ASA的IKEv2的共享密钥和证书配置

深藏阁楼爱情的钟 2022-01-17 01:37 1091阅读 0赞

实验拓扑：  
  
  
=======================================预共享密钥认证================================  
hostname ASA1  
enable password 8Ry2YjIyt7RRXU24 encrypted  
passwd 2KFQnbNIdI.2KYOU encrypted  
names  
!  
interface Ethernet0/0  
nameif Outside  
security-level 0  
ip address 202.100.1.10 255.255.255.0  
!  
interface Ethernet0/1  
nameif Inside  
security-level 100  
ip address 10.1.1.10 255.255.255.0  
!  
interface Ethernet0/2  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Ethernet0/3  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Management0/0  
shutdown  
no nameif  
no security-level  
no ip address  
management-only  
!  
ftp mode passive  
access-list yeslab-\*\*\* extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0255.255.255.0  
pager lines 24  
logging enable  
mtu Outside 1500  
mtu Inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
route Outside 0.0.0.0 0.0.0.0 202.100.1.1 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip\_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
dynamic-access-policy-record DfltAccessPolicy  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstartwarmstart  
crypto ipsec ikev2 ipsec-proposal yeslab-proposal  
protocol esp encryption 3des  
protocol esp integrity sha-1  
crypto map yeslab-map 10 match address yeslab-\*\*\*  
crypto map yeslab-map 10 set peer 202.100.2.10  
crypto map yeslab-map 10 set ikev2 ipsec-proposal yeslab-proposal  
crypto map yeslab-map interface Outside  
crypto ikev2 policy 10  
encryption 3des  
integrity sha  
group 2  
prf sha  
lifetime seconds 86400  
crypto ikev2 enable Outside  
telnet timeout 5  
ssh timeout 5  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  
tunnel-group 202.100.2.10 type ipsec-l2l  
tunnel-group 202.100.2.10 ipsec-attributes  
ikev2 remote-authentication pre-shared-key 0 asa1-remote  
ikev2 local-authentication pre-shared-key 0 asa1-local  
!  
class-map inspection\_default  
match default-inspection-traffic  
!  
!  
policy-map type inspect dns preset\_dns\_map  
parameters  
message-length maximum client auto  
message-length maximum 512  
policy-map global\_policy  
class inspection\_default  
inspect dns preset\_dns\_map  
inspect ftp  
inspect h323 h225  
inspect h323 ras  
inspect rsh  
inspect rtsp  
inspect esmtp  
inspect sqlnet  
inspect skinny  
inspect sunrpc  
inspect xdmcp  
inspect sip  
inspect netbios  
inspect tftp  
inspect ip-options  
!  
service-policy global\_policy global  
prompt hostname context  
Cryptochecksum:2f71706149011ae8036c4bb3edd8d6f6  
: end  
\----------------------------------------------------------------  
hostname ASA2  
enable password 8Ry2YjIyt7RRXU24 encrypted  
passwd 2KFQnbNIdI.2KYOU encrypted  
names  
!  
interface Ethernet0/0  
nameif Outside  
security-level 0  
ip address 202.100.2.10 255.255.255.0  
!  
interface Ethernet0/1  
nameif Inside  
security-level 100  
ip address 192.168.1.10 255.255.255.0  
!  
interface Ethernet0/2  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Ethernet0/3  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Management0/0  
shutdown  
no nameif  
no security-level  
no ip address  
management-only  
!  
