多个思科PIX防火墙配置点到点VPN实例

这里是三个PIX515防火墙,版本呢都是6.3,在很多时候我们都是通过专线连接着三个pix防火墙,但以防万一但专线故障是我们是否可以通过防火墙的vpn来连接呢?请看下面的实例:
PIX Central
  Building configuration…
  : Saved
  :
  PIX Version 6.3(3)
  in terface ethernet0 auto
  interface ethernet1 auto
  nameif ethernet0 outside security0
  nameif ethernet1 inside security100
  enable password 8Ry2YjIyt7RRXU24 encrypted
  passwd 2KFQnbNIdI.2KYOU encrypted
  hostname pix-central
  fixup protocol dns maximum-length 512
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol skinny 2000
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names
  !— This is traffic to PIX 2.
  access-list 120 permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
  !— This is traffic to PIX 3.
  access-list 130 permit ip 10.1.1.0 255.255.255.0 10.3.3.0 255.255.255.0
  !— Do not do Network Address Translation (NAT) on traffic to other PIXes.
  access-list 100 permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
  access-list 100 permit ip 10.1.1.0 255.255.255.0 10.3.3.0 255.255.255.0
  pager lines 24
  logging on
  mtu outside 1500
  mtu inside 1500
  ip address outside 172.18.124.153 255.255.255.0
  ip address inside 10.1.1.1 255.255.255.0
  ip audit info action alarm
  ip audit attack action alarm
  pdm history enable
  arp timeout 14400
  !— Do not do NAT on traffic to other PIXes.
  nat (inside) 0 access-list 100
  route outside 0.0.0.0 0.0.0.0 172.18.124.1 1
  timeout xlate 3:00:00
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
  timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
  timeout uauth 0:05:00 absolute
  aaa-server TACACS+ protocol tacacs+
  aaa-server RADIUS protocol radius
  aaa-server LOCAL protocol local
  no snmp-server location
  no snmp-server contact
  snmp-server community public
  snmp-server enable traps
  floodguard enable
  sysopt connection permit-ipsec
  crypto ipsec transform-set myset esp-des esp-md5-hmac
  !— This is traffic to PIX 2.
  crypto map newmap 20 ipsec-isakmp
  crypto map newmap 20 match address 120
  crypto map newmap 20 set peer 172.18.124.154
  crypto map newmap 20 set transform-set myset
  !— This is traffic to PIX 3.
  crypto map newmap 30 ipsec-isakmp
  crypto map newmap 30 match address 130
  crypto map newmap 30 set peer 172.18.124.157
  crypto map newmap 30 set transform-set myset
  crypto map newmap interface outside
  isakmp enable outside
  isakmp key ******** address 172.18.124.154 netmask 255.255.255.255
  no-xauth no-config-mode
  isakmp key ******** address 172.18.124.157 netmask 255.255.255.255
  no-xauth no-config-mode
  isakmp identity address
  isakmp policy 10 authentication pre-share
  isakmp policy 10 encryption des
  isakmp policy 10 hash md5
  isakmp policy 10 group 1
  isakmp policy 10 lifetime 1000
  telnet timeout 5
  ssh timeout 5
  console timeout 0
  terminal width 80
  Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
  : end
  PIX 2
  Building configuration…
  : Saved
  :
  PIX Version 6.3(3)
  interface ethernet0 auto
  interface ethernet1 auto
  nameif ethernet0 outside security0
  nameif ethernet1 inside security100
  enable password 8Ry2YjIyt7RRXU24 encrypted
  passwd 2KFQnbNIdI.2KYOU encrypted
  hostname pix2
  fixup protocol dns maximum-length 512
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol skinny 2000
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names
  !— This is traffic to PIX Central.
  access-list 110 permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0
  !— Do not do NAT on traffic to PIX Central.
  access-list 100 permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0
  pager lines 24
  logging on
  mtu outside 1500
  mtu inside 1500
  ip address outside 172.18.124.154 255.255.255.0
  ip address inside 10.2.2.1 255.255.255.0
  ip audit info action alarm
  ip audit attack action alarm
  no failover
  failover timeout 0:00:00
  failover poll 15
