系统环境:
cisco pix 525
cisco acs server 3.2
实现功能:
远程使用cisco ipsec vpn client 3.x以上的vpn client 拨入企业网络;
远程使用ms pptp vpn拨入企业网络;
所有远程vpdn用户通过acs server 做用户验证和记帐,便于管理和实现其他pix 验证无法实现的功能,例如实现用户帐号尝试错误后锁定,访问时间等功能;
pix 525 上的配置:
jtpixfirewall# sh run
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
interface ethernet3 auto
interface ethernet4 auto
interface ethernet5 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 perimter1 security20
nameif ethernet3 perimter2 security30
nameif ethernet4 perimter3 security40
nameif ethernet5 perimter4 security50
enable password pAvMEKYodlghdOOb7Y encrypted
passwd 1ZowQT4VG2d3TbU69 encrypted
hostname jtpixfirewall
domain-name jt.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.1.5.0 test
name 10.1.8.50 netmang
access-list inside_outbound_nat0_acl permit ip 10.1.8.0 255.255.255.0 10.1.58.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip test 255.255.255.0 10.1.58.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.0.0.0 255.252.0.0 10.1.58.0 255.255.255.0
access-list jt1_splitTunnelAcl permit ip tests 255.255.255.0 any
access-list jt1_splitTunnelAcl permit ip 10.1.2.0 255.255.255.0 any
access-list acl-out permit icmp any any
pager lines 24
logging on
logging timestamp
logging trap debugging
logging history debugging
logging facility 16
logging host inside netmang
mtu outside 1500
mtu inside 1500
mtu perimter1 1500
mtu perimter2 1500
mtu perimter3 1500
mtu perimter4 1500
ip address outside 222.121.48.75 255.255.255.224
ip address inside 10.1.8.12 255.255.255.0
ip address perimter1 127.0.0.1 255.255.255.255
no ip address perimter2
no ip address perimter3
no ip address perimter4
ip audit info action alarm
ip audit attack action alarm
ip local pool local_pool 10.1.58.50-10.1.58.100
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address perimter1
no failover ip address perimter2
no failover ip address perimter3
no failover ip address perimter4
pdm location 10.1.9.50 255.255.255.255 inside
pdm location 10.1.9.0 255.255.255.0 inside
pdm location 10.1.9.0 255.255.255.0 perimter1
pdm location 10.1.1.253 255.255.255.255 inside
pdm location 10.1.0.0 255.255.0.0 inside
pdm location 10.1.1.253 255.255.255.255 perimter1
pdm location test 255.255.255.0 inside
pdm location 10.0.0.0 255.252.0.0 inside
pdm location 10.1.58.0 255.255.255.0 outside
pdm location netmang 255.255.255.255 inside
pdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 10.1.8.0 255.255.255.0 0 0
nat (inside) 0 10.0.0.0 255.252.0.0 0 0
access-group acl-out in interface inside
rip inside default version 2
route outside 0.0.0.0 0.0.0.0 222.121.48.65 1
route inside 10.1.0.0 255.255.0.0 10.1.8.253 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server jtacs protocol radius
#指定aaa采用radius
aaa-server jtacs (inside) host netmang ddjt2008 timeout 5
#指定radius server 的ip地址和口令(ddjt2008)
aaa proxy-limit disable
aaa accounting include tcp/0 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 jtacs
#对aaa group jtacs做radius account (记帐)
http server enable
http 10.1.9.50 255.255.255.255 inside
snmp-server host inside netmang
no snmp-server location
no snmp-server contact
snmp-server community en9fk5*37
snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt radius ignore-secret
service resetinbound
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication jtacs
crypto map outside_map interface outside
isakmp enable outside
isakmp nat-traversal 20
#解决 ipsec 穿透 nat 问题;
isakmp policy 40 authentication pre-share
isakmp policy 40 encryption 3des
isakmp policy 40 hash md5
isakmp policy 40 group 2
isakmp policy 40 lifetime 86400
vpngroup test1 address-pool local_pool
vpngroup test1 dns-server 10.1.2.1
vpngroup test1 wins-server 10.1.2.1
vpngroup test1 default-domain jt
vpngroup test1 split-tunnel jt1_splitTunnelAcl
vpngroup test1 idle-time 1800
vpngroup test1 secure-unit-authentication
vpngroup tset1 user-idle-timeout 18
vpngroup test1 device-pass-through
vpngroup test1 password ********
telnet 10.1.8.0 255.255.255.0 inside
telnet 10.1.9.0 255.255.255.0 inside
telnet 10.1.1.253 255.255.255.255 inside
telnet 10.1.1.253 255.255.255.255 perimter1
telnet 10.1.1.253 255.255.255.255 perimter2
telnet 10.1.1.253 255.255.255.255 perimter3
telnet 10.1.1.253 255.255.255.255 perimter4
telnet timeout 10
ssh 10.1.9.0 255.255.255.0 inside
ssh 10.1.9.0 255.255.255.0 perimter1
ssh 10.1.9.0 255.255.255.0 perimter2
ssh 10.1.9.0 255.255.255.0 perimter
