NAT穿越VPNSec站点到站点

ASA配置
默认路由一条
ciscoasa(config)# route outside 0 0 192.168.1.1
允许其他人ping
ciscoasa(config)# access-list 100 extended permit icmp any any
ciscoasa(config)# access-group 100 in interface outside

配置管理连接策略
ciscoasa(config)# crypto isakmp enable outside
ciscoasa(config)# crypto isakmp policy 1
ciscoasa(config-isakmp-policy)# encryption 3des
ciscoasa(config-isakmp-policy)# hash md5
ciscoasa(config-isakmp-policy)# authentication pre-share
ciscoasa(config-isakmp-policy)# group 2

配置预共享密钥
ciscoasa(config)# tunnel-group 200.0.0.1 type ipsec-l2l
ciscoasa(config)# tunnel-group 200.0.0.1 ipsec-attributes
ciscoasa(config-tunnel-ipsec)# pre-shared-key vpn

配置加密流量
ciscoasa(config)#access-list vpn extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

交换数据连接的传输集
ciscoasa(config)# crypto ipsec transform-set vpn-set esp-aes esp-sha-hmac

配置crypto map
ciscoasa(config)# crypto map vpn-map 1 match address vpn
ciscoasa(config)# crypto map vpn-map 1 set peer 200.0.0.1
ciscoasa(config)# crypto map vpn-map 1 set transform-set vpn-set

将crypto map应用到接口
ciscoasa(config)# crypto map vpn-map interface outside

启用nat穿越
ciscoasa(config)# crypto isakmp nat-traversal


R1配置
路由表设置
R1(config)#ip route 192.168.2.0 255.255.255.0 192.168.1.2
R1(config)#ip route 0.0.0.0 0.0.0.0 100.0.0.2

正常PAT转换
R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)#access-list 1 permit 192.168.2.0 0.0.0.255
R1(config)#ip nat inside source list 1 interface ethernet 0/1 overload

IPSec VPN发布转换
R1(config)#ip nat inside source static udp 192.168.1.2 500 100.0.0.1 500 extendable
R1(config)#ip nat inside source static udp 192.168.1.2 4500 100.0.0.1 4500 extendable
R1(config)#interface ethernet 0/0
R1(config-if)#ip nat inside
R1(config)#interface ethernet 0/1
R1(config-if)#ip nat outside

R3配置
配置路由表
R3(config)#ip route 0.0.0.0 0.0.0.0 200.0.0.2

管理连接配置
R3(config)#crypto isakmp policy 1
R3(config-isakmp)#encryption 3des
R3(config-isakmp)#hash md5
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#group 2

预共享密钥配置
R3(config)#crypto isakmp key 0 vpn address 100.0.0.1

数据交换传输集配置
R3(config)#crypto ipsec transform-set vpn-set esp-aes esp-sha-hmac

配置加密流量列表
R3(config)#access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255

配置Crypt map
R3(config)#crypto map vpn-map 1 ipsec-isakmp
R3(config-crypto-map)#set peer 100.0.0.1
R3(config-crypto-map)#set transform-set vpn-set
R3(config-crypto-map)#match address 100

将映射应用在接口
R3(config)#interface ethernet 0/0
R3(config-if)#crypto map vpn-map

验证结果

nat端口转换成功

管理连接建立成功

数据连接有流量通过

本文出自 “梅花香自苦寒来” 博客，请务必保留此出处http://wangjunkang.blog.51cto.com/8809812/1562549