【每日必學】Remote VPN

發(fā)布作者：微思網(wǎng)絡   發(fā)布時間：2017-03-20   瀏覽量：0次

實驗拓撲：

配置R1:

crypto isakmp policy 10

  authentication pre-share

 group 2

 hash md5

 enc 3des

 

crypto isakmp client configuration group ipsecgroup (驗證的group名)

key cisco123  (驗證的key)

aaa new-model

aaa authentication login noacs line none (線下保護)

line console 0

   login authentication noacs

line vty 0 15

   login authentication noacs

 

aaa authentication login remote local (本地認證)

username cisco password cisco

 

Aaa authorization network remote local (使用本地數(shù)據(jù)庫授權)

 

Ip local pool ippool 10.1.1.1 10.1.1.100   //為vpn客戶端分配的IP地址池

 

Crypto isakmp client config group ipsecgroup

   Poop ippool (可以為不同的組分配不同的策略)

   netmask 255.255.255.0

 

配置切分通道split tunneling，只是到172.16.1.0/24的流量要加密.

access-list 100 permit ip 172.16.1.0 0.0.0.255 any

 

Crypto isakmp client config group ipsecgroup

   acl 100

 

Crypto isakmp profile ciscopro

   Match identity group ipsecgroup

   Client configuration address respond

   Client authentication list remote

   isakmp authorization list remote

 

Crypto ipsec transform-set myset esp-3des esp-md5-hmac

 

Crypto dynamic dycisco 10

    Set trans myset

    Set isakmp-profile ciscopro

    Reverse-route

 

Crypto map mymap 10 ipsec-isakmp dynamic dycisco

在接口下應用mymap

Interface f0/1

  Crypto map mymap

 

 

撥號后會彈出1.5階段認證的用戶名和密碼: