IPsec站点到站点×××配置
 
前提：没有加密通道前，数据能够正常交流。
 
Step1:  允许pix 外口进来的ipsec数据流
 
                                  Pix(config)#access-list out_in permit 50 any host 222.254.240.193
                                       Pix(config)#access-list out_in permit 51 any host 222.254.240.193
                                           Pix(config)#access-list out_in permit udp any host 222.254.240.193 eq 500
 
Sysopt connection permit-ipsec            更简略的方式，只需一条
 
 
Step2: 外口启用ISAKMP 
                                       Pix1(config)#isakmp enable outside
                                       Pix2(config)#isakmp enable outside
 
 
Step3: 配置IKE策略参数
 
Isakmp policy 10 encryption 3des
Isakmp policy 10 hash md5
Isakmp policy 10 group 2
                                           Isakmp policy 10 lifetime 2400
                                           Isakmp policy 10 autentication pre-share
                                                (Isakmp policy 10 autentication rsa-sig)     启用RSA数字签名认证（缺省）
 
pix#show isakmp policy          查看策略
 
step4: 定义预共享密钥
pix1(config)#isakmp key mykey address 202.103.96.112 netmask 255.255.255.255
pix2(config)#isakmp key mykey address 222.254.240.193 netmask 255.255.255.255
 
pix(config)#isakmp key pubkey address 0.0.0.0 netmask 0.0.0.0 (  所有通道peer都共享同一密钥)
 
 
step5: 定义加密数据流ACL
 
 
pix1(config)#
access-list crypto_date permit 192.168.1.1 255.255.255.0 192.168.2.0 255.255.255.0
pix2(config)#
access-list crypto_date permit 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
 
 
step6:  定义转换集合 transform set    两边配置一样
pix1(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac
pix2(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac
 
pix1(config)# show crypto ipsec transform-set
 
 
step7: NAT 的问题
 
pix1(config)# nat 0 access-list cryto_date
pix2(config)# nat 0 access-list cryto_date
 
step8: 配置加密图  连接policy+transform-set+peer address
 
pix1(config)# crypto map pix1map 10 ipsec-isakmp
pix1(config)# crypto map pix1map 10 match address crypto_date
pix1(config)# crypto map pix1map 10 set peer 202.103.96.112
pix1(config)# crypto map pix1map 10 set transform-set myset
pix2(config)# crypto map pix2map 10 ipsec-isakmp
pix2(config)# crypto map pix1map 10 match address crypto_date
pix2(config)# crypto map pix1map 10 set peer 222.240.254.193
pix2(config)# crypto map pix1map 10 set transform-set myset
 
 
step 9: 绑定加密图到接口
 
pix1(config)# crypto map pix1map interface outside
pix2(config)# crypto map pix2map interface outside
 
pix1#show crypto map
pix1#show crypto ipsec sa