ftp mode passive  
access-list yeslab-\*\*\* extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0255.255.255.0  
pager lines 24  
logging enable  
mtu Outside 1500  
mtu Inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
route Outside 0.0.0.0 0.0.0.0 202.100.2.1 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip\_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
dynamic-access-policy-record DfltAccessPolicy  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstartwarmstart  
crypto ipsec ikev2 ipsec-proposal yeslab-proposal  
protocol esp encryption 3des  
protocol esp integrity sha-1  
crypto map yeslab-map 10 match address yeslab-\*\*\*  
crypto map yeslab-map 10 set peer 202.100.1.10  
crypto map yeslab-map 10 set ikev2 ipsec-proposal yeslab-proposal  
crypto map yeslab-map interface Outside  
crypto ikev2 policy 10  
encryption 3des  
integrity sha  
group 2  
prf sha  
lifetime seconds 86400  
crypto ikev2 enable Outside  
telnet timeout 5  
ssh timeout 5  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  
web\*\*\*  
anyconnect-essentials  
tunnel-group 202.100.1.10 type ipsec-l2l  
tunnel-group 202.100.1.10 ipsec-attributes  
ikev2 remote-authentication pre-shared-key 0 asa1-local  
ikev2 local-authentication pre-shared-key 0 asa1-remote  
!  
class-map inspection\_default  
match default-inspection-traffic  
!  
!  
policy-map type inspect dns preset\_dns\_map  
parameters  
message-length maximum client auto  
message-length maximum 512  
policy-map global\_policy  
class inspection\_default  
inspect dns preset\_dns\_map  
inspect ftp  
inspect h323 h225  
inspect h323 ras  
inspect rsh  
inspect rtsp  
inspect esmtp  
inspect sqlnet  
inspect skinny  
inspect sunrpc  
inspect xdmcp  
inspect sip  
inspect netbios  
inspect tftp  
inspect ip-options  
!  
service-policy global\_policy global  
prompt hostname context  
Cryptochecksum:f25f81615f8341e85e95b9a8eb459e74  
: end  
======================================预共享密钥加证书认证============================  
hostname ASA1  
enable password 8Ry2YjIyt7RRXU24 encrypted  
passwd 2KFQnbNIdI.2KYOU encrypted  
names  
!  
interface Ethernet0/0  
nameif Outside  
security-level 0  
ip address 202.100.1.10 255.255.255.0  
!  
interface Ethernet0/1  
nameif Inside  
security-level 100  
ip address 10.1.1.10 255.255.255.0  
!  
interface Ethernet0/2  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Ethernet0/3  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Management0/0  
shutdown  
no nameif  
no security-level  
no ip address  
management-only  
!  
ftp mode passive  
clock timezone GMT 8  
access-list yeslab-\*\*\* extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0255.255.255.0  
pager lines 24  
logging enable  
mtu Outside 1500  
mtu Inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
route Outside 0.0.0.0 0.0.0.0 202.100.1.1 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip\_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
dynamic-access-policy-record DfltAccessPolicy  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstartwarmstart  
crypto ipsec ikev2 ipsec-proposal yeslab-proposal  
protocol esp encryption 3des  
protocol esp integrity sha-1  
crypto map yeslab-map 10 match address yeslab-\*\*\*  
crypto map yeslab-map 10 set peer 202.100.2.10  
crypto map yeslab-map 10 set ikev2 ipsec-proposal yeslab-proposal  
crypto map yeslab-map 10 set trustpoint CA------注意此配置  
crypto map yeslab-map interface Outside  
crypto ca trustpoint CA  
enrollment url [http://202.100.1.1:80][http_202.100.1.1_80]  
