.1 1
route inside 172.31.15.0 255.255.255.0 172.16.0.1 1


crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map vpn_map 1 match address vpn
crypto map vpn_map 1 set peer 1.1.1.2
crypto map vpn_map 1 set ikev1 transform-set ESP-AES-SHA
crypto map vpn_map interface outside


crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400


tunnel-group 1.1.1.2 type ipsec-l2l
tunnel-group 1.1.1.2 ipsec-attributes
ikev1 pre-shared-key *****


2、ASA5505配置：
access-list vpn extended permit ip 192.168.15.0 255.255.255.0 172.31.15.0 255.255.255.0
access-list vpn extended permit icmp 192.168.15.0 255.255.255.0 172.31.15.0 255.255.255.0
access-list nonat extended permit ip 192.168.15.0 255.255.255.0 172.31.15.0 255.255.255.0


global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 192.168.15.0 255.255.255.0


global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 192.168.15.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
route inside 192.168.15.0 255.255.255.0 172.16.0.1 1


crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map vpn_map 1 match address vpn
crypto map vpn_map 1 set peer 2.2.2.2
crypto map vpn_map 1 set transform-set ESP-AES-SHA
crypto map vpn_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400


tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key *****


以上配置后，ASA5505中，show crypto isakmp sa
   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 2.2.2.2
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE