Announcement

**~~ttkk~~** · 02-03-2011, 12:43 PM

cả forum không có ai giúp em sao?? em thấy có rất nhiều người xem bài, vậy mà không ai chịu giúp em
Buồn wa !

**thanhnam0707** · 02-03-2011, 02:54 PM

sau khi định tuyến trên R1,Internet,R2,bạn ping từ fw1 20.0.0.2 tới fw2 50.0.0.2 đc chưa,sau khi ping đc rồi,bạn tiến hành cấu hình vpn site to site,

dùng lệnh show cryto isakmp sa để kiểm tra phase 1.
dùng lệnh show cryto ipsec sa để kiểm tra phase 2.

đây là cấu hình chi tiết và cách kiểm tra tunnel lên hay chưa.

LAN-to-LAN Tunnel Between ASA 5505 and ASA/PIX Configuration Example

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080950890.shtml#diag

This document provides a sample configuration for the LAN-to-LAN (Site-to-Site) IPsec tunnel between Cisco Security Appliances (ASA/PIX) and the Adaptive Secruity Appliance (ASA) 5505.

**~~ttkk~~** · 03-03-2011, 12:58 AM

Originally posted by thanhnam0707 View Post

sau khi định tuyến trên R1,Internet,R2,bạn ping từ fw1 20.0.0.2 tới fw2 50.0.0.2 đc chưa,sau khi ping đc rồi,bạn tiến hành cấu hình vpn site to site,

từ FW1 20.0.0.2 đã ping thành công tới FW2 50.0.0.2

Đây là file cấu hình của 2 FW ( em đã có chỉnh sửa so vơi cấu hình trước )
FW1:

PIX1# show running-config
: Saved
:
PIX Version 8.0(2)
!
hostname PIX1
enable password UwiM/pkFcM.xYc8s encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 20.0.0.2 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
passwd UwiM/pkFcM.xYc8s encrypted
ftp mode passive
access-list toInside extended permit udp any eq isakmp interface outside eq isakmp
access-list toInside extended permit esp any interface outside
access-list toPIX2 extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list NO_NAT extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat-control
global (inside) 1 interface
nat (inside) 0 access-list NO_NAT
nat (inside) 1 10.1.1.0 255.255.255.0
access-group toInside in interface outside
route outside 0.0.0.0 0.0.0.0 20.0.0.1 1
route outside 50.0.0.2 255.255.255.255 20.0.0.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mytransformset esp-3des esp-sha-hmac
crypto map mymap 2 match address toPIX2
crypto map mymap 2 set peer 50.0.0.2
crypto map mymap 2 set transform-set mytransformset
crypto map mymap interface outside
crypto isakmp enable outside
crypto isakmp policy 2
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 3600
telnet 10.1.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect icmp
!
service-policy global_policy global
tunnel-group 50.0.0.2 type ipsec-l2l
tunnel-group 50.0.0.2 ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:779c7aac1201658c3ae15e3e5b33a9f4
: end

FW2:

PIX2# show running-config
: Saved
:
PIX Version 8.0(2)
!
hostname PIX2
enable password UwiM/pkFcM.xYc8s encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 50.0.0.2 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 10.2.2.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list toInside extended permit esp any interface outside
access-list toInside extended permit udp any eq isakmp interface outside eq isakmp
access-list toPIX1 extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list NO_NAT extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat-control
global (inside) 1 interface
nat (inside) 0 access-list NO_NAT
nat (inside) 1 10.2.2.0 255.255.255.0
access-group toInside in interface outside
route outside 0.0.0.0 0.0.0.0 50.0.0.1 1
route outside 20.0.0.2 255.255.255.255 50.0.0.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mytransformset esp-3des esp-sha-hmac
crypto map mymap 2 match address toPIX1
crypto map mymap 2 set peer 20.0.0.2
crypto map mymap 2 set transform-set mytransformset
crypto map mymap interface outside
crypto isakmp enable outside
crypto isakmp policy 2
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 3600
telnet 10.2.2.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect icmp
!
service-policy global_policy global
tunnel-group 20.0.0.2 type ipsec-l2l
tunnel-group 20.0.0.2 ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:c8a7d639a1146d2db593a4a6c24edf9b
: end

từ PC1 ping (extended ping)đến PC2 không thành công ,
Em kiểm tra phases1 và phase 2:

PIX1# show crypto isakmp sa

There are no isakmp sas

PIX1# show crypto ipsec sa

There are no ipsec sas
PIX1#

Mong các anh giúp đỡ

**~~ttkk~~** · 03-03-2011, 11:06 AM

Không có ai giúp em sao ??
Mong các thầy giúp em , em đang cần hoàn thành bài tập này .

Announcement

Xin giúp em về cấu hình site-to-site VPN trên PIX 525

Xin giúp em về cấu hình site-to-site VPN trên PIX 525

Comment

Comment

Comment

Comment