subject-name cn=ASA1.yeslab.net  
serial-number  
crl configure  
crypto ca certificate chain CA  
certificate 02  
3082023a 308201a3 a0030201 02020102 300d0609 2a864886f70d0101 04050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303833 3532345a 170d3132 3036313430383335 32345a30  
43311830 16060355 0403130f 41534131 2e796573 6c61622e 6e65743127301106  
092a8648 86f70d01 09021604 41534131 30120603 550405130b4a4d58 31343338  
4c313445 30819f30 0d06092a 864886f7 0d010101 050003818d003081 89028181  
00a8e60c 5f2a1476 da7b421d 48416ca1 dcb4af20 076c83d7de64fa11 4839e0d1  
dee006b1 a9de2a64 d969bf51 528098d1 e449e8b5 f4267122e4980566 c6d84a85  
3f0c66ae fc3e7b93 165f2e9a 3b851d82 e7a63ceb 1859a3a49149a0cb 35f38e47  
7bc4161e 3080720d 91ef3587 a8f6020a b17fda3b a2cce79353415c29 9172ea3d  
35020301 0001a363 3061300f 0603551d 11040830 0682044153413130 0e060355  
1d0f0101 ff040403 0205a030 1f060355 1d230418 30168014d0819152 f47c8c60  
6249149d 5818bd13 81fed687 301d0603 551d0e04 16041495fe643b27 e6a36f3b  
63e2043f 24db5e2b a4579530 0d06092a 864886f7 0d01010405000381 81007774  
18d8057b ab15a02a 84348fcd aed985d0 1e6058a1 340a50c8c3393150 a3810149  
dc301417 95af943c 9cfe8484 08d3719a ba6d5a79 89659f0d5337c9a3 541b5fe8  
60a2beb0 8d40ab0f 5dff2f88 2ab5bb89 2953b8f2 200e342bda12a162 db962bed  
f9f738fd c463acfb 1a871249 649cd2ac 1636d675 985cc54a7918fa96 cb60  
quit  
certificate ca 01  
30820215 3082017e a0030201 02020101 300d0609 2a864886f70d0101 04050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303833 3333315a 170d3134 3036313430383333 33315a30  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
819f300d 06092a86 4886f70d 01010105 0003818d 0030818902818100 cc95efdd  
797a14c4 fca64b97 55c20a79 4916c1f4 f39925ad 2fc36a775b692ae6 11305887  
742ee3ed 7d91aef4 fb1343ef 9cae092a ce26e4a7 22d700126cede76b bbdc6774  
ced862be 6741a968 8588d865 c77d94f2 02374fdf 208d46f35c02a682 05b70f06  
2444bd19 33324b1f 12c87aaf 1fb05b06 372850db d6da9dac9eed5859 02030100  
01a36330 61300f06 03551d13 0101ff04 05300301 01ff300e0603551d 0f0101ff  
04040302 0186301f 0603551d 23041830 168014d0 819152f47c8c6062 49149d58  
18bd1381 fed68730 1d060355 1d0e0416 0414d081 9152f47c8c606249 149d5818  
bd1381fe d687300d 06092a86 4886f70d 01010405 0003818100327f4e 7f8c16a0  
249a53a0 f4b90e15 296eeac2 25035b5c 86588fcc 57e49e1266665ca3 88c25b35  
0f68903f 30eeb03c 35b11092 94ecf9ab e7deef80 c0cba2a8356a9363 90579285  
740e3199 d7949713 3f7acd85 a6efbe30 1a54c460 a573dfd9 b2bc57287e2e3083  
6e391a6d c6871758 77bac491 cdc00ca5 093cc959 07bbfda9 0e  
quit  
crypto ikev2 policy 10  
encryption 3des  
integrity sha  
group 2  
prf sha  
lifetime seconds 86400  
crypto ikev2 enable Outside  
telnet timeout 5  
ssh timeout 5  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  
ntp server 202.100.1.1  
tunnel-group 202.100.2.10 type ipsec-l2l  
tunnel-group 202.100.2.10 ipsec-attributes  
ikev2 remote-authentication pre-shared-key yeslabccies  
ikev2 local-authentication certificate CA  
!  
class-map inspection\_default  
match default-inspection-traffic  
!  
!  
policy-map type inspect dns preset\_dns\_map  
parameters  
message-length maximum client auto  
message-length maximum 512  
policy-map global\_policy  
class inspection\_default  
inspect dns preset\_dns\_map  
inspect ftp  
inspect h323 h225  
inspect h323 ras  
inspect rsh  
inspect rtsp  
inspect esmtp  
inspect sqlnet  
inspect skinny  
inspect sunrpc  
inspect xdmcp  
inspect sip  
inspect netbios  
inspect tftp  
inspect ip-options  
!  
