如何配置Cisco pix实现VPN访问

枫速向航

PIX-Shanghai> en

Password: **********

PIX-Shanghai# show run

: Saved

:

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

na meif ethernet1 inside security100

enable password S2MnpAQ0MxnL encrypted

passwd pAQ0MxOQLJnL encrypted

hostname PIX-Shanghai

domain-name ciscofan.com

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

name 218.242.194.97 www.ciscofan.com

object-group network LAN_Interne_ICE

network-object 128.1.0.0 255.255.0.0

network-object 10.101.0.0 255.255.0.0

network-object 10.102.0.0 255.254.0.0

network-object 10.104.0.0 255.248.0.0

network-object 10.112.0.0 255.252.0.0

network-object 10.116.0.0 255.254.0.0

network-object 192.168.10.0 255.255.254.0

network-object 192.168.12.0 255.255.252.0

network-object 192.168.16.0 255.255.240.0

network-object 192.168.32.0 255.255.240.0

network-object 192.168.48.0 255.255.254.0

network-object 192.168.50.0 255.255.255.0

object-group network LAN_Remota

network-object 10.200.62.0 255.255.255.0

access-list acl_out permit ip any any

access-list acl_out permit icmp any any

access-list acl_in permit ip any any

access-list acl_in permit icmp any any

access-list acl_nat0 permit ip object-group LAN_Remota object-group LAN_Interne_

ICE

access-list cryptomap permit ip object-group LAN_Remota object-group LAN_Interne

_ICE

pager lines 24

logging on

logging timestamp

logging trap debugging

logging host outside 212.17.199.170

icmp permit host 212.17.199.170 outside

icmp permit host 212.17.199.198 outside

icmp permit host 217.56.45.123 outside

icmp permit host 217.56.45.122 outside

icmp permit host 80.23.50.226 outside

icmp permit host 212.17.199.167 outside

icmp permit host 217.17.199.198 outside

icmp permit host 80.20.218.100 outside

icmp permit host 80.20.218.108 outside

icmp permit host 211.152.x.x outside

mtu outside 1500

mtu inside 1500

ip address outside 211.152.x.x 255.255.255.240

ip address inside 10.200.62.1 255.255.255.0

ip audit name ids_attack attack action drop reset

ip audit interface outside ids_attack

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 211.152.x.x

nat (inside) 0 access-list acl_nat0

nat (inside) 1 10.200.62.0 255.255.255.0 0 0

access-group acl_out in interface outside

access-group acl_in in interface inside

conduit permit icmp any any

route outside 0.0.0.0 0.0.0.0 211.152.x.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

ntp server 193.204.114.232 source outside

http server enable

http 212.17.199.170 255.255.255.255 outside

http 212.17.199.198 255.255.255.255 outside

http 217.56.45.123 255.255.255.255 outside

http 217.56.45.122 255.255.255.255 outside

snmp-server host outside 212.17.199.170

snmp-server host outside 212.17.199.198

no snmp-server location

no snmp-server contact

snmp-server community ciscofanvpn

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto map outside_map 20 ipsec-isakmp

crypto map outside_map 20 match address cryptomap

crypto map outside_map 20 set peer 213.215.136.251

crypto map outside_map 20 set transform-set ESP-DES-MD5

crypto map outside_map 20 set security-association lifetime seconds 120 kilobyte

s 4608000

crypto map outside_map interface outside

isakmp enable outside

isakmp policy 20 authentication rsa-sig

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 120

ca identity ca1 www.ciscofan.com:/certsrv/mscep/mscep.dll

ca configure ca1 ra 1 20 crloptional

telnet timeout 5

ssh 212.17.199.170 255.255.255.255 outside

ssh 212.17.199.198 255.255.255.255 outside

ssh 217.56.45.123 255.255.255.255 outside

ssh 217.56.45.122 255.255.255.255 outside

ssh 80.23.50.226 255.255.255.255 outside

ssh 212.17.199.167 255.255.255.255 outside

ssh 80.20.218.100 255.255.255.255 outside

ssh 80.20.218.108 255.255.255.255 outside

ssh timeout 60

console timeout 0

terminal width 80

Cryptochecksum:e99eb892f5c2b5d02540352ad9d72cce

: end

PIX-Shanghai#

liusha2005

楼主 ?
在接口上同时做RA-VPN和L2L-VPN
需要注意些啥子???
请赐教????