转http://2294439.blog.51cto.com/2284439/733246

ASA ipsec ×××_第1张图片
 
 
ASA1:
 
ciscoasa(config)# interface ethernet 0/0
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# ip add  1.1.1 .254 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config)# interface ethernet 0/2
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# ip add 202.103.1.254 255.255.255.0
ciscoasa(config-if)# no shutdown
 
ciscoasa(config)# route outside 0 0 202.103.1.1
 
ciscoasa(config)# nat-control
ciscoasa(config)# nat (inside) 1 0 0
ciscoasa(config)# global (outside) 1 interface
ciscoasa(config)# access-list unat permit i p 1.1.1 .0 255.255.255.0 2.2.2.0 255.255.255.0
ciscoasa(config)# nat (inside) 0 access-list unat
 
ciscoasa(config)# crypto isakmp enable outside
 
ciscoasa(config)# crypto isakmp policy 1
ciscoasa(config-isakmp-policy)# authentication pre-share
ciscoasa(config-isakmp-policy)# encryption des
ciscoasa(config-isakmp-policy)# hash sha
ciscoasa(config-isakmp-policy)# group 2
 
ciscoasa(config)# isakmp key 123456 address 202.103.2.254
 
ciscoasa(config)# crypto ipsec transform-set set esp-des esp-sha-hmac
 
ciscoasa(config)# crypto map map 1 match address unat    
ciscoasa(config)# crypto map map 1 set peer 202.103.2.254
ciscoasa(config)# crypto map map 1 set transform-set set
ciscoasa(config)# crypto map map interface outside
 
 
ASA2:
 
 
ciscoasa(config)# interface ethernet 0/2
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# ip add 202.103.2.254 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# interface ethernet 0/0
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# ip add  2.2.2 .254 255.255.255.0
ciscoasa(config-if)# no shutdown
 
ciscoasa(config)# route outside 0 0 202.103.2.1
 
ciscoasa(config)# nat-control
ciscoasa(config)# nat (inside) 1 0 0
ciscoasa(config)# global (outside) 1 interface
ciscoasa(config)# access-list unat permit i p 2.2.2 .0 255.255.255.0 1.1.1.0 255.255.255.0
ciscoasa(config)# nat (inside) 0 access-list unat
 
ciscoasa(config)# crypto isakmp enable outside
 
ciscoasa(config)# crypto isakmp policy 1
ciscoasa(config-isakmp-policy)# encryption des
ciscoasa(config-isakmp-policy)# hash sha
ciscoasa(config-isakmp-policy)# authentication pre-share
ciscoasa(config-isakmp-policy)# group 2
 
ciscoasa(config)# isakmp key 123456 address 202.103.1.254
 
ciscoasa(config)# crypto ipsec transform-set zero esp-des esp-sha-hmac
 
ciscoasa(config)# crypto map ftm 1 match address unat        
ciscoasa(config)# crypto map ftm 1 set peer 202.103.1.254       
ciscoasa(config)# crypto map ftm 1 set transform-set zero
ciscoasa(config)# crypto map ftm interface outside
 
用PC0检验