service-policy global\_policy global  
prompt hostname context  
Cryptochecksum:01c54b0fd42e2a519f5d52fe62c62abc  
: end  
\-----------------------------------------------------------  
hostname ASA2  
enable password 8Ry2YjIyt7RRXU24 encrypted  
passwd 2KFQnbNIdI.2KYOU encrypted  
names  
!  
interface Ethernet0/0  
nameif Outside  
security-level 0  
ip address 202.100.2.10 255.255.255.0  
!  
interface Ethernet0/1  
nameif Inside  
security-level 100  
ip address 192.168.1.10 255.255.255.0  
!  
interface Ethernet0/2  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Ethernet0/3  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Management0/0  
shutdown  
no nameif  
no security-level  
no ip address  
management-only  
!  
ftp mode passive  
clock timezone GMT 8  
access-list yeslab-\*\*\* extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0255.255.255.0  
pager lines 24  
logging enable  
mtu Outside 1500  
mtu Inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
route Outside 0.0.0.0 0.0.0.0 202.100.2.1 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip\_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
dynamic-access-policy-record DfltAccessPolicy  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstartwarmstart  
crypto ipsec ikev2 ipsec-proposal yeslab-proposal  
protocol esp encryption 3des  
protocol esp integrity sha-1  
crypto map yeslab-map 10 match address yeslab-\*\*\*  
crypto map yeslab-map 10 set peer 202.100.1.10  
crypto map yeslab-map 10 set ikev2 ipsec-proposal yeslab-proposal  
\----本端没有必要配置此命令\----crypto map yeslab-map 10 set trustpoint CA------注意此配置  
crypto map yeslab-map interface Outside  
crypto ca trustpoint CA  
enrollment url [http://202.100.2.1:80][http_202.100.2.1_80]  
subject-name cn=ASA2.yeslab.net  
serial-number  
crl configure  
crypto ca certificate chain CA  
certificate 03  
3082023a 308201a3 a0030201 02020103 300d0609 2a864886f70d0101 04050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303834 3330345a 170d3132 3036313430383433 30345a30  
43311830 16060355 0403130f 41534132 2e796573 6c61622e6e657431 27301106  
092a8648 86f70d01 09021604 41534132 30120603 55040513 0b4a4d5831343139  
4c344b32 30819f30 0d06092a 864886f7 0d010101 050003818d003081 89028181  
00b8d6e8 1e4d9065 49836f7b 03f9e22a 217abded a48c7584917304a2 ac1fb986  
f93dadf3 ea303cba d4f41885 0fdec719 5ad5c2e5 1a5d51a2ec6616c0 46105bd2  
08a748b9 8472957a 61a737d5 8e11d7b1 785e4795 0627b12e07d82ae9 872eb411  
ac927faa 6887622f 6bfd4770 5e45abf8 d138130d 074cb4ef7a317528 d2a9b7f9  
75020301 0001a363 3061300f 0603551d 11040830 0682044153413230 0e060355  
1d0f0101 ff040403 0205a030 1f060355 1d230418 30168014d0819152 f47c8c60  
6249149d 5818bd13 81fed687 301d0603 551d0e04 1604146f68374d3c 362b0544  
660af52f 54d39ca7 11045430 0d06092a 864886f7 0d01010405000381 810040a3  
2ee69860 a119deec cb15c6b6 59fd77b1 a0831368 66c66ded9b5221e9 cd7c044a  
95de539d d45d2fb3 de8a11ed 6ff5aa09 1cc50dd9 251379c632e7598c 0126f9bf  
1249c9b9 6474838a 233d9145 d44440bb 5646d4f6 f256c6ad4c8b8cb8 9f5c7992  
