Cisco ASA5510配置 远程访问×××

1、网络拓扑图

 

网络拓扑图

2、ASA具体配置

部分已经省略

ASA5510# show run
: Saved
:
ASA Version 7.2(3)
!
hostname ASA5510
domain-name zqy.com
enable password oQMJ3TXqSC.skFhg encrypted
names
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address …… 255.255.255.252
!
interface Ethernet0/1
 nameif dmz
 security-level 50
 ip address 192.168.100.254 255.255.255.0
!

interface Ethernet0/2
 nameif inside2
 security-level 100
 ip address 10.0.0.5 255.255.255.252
!            
interface Management0/0
 shutdown    
 no nameif   
 no security-level
 no ip address
 management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone HKST 8
dns server-group DefaultDNS
 domain-name zqy.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list in-out-nat extended deny ip host 192.168.1.188 any
access-list in-out-nat extended permit ip 192.168.1.0 255.255.255.0 any
……………………这是省略一万字

ip local pool ez***_pool 172.16.10.100-172.16.10.200 mask 255.255.255.0
no failover
nat-control
global (outside) ……
nat (dmz) 1 0.0.0.0 0.0.0.0
nat (inside2) 1 0.0.0.0 0.0.0.0
static (inside2,outside) ……
……省略一万字
access-group out-in in interface outside
access-group dmz-out-nat in interface dmz
access-group in-out-nat in interface inside2
route outside ……
!
aaa-server ***_radius protocol radius
aaa-server ***_radius (inside2) host 192.168.1.7
 timeout 5
 key ASA5510
aaa authentication enable console ***_radius
aaa accounting enable console ***_radius
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
console timeout 0
!

group-policy ***group internal
group-policy ***group attributes
 wins-server value 172.16.10.100 172.16.10.100
 dns-server value 192.168.1.13 192.168.1.14
 ***-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ez***_splitTunnelAcl
 default-domain value ipgchina.com
username zqy password O0qvlbgGwBBckWRt encrypted privilege 15
tunnel-group ***group type ipsec-ra
tunnel-group ***group general-attributes
 address-pool ez***_pool
 authentication-server-group ***_radius
 default-group-policy ***group
tunnel-group ***group ipsec-attributes
 pre-shared-key *
smtp-server 192.168.0.155 192.168.0.156
prompt hostname context
Cryptochecksum:e53fcc41c616ae28c746da88e6d1e65a
: end