  no failover ip address outside
  no failover ip address inside
  pdm history enable
  arp timeout 14400
  !— Do not do NAT on traffic to PIX Central.
  nat (inside) 0 access-list 100
  route outside 0.0.0.0 0.0.0.0 172.18.124.1 1
  timeout xlate 3:00:00
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
  timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
  timeout uauth 0:05:00 absolute
  aaa-server TACACS+ protocol tacacs+
  aaa-server RADIUS protocol radius
  aaa-server LOCAL protocol local
  no snmp-server location
  no snmp-server contact
  snmp-server community public
  no snmp-server enable traps
  floodguard enable
  sysopt connection permit-ipsec
  crypto ipsec transform-set myset esp-des esp-md5-hmac
  !— This is traffic to PIX Central.
  crypto map newmap 10 ipsec-isakmp
  crypto map newmap 10 match address 110
  crypto map newmap 10 set peer 172.18.124.153
  crypto map newmap 10 set transform-set myset
  crypto map newmap interface outside
  isakmp enable outside
  isakmp key ******** address 172.18.124.153 netmask 255.255.255.255
  no-xauth no-config-mode
  isakmp identity address
  isakmp policy 10 authentication pre-share
  isakmp policy 10 encryption des
  isakmp policy 10 hash md5
  isakmp policy 10 group 1
  isakmp policy 10 lifetime 1000
  telnet timeout 5
  ssh timeout 5
  console timeout 0
  terminal width 80
  Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
  : end
  PIX 3 Configuration
  Building configuration…
  : Saved
  :
  PIX Version 6.3(3)
  interface ethernet0 auto
  interface ethernet1 auto
  nameif ethernet0 outside security0
  nameif ethernet1 inside security100
  enable password 8Ry2YjIyt7RRXU24 encrypted
  passwd 2KFQnbNIdI.2KYOU encrypted
  hostname pix3
  fixup protocol dns maximum-length 512
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol skinny 2000
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names
  !— This is traffic to PIX Central.
  access-list 110 permit ip 10.3.3.0 255.255.255.0 10.1.1.0 255.255.255.0
  !— Do not do NAT on traffic to PIX Central.
  access-list 100 permit ip 10.3.3.0 255.255.255.0 10.1.1.0 255.255.255.0
  pager lines 24
  logging on
  mtu outside 1500
  mtu inside 1500
  ip address outside 172.18.124.157 255.255.255.0
  ip address inside 10.3.3.1 255.255.255.0
  ip audit info action alarm
  ip audit attack action alarm
  no failover
  failover timeout 0:00:00
  failover poll 15
  no failover ip address outside
  no failover ip address inside
  pdm history enable
  arp timeout 14400
  !— Do not do NAT on traffic to PIX Central.
  nat (inside) 0 access-list 100
  route outside 0.0.0.0 0.0.0.0 172.18.124.1 1
  timeout xlate 3:00:00
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
  timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
  timeout uauth 0:05:00 absolute
  aaa-server TACACS+ protocol tacacs+
  aaa-server RADIUS protocol radius
  aaa-server LOCAL protocol local
  no snmp-server location
  no snmp-server contact
  snmp-server community public
  no snmp-server enable traps
  floodguard enable
  sysopt connection permit-ipsec
  crypto ipsec transform-set myset esp-des esp-md5-hmac
  !— This is traffic to PIX Central.
  crypto map newmap 10 ipsec-isakmp
  crypto map newmap 10 match address 110
  crypto map newmap 10 set peer 172.18.124.153
  crypto map newmap 10 set transform-set myset
  crypto map newmap interface outside
  isakmp enable outside
  isakmp key ******** address 172.18.124.153 netmask 255.255.255.255
  no-xauth no-config-mode
  isakmp identity address
  isakmp policy 10 authentication pre-share
  isakmp policy 10 encryption des
  isakmp policy 10 hash md5
  isakmp policy 10 group 1
  isakmp policy 10 lifetime 1000
  telnet timeout 5
  ssh timeout 5
  console timeout 0
  terminal width 80
  Cryptochecksum:aa3bbd8c6275d214b153e1e0bc0173e4
  : end

发表评论

电子邮件地址不会被公开。 必填项已用*标注