0dc963d3 a3f00d3d f5e6bc6e c62d69d7 4ba1731a 51b55b09f8035f31 1a34  
quit  
certificate ca 01  
30820215 3082017e a0030201 02020101 300d0609 2a864886f70d0101 04050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303833 3333315a 170d3134 3036313430383333 33315a30  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
819f300d 06092a86 4886f70d 01010105 0003818d 0030818902818100 cc95efdd  
797a14c4 fca64b97 55c20a79 4916c1f4 f39925ad 2fc36a775b692ae6 11305887  
742ee3ed 7d91aef4 fb1343ef 9cae092a ce26e4a7 22d700126cede76b bbdc6774  
ced862be 6741a968 8588d865 c77d94f2 02374fdf 208d46f35c02a682 05b70f06  
2444bd19 33324b1f 12c87aaf 1fb05b06 372850db d6da9dac9eed5859 02030100  
01a36330 61300f06 03551d13 0101ff04 05300301 01ff300e0603551d 0f0101ff  
04040302 0186301f 0603551d 23041830 168014d0 819152f47c8c6062 49149d58  
18bd1381 fed68730 1d060355 1d0e0416 0414d081 9152f47c8c606249 149d5818  
bd1381fe d687300d 06092a86 4886f70d 01010405 0003818100327f4e 7f8c16a0  
249a53a0 f4b90e15 296eeac2 25035b5c 86588fcc 57e49e1266665ca3 88c25b35  
0f68903f 30eeb03c 35b11092 94ecf9ab e7deef80 c0cba2a8356a9363 90579285  
740e3199 d7949713 3f7acd85 a6efbe30 1a54c460 a573dfd9b2bc5728 7e2e3083  
6e391a6d c6871758 77bac491 cdc00ca5 093cc959 07bbfda9 0e  
quit  
crypto ikev2 policy 10  
encryption 3des  
integrity sha  
group 2  
prf sha  
lifetime seconds 86400  
crypto ikev2 enable Outside  
telnet timeout 5  
ssh timeout 5  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  
ntp server 202.100.2.1  
web\*\*\*  
anyconnect-essentials  
tunnel-group 202.100.1.10 type ipsec-l2l  
tunnel-group 202.100.1.10 ipsec-attributes  
ikev2 remote-authentication certificate  
ikev2 local-authentication pre-shared-key yeslabccies  
!  
class-map inspection\_default  
match default-inspection-traffic  
!  
!  
policy-map type inspect dns preset\_dns\_map  
parameters  
message-length maximum client auto  
message-length maximum 512  
policy-map global\_policy  
class inspection\_default  
inspect dns preset\_dns\_map  
inspect ftp  
inspect h323 h225  
inspect h323 ras  
inspect rsh  
inspect rtsp  
inspect esmtp  
inspect sqlnet  
inspect skinny  
inspect sunrpc  
inspect xdmcp  
inspect sip  
inspect netbios  
inspect tftp  
inspect ip-options  
!  
service-policy global\_policy global  
prompt hostname context  
Cryptochecksum:287a0c1e17b36b92f7d04d1a9157cc38  
: end  
====================================双方都用证书认证===================================  
hostname ASA1  
enable password 8Ry2YjIyt7RRXU24 encrypted  
passwd 2KFQnbNIdI.2KYOU encrypted  
names  
!  
interface Ethernet0/0  
nameif Outside  
security-level 0  
ip address 202.100.1.10 255.255.255.0  
!  
interface Ethernet0/1  
nameif Inside  
security-level 100  
ip address 10.1.1.10 255.255.255.0  
!  
interface Ethernet0/2  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Ethernet0/3  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Management0/0  
shutdown  
no nameif  
no security-level  
no ip address  
management-only  
!  
