Cisco配置实例:CiscoSSLVPN配置实例Cisco认证考试

文章作者 100test 发表时间 2009:04:09 23:57:24
来源 100Test.Com百考试题网


  注意:这里的配置是SSL VPN的隧道模式
  一、网络拓扑图

  二、SSL VPN Server 配置
  软件版本:
  Cisco IOS Software, 7200 Software (C7200-ADVSECURITYK9-M), Version 12.4(9)T1, RELEASE SOFTWARE (fc2)
  VPN 客户端软件:sslclient-win-1.1.2.169.pkg
  1、格式化 disk0
  R1#format disk0:
  Format operation may take a while. Continue? [confirm]
  Format operation will destroy all data in "disk0:". Continue? [confirm]
  Format: Drive communication &. 1st Sector Write OK...
  Writing Monlib sectors.
  ........................................................................................
  Monlib write complete
  Format: All system sectors written. OK...
  Format: Total sectors in formatted partition: 8009
  Format: Total bytes in formatted partition: 4100608
  Format: Operation completed successfully.
  Format of disk0 complete
  2、上传软件
  R1#copy tftp disk0:
  Address or name of remote host []? 192.168.10.100
  Source filename []? sslclient-win-1.1.2.169.pkg
  Destination filename [sslclient-win-1.1.2.169.pkg]?
  Accessing tftp://192.168.10.100/sslclient-win-1.1.2.169.pkg...
  Loading sslclient-win-1.1.2.169.pkg from 192.168.10.100 (via FastEthernet0/0): !!
  [OK - 415090 bytes]
  415090 bytes copied in 12.892 secs (32197 bytes/sec)
  3、安装 client 软件
  R1(config)#webvpn install svc disk0:/sslclient-win-1.1.2.169.pkg
  SSLVPN Package SSL-VPN-Client : installed successfully
  4、配置 SSL VPN
  R1(config)# aaa new-model
  R1(config)# aaa authentication login default local //为防止控制台超时而造成无法进入Exec
  R1(config))# aaa authentication login webvpn local
  R1(config)# ip local pool ssl-add 11.1.1.10 11.1.1.20
  R1(config)# username user1 password 123 //定义WebVPN本地认证用户名,密码
  R1(config))# webvpn gateway vpngateway //定义WebVPN在哪个接口上进行监听,此时IOS会自动产生自签名证书。
  R1 (config-webvpn-gateway)# ip address 192.168.10.10 port 443
  R1 (config-webvpn-gateway)# inservice //启用webvpn gateway配置
  R1 (config)# webvpn context webcontext //定义webvpn的相关配置,相当于ASA的tunnel-group,在这里可以定义
  R1 (config-webvpn-context)# gateway vpngateway //将context和gateway相关联
  R1 (config-webvpn-context)# aaa authentication list webvpn
  R1 (config-webvpn-context)# inservice //启用webvpn context配置
  R1(config-webvpn-context)# policy group sslvpn-policy //进入sslvpn策略组
  R1(config-webvpn-group)# functions svc-enabled
  R1(config-webvpn-group)# svc address-pool ssl-add //分配svc使用的地址池
  R1(config-webvpn-group)# svc split include 192.168.20.0 255.255.255.0 //定义隧道分离的目标地址,如果不配置,则默认为0.0.0.0
  R1(config-webvpn-group)#exit
  R1(config-webvpn-context)# default-group-policy sslvpn-policy //当配置了多个policy group后,默认使用的策略组
  注意:
  在IOS中,如果地址池不和内网在一个段,则需创建一个和地址池在同一网段的loopback接口作为vpn客户端的网关。
  还可以在context中指定virtual-host,类似于iis中的文件头,允许多个主机映射到同一个IP地址
  同时context中还可以设置web登陆框的样式,比如logo,title等
  5、完整配置
  R1#show running-config
  Building configuration...
  Current configuration : 3223 bytes
  !
  version 12.4
  service timestamps debug datetime msec
  service timestamps log datetime msec
  no service password-encryption
  !
  hostname R1
  !
  boot-start-marker
  boot-end-marker
  !
  !
  aaa new-model
  !
  !
  aaa authentication login default local
  aaa authentication login webvpn local
  !
  aaa session-id common
  !
  resource policy
  !
  ip cef
  !
  !
  !
  crypto pki trustpoint TP-self-signed-4294967295
  enrollment selfsigned
  subject-name cn=IOS-Self-Signed-Certificate-4294967295
  revocation-check none
  rsakeypair TP-self-signed-4294967295
  !
  !
  crypto pki certificate chain TP-self-signed-4294967295
  certificate self-signed 01
  3082023A 308201A3 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 34323934 39363732 3935301E 170D3038 31323135 31393039
  30335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 32393439
  36373239 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  8100C6F2 B499879D 1CEB3638 BA59B459 A72167BB FDD2CD73 3E3E6FB6
  D1347E43
  8CC21C65 BAC01E28 50013497 71CF8062 C54F254C A6DB2D5A CDDB864D
  CFF71A50
  F3C20566 1405E49B 18CE2DAB 469C58E8 5B4A1FD6 59DCBCA5 12A34543
  4F6842B6
  24B9A7BD CE36E98A A5463EB3 2D2C5BC0 FAA247C1 E44DB455 4537465F
  18895A14
  66D10203 010001A3 62306030 0F060355 1D130101 FF040530 030101FF 300D0603
  551D1104 06300482 02523130 1F060355 1D230418 30168014 9F7F1B46 F6903BC5
  803F4AD7 2433EBD0 5813E29D 301D0603 551D0E04 1604149F 7F1B46F6
  903BC580
  3F4AD724 33EBD058 13E29D30 0D06092A 864886F7 0D010104 05000381
  81002516
  3F75E2AA 33544113 9A9179DB DFED2529 DF5A972F C2BFDE0E 0279D1F5
  8D30CAC7
  59BE79C6 85825281 AB2D0B08 2CA84D01 85A4DB19 8977BC82 9E59F764
  ADE75E22
  9A7FF37A 9D83819A 2287BE75 773FAA32 D38DD3C2 2C0DF23F 7D45D7A3
  E8006C1A
  6B9E0540 12483241 6EEAA0FF B31240F3 94044BCB 75210037 FEF5AD15 F49B
  quit
  username user1 password 0 123
  !
  !
  !
  !
  !
  !



相关文章


网络安全:老生常谈隐形的企业网络问题Cisco认证考试
思科统一运算系统(UCS)策略的启示Cisco认证考试
Cisco配置实例:CiscoSSLVPN配置实例Cisco认证考试
网络需整合节能环保数据中心绿色是趋势Cisco认证考试
澳大利亚华人论坛
考好网
日本华人论坛
华人移民留学论坛
英国华人论坛