ASA Firewall IPSEC
Experiment with ASA Firewall IPSEC
The steps of the experiment:
1. First configure the ip address on R1 and R2, and configure the default route on R1 and R3.
two。 Configure ASA1 and ASA 2
First, ASA1 initializes
Then change the name and configure the interface name and IP address as well as default and static routes
First turn on ISAKMP/IKE
In the first stage of configuration, the security policy (priority is 1, note: the smaller the number, the larger the number)
Define five elements: define encryption (encryption), define hash authentication (hash), define authentication (authentcation), define DH encryption strength (group), define life cycle (lifetime)
Crypto isakmp key abc123 address 20.1.1.2 / / pre-shared key / /
Access-list 110permit ip 192.168.10.0255.255.255.0 192.168.20.0255.255.255.0 / / Traffic of interest in configuration / /
Crypto ipsec transform-set benet esp-aes esp-sha-hmac / / configuring transfer sets / /
And then establish a session.
Crypto map benetmap 1 set peer 20.1.1.2 / / first define the name and priority, and then call / /
Crypto map benetmap 1 set transform-set benet / / configuring the transfer set / /
Crypto map benetmap 1 match address 110 / / matching ACL//
Crypto map benetmap interface outside / / Last application port / /
Then ASA2 initializes
Then change the name and configure the interface name and IP address as well as default and static routes
First turn on ISAKMP/IKE
In the first stage of configuration, the security policy (priority is 1, note: the smaller the number, the larger the number)
Define five elements: define encryption (encryption), define hash authentication (hash), define authentication (authentcation), define DH encryption strength (group), define life cycle (lifetime)
Crypto isakmp key abc123 address 10.1.1.2 / / pre-shared key / /
Access-list 110permit ip 192.168.20.0255.255.255.0 192.168.10.0255.255.255.0 / / Traffic of interest in configuration / /
Crypto ipsec transform-set benet esp-aes esp-sha-hmac / / configuring transfer sets / /
And then establish a session.
Crypto map benetmap 1 set peer 10.1.1.2 / / first define the name and priority, and then call / /
Crypto map benetmap 1 set transform-set benet / / configuring the transfer set / /
Crypto map benetmap 1 match address 110 / / matching ACL//
Crypto map benetmap interface outside / / Last application port / /
Finally, configure the ip address on VPC, and then C2 can't get through under C1ping.
Actual completion