ftp mode passive  
clock timezone GMT 8  
access-list yeslab-\*\*\* extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0255.255.255.0  
pager lines 24  
logging enable  
mtu Outside 1500  
mtu Inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
route Outside 0.0.0.0 0.0.0.0 202.100.1.1 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip\_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
dynamic-access-policy-record DfltAccessPolicy  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstartwarmstart  
crypto ipsec ikev2 ipsec-proposal yeslab-proposal  
protocol esp encryption 3des  
protocol esp integrity sha-1  
crypto map yeslab-map 10 match address yeslab-\*\*\*  
crypto map yeslab-map 10 set peer 202.100.2.10  
crypto map yeslab-map 10 set ikev2 ipsec-proposal yeslab-proposal  
crypto map yeslab-map 10 set trustpoint CA  
crypto map yeslab-map interface Outside  
crypto ca trustpoint CA  
enrollment url [http://202.100.1.1:80][http_202.100.1.1_80]  
subject-name cn=ASA1.yeslab.net  
serial-number  
crl configure  
crypto ca certificate chain CA  
certificate 02  
3082023a 308201a3 a0030201 02020102 300d0609 2a864886f70d0101 04050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303833 3532345a 170d3132 3036313430383335 32345a30  
43311830 16060355 0403130f 41534131 2e796573 6c61622e6e657431 27301106  
092a8648 86f70d01 09021604 41534131 30120603 550405130b4a4d58 31343338  
4c313445 30819f30 0d06092a 864886f7 0d010101 050003818d003081 89028181  
00a8e60c 5f2a1476 da7b421d 48416ca1 dcb4af20 076c83d7de64fa11 4839e0d1  
dee006b1 a9de2a64 d969bf51 528098d1 e449e8b5 f4267122e4980566 c6d84a85  
3f0c66ae fc3e7b93 165f2e9a 3b851d82 e7a63ceb 1859a3a49149a0cb 35f38e47  
7bc4161e 3080720d 91ef3587 a8f6020a b17fda3b a2cce79353415c29 9172ea3d  
35020301 0001a363 3061300f 0603551d 11040830 0682044153413130 0e060355  
1d0f0101 ff040403 0205a030 1f060355 1d230418 30168014d0819152 f47c8c60  
6249149d 5818bd13 81fed687 301d0603 551d0e04 16041495fe643b27 e6a36f3b  
63e2043f 24db5e2b a4579530 0d06092a 864886f7 0d01010405000381 81007774  
18d8057b ab15a02a 84348fcd aed985d0 1e6058a1 340a50c8c3393150 a3810149  
dc301417 95af943c 9cfe8484 08d3719a ba6d5a79 89659f0d 5337c9a3541b5fe8  
60a2beb0 8d40ab0f 5dff2f88 2ab5bb89 2953b8f2 200e342bda12a162 db962bed  
f9f738fd c463acfb 1a871249 649cd2ac 1636d675 985cc54a7918fa96 cb60  
quit  
certificate ca 01  
30820215 3082017e a0030201 02020101 300d0609 2a864886 f70d010104050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303833 3333315a 170d3134 3036313430383333 33315a30  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
819f300d 06092a86 4886f70d 01010105 0003818d 0030818902818100 cc95efdd  
797a14c4 fca64b97 55c20a79 4916c1f4 f39925ad 2fc36a775b692ae6 11305887  
742ee3ed 7d91aef4 fb1343ef 9cae092a ce26e4a7 22d700126cede76b bbdc6774  
ced862be 6741a968 8588d865 c77d94f2 02374fdf 208d46f35c02a682 05b70f06  
2444bd19 33324b1f 12c87aaf 1fb05b06 372850db d6da9dac9eed5859 02030100  
01a36330 61300f06 03551d13 0101ff04 05300301 01ff300e0603551d 0f0101ff  
04040302 0186301f 0603551d 23041830 168014d0 819152f47c8c6062 49149d58  
18bd1381 fed68730 1d060355 1d0e0416 0414d081 9152f47c8c606249 149d5818  
bd1381fe d687300d 06092a86 4886f70d 01010405 0003818100327f4e 7f8c16a0  
249a53a0 f4b90e15 296eeac2 25035b5c 86588fcc 57e49e1266665ca3 88c25b35  
0f68903f 30eeb03c 35b11092 94ecf9ab e7deef80 c0cba2a8356a9363 90579285  
740e3199 d7949713 3f7acd85 a6efbe30 1a54c460 a573dfd9b2bc5728 7e2e3083  
6e391a6d c6871758 77bac491 cdc00ca5 093cc959 07bbfda9 0e  
quit  
crypto ikev2 policy 10  
encryption 3des  
integrity sha  
group 2  
prf sha  
lifetime seconds 86400  
crypto ikev2 enable Outside  
telnet timeout 5  
ssh timeout 5  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  
ntp server 202.100.1.1  
tunnel-group 202.100.2.10 type ipsec-l2l  
tunnel-group 202.100.2.10 ipsec-attributes  
ikev2 remote-authentication certificate  
ikev2 local-authentication certificate CA  
!  
class-map inspection\_default  
match default-inspection-traffic  
!  
!  
policy-map type inspect dns preset\_dns\_map  
parameters  
message-length maximum client auto  
message-length maximum 512  
policy-map global\_policy  
class inspection\_default  
inspect dns preset\_dns\_map  
inspect ftp  
inspect h323 h225  
inspect h323 ras  
inspect rsh  
inspect rtsp  
inspect esmtp  
inspect sqlnet  
inspect skinny  
inspect sunrpc  
inspect xdmcp  
inspect sip  
inspect netbios  
inspect tftp  
inspect ip-options  
!  
service-policy global\_policy global  
prompt hostname context  
Cryptochecksum:deb8d6aeef7e269a78c07972a5c1f3b3  
: end  
\----------------------------------------------------------------------  
hostname ASA2  
enable password 8Ry2YjIyt7RRXU24 encrypted  
passwd 2KFQnbNIdI.2KYOU encrypted  
names  
!  
interface Ethernet0/0  
nameif Outside  
security-level 0  
ip address 202.100.2.10 255.255.255.0  
!  
interface Ethernet0/1  
nameif Inside  
security-level 100  
ip address 192.168.1.10 255.255.255.0  
!  
interface Ethernet0/2  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Ethernet0/3  
shutdown  
no nameif  
no security-level  
no ip address  
!  
interface Management0/0  
shutdown  
no nameif  
no security-level  
no ip address  
management-only  
!  
ftp mode passive  
clock timezone GMT 8  
access-list yeslab-\*\*\* extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0255.255.255.0  
pager lines 24  
logging enable  
mtu Outside 1500  
mtu Inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
route Outside 0.0.0.0 0.0.0.0 202.100.2.1 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip\_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
dynamic-access-policy-record DfltAccessPolicy  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstartwarmstart  
crypto ipsec ikev2 ipsec-proposal yeslab-proposal  
protocol esp encryption 3des  
protocol esp integrity sha-1  
crypto map yeslab-map 10 match address yeslab-\*\*\*  
crypto map yeslab-map 10 set peer 202.100.1.10  
crypto map yeslab-map 10 set ikev2 ipsec-proposal yeslab-proposal  
crypto map yeslab-map 10 set trustpoint CA  
crypto map yeslab-map interface Outside  
crypto ca trustpoint CA  
enrollment url [http://202.100.2.1:80][http_202.100.2.1_80]  
subject-name cn=ASA2.yeslab.net  
serial-number  
crl configure  
crypto ca certificate chain CA  
certificate 03  
3082023a 308201a3 a0030201 02020103 300d0609 2a864886f70d0101 04050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303834 3330345a 170d3132 3036313430383433 30345a30  
43311830 16060355 0403130f 41534132 2e796573 6c61622e 6e65743127301106  
092a8648 86f70d01 09021604 41534132 30120603 550405130b4a4d58 31343139  
4c344b32 30819f30 0d06092a 864886f7 0d010101 050003818d003081 89028181  
00b8d6e8 1e4d9065 49836f7b 03f9e22a 217abded a48c7584917304a2 ac1fb986  
f93dadf3 ea303cba d4f41885 0fdec719 5ad5c2e5 1a5d51a2ec6616c0 46105bd2  
08a748b9 8472957a 61a737d5 8e11d7b1 785e4795 0627b12e07d82ae9 872eb411  
ac927faa 6887622f 6bfd4770 5e45abf8 d138130d 074cb4ef7a317528 d2a9b7f9  
75020301 0001a363 3061300f 0603551d 11040830 0682044153413230 0e060355  
1d0f0101 ff040403 0205a030 1f060355 1d230418 30168014d0819152 f47c8c60  
6249149d 5818bd13 81fed687 301d0603 551d0e04 1604146f68374d3c 362b0544  
660af52f 54d39ca7 11045430 0d06092a 864886f7 0d01010405000381 810040a3  
2ee69860 a119deec cb15c6b6 59fd77b1 a0831368 66c66ded9b5221e9 cd7c044a  
95de539d d45d2fb3 de8a11ed 6ff5aa09 1cc50dd9 251379c632e7598c 0126f9bf  
1249c9b9 6474838a 233d9145 d44440bb 5646d4f6 f256c6ad4c8b8cb8 9f5c7992  
0dc963d3 a3f00d3d f5e6bc6e c62d69d7 4ba1731a 51b55b09f8035f31 1a34  
quit  
certificate ca 01  
30820215 3082017e a0030201 02020101 300d0609 2a864886f70d0101 04050030  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
1e170d31 31303631 35303833 3333315a 170d3134 3036313430383333 33315a30  
1e311c30 1a060355 04031313 496e7465 726e6574 2e7965736c61622e 6e657430  
819f300d 06092a86 4886f70d 01010105 0003818d 0030818902818100 cc95efdd  
797a14c4 fca64b97 55c20a79 4916c1f4 f39925ad 2fc36a775b692ae6 11305887  
742ee3ed 7d91aef4 fb1343ef 9cae092a ce26e4a7 22d700126cede76b bbdc6774  
ced862be 6741a968 8588d865 c77d94f2 02374fdf 208d46f35c02a682 05b70f06  
2444bd19 33324b1f 12c87aaf 1fb05b06 372850db d6da9dac9eed5859 02030100  
01a36330 61300f06 03551d13 0101ff04 05300301 01ff300e0603551d 0f0101ff  
04040302 0186301f 0603551d 23041830 168014d0 819152f47c8c6062 49149d58  
18bd1381 fed68730 1d060355 1d0e0416 0414d081 9152f47c8c606249 149d5818  
bd1381fe d687300d 06092a86 4886f70d 01010405 0003818100327f4e 7f8c16a0  
249a53a0 f4b90e15 296eeac2 25035b5c 86588fcc 57e49e1266665ca3 88c25b35  
0f68903f 30eeb03c 35b11092 94ecf9ab e7deef80 c0cba2a8356a9363 90579285  
740e3199 d7949713 3f7acd85 a6efbe30 1a54c460 a573dfd9 b2bc57287e2e3083  
6e391a6d c6871758 77bac491 cdc00ca5 093cc959 07bbfda9 0e  
quit  
crypto ikev2 policy 10  
encryption 3des  
integrity sha  
group 2  
prf sha  
lifetime seconds 86400  
crypto ikev2 enable Outside  
telnet timeout 5  
ssh timeout 5  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept  
ntp server 202.100.2.1  
web\*\*\*  
anyconnect-essentials  
tunnel-group 202.100.1.10 type ipsec-l2l  
tunnel-group 202.100.1.10 ipsec-attributes  
ikev2 remote-authentication certificate  
ikev2 local-authentication certificate CA  
!  
class-map inspection\_default  
match default-inspection-traffic  
!  
!  
policy-map type inspect dns preset\_dns\_map  
parameters  
message-length maximum client auto  
message-length maximum 512  
policy-map global\_policy  
class inspection\_default  
inspect dns preset\_dns\_map  
inspect ftp  
inspect h323 h225  
inspect h323 ras  
inspect rsh  
inspect rtsp  
inspect esmtp  
inspect sqlnet  
inspect skinny  
inspect sunrpc  
inspect xdmcp  
inspect sip  
inspect netbios  
inspect tftp  
inspect ip-options  
!  
service-policy global\_policy global  
prompt hostname context  
Cryptochecksum:a2d8e9774ef16bfd32ae25849d006b28  
: end

转载于:https://blog.51cto.com/xushen/1286843

[http_202.100.1.1_80]: http://202.100.1.1/
[http_202.100.2.1_80]: http://202.100.2.1/