加载中…
正文 字体大小:

890路由器EZVPN+CA认证

(2012-11-14 13:59:43)
标签:

cisco

vpn

it

分类: 网络与安全

笔者做easy vpn实验,配置如下,已验证成功。client是891路由器,版本12.4,VPN Server是ASA,版本8.1。

aaa authentication login rtr-remote local
aaa authorization network rtr-remote local

clock timezone HKST 8     //时间需正确

crypto pki trustpoint testca     //证书名
 enrollment mode ra
 enrollment url http://1.1.1.1:80/certsrv/mscep/mscep.dll     //在线注册CA
 revocation-check none 
 rsakeypair test.domain.com     //密钥对,hostname是test,域名是domain.com,大小最好1024

crypto pki certificate chain testca
 certificate 1EA19833000000000038
  308203BC 308202A4 A0030201 02020A1E A1983300 00000000 38300D06 092A8648
  86F70D01 01050500 30133111 300F0603 55040313 0856504E 4D414743 41301E17
  0D313231 31303631 30303134 335A170D 31383039 30313037 34363539 5A302031
  1E301C06 092A8648 86F70D01 0902130F 63613839 312E626A 6C6F742E 636F6D30
  5C300D06 092A8648 86F70D01 01010500 034B0030 48024100 982E251F 25DA21D7
  65EE5390 7F7BDA1B C40C28E4 8B1C5A63 87A2F572 4D4543B0 7E60D088 49706DF8
  4058D1A0 5466EA30 21A9D3C0 FFF383B5 4F02375B 0720B05F 02030100 01A38201
  CB308201 C7300B06 03551D0F 04040302 05A0301D 0603551D 0E041604 14B58D91
  96B09CB6 4051EA65 0CCF087C 444B39A2 6B301F06 03551D23 04183016 80144CDD
  4B1D4789 D9B20920 1B67C0E2 C0984AA7 9C67306F 0603551D 1F046830 663064A0
  62A06086 2D687474 703A2F2F 71677467 2E626A6C 6F742E63 6F6D2F43 65727445
  6E726F6C 6C2F5650 4E4D4147 43412E63 726C862F 66696C65 3A2F2F5C 5C716774
  672E626A 6C6F742E 636F6D5C 43657274 456E726F 6C6C5C56 504E4D41 4743412E
  63726C30 81A60608 2B060105 05070101 04819930 81963048 06082B06 01050507
  3002863C 68747470 3A2F2F71 6774672E 626A6C6F 742E636F 6D2F4365 7274456E
  726F6C6C 2F716774 672E626A 6C6F742E 636F6D5F 56504E4D 41474341 2E637274
  304A0608 2B060105 05073002 863E6669 6C653A2F 2F5C5C71 6774672E 626A6C6F
  742E636F 6D5C4365 7274456E 726F6C6C 5C716774 672E626A 6C6F742E 636F6D5F
  56504E4D 41474341 2E637274 301D0603 551D1101 01FF0413 3011820F 63613839
  312E626A 6C6F742E 636F6D30 3F06092B 06010401 82371402 04321E30 00490050
  00530045 00430049 006E0074 00650072 006D0065 00640069 00610074 0065004F
  00660066 006C0069 006E0065 300D0609 2A864886 F70D0101 05050003 82010100
  224A0D66 E5C49C19 393A5055 AD4B348F 5375B26F B95987C0 B458675C E1F8FB69
  35500E96 B54DC69A 95CC72DF CA5D27A0 29B978AF F17BBA73 885AFACD 44EB553B
  32A824C5 CAF79AC4 351B8A25 3B7ACDB9 2118A5BF 527E27C6 601B561D 105A3CE7
  F2113868 F5F382C6 690D9564 686F0E1F DE665FFA 2B681C6B A65FFEEA ECA67562
  C9EBFAB3 FDB175AE B64415B9 4F0AF6A3 9B7A5829 241396E0 03A6BAB4 D5936CD4
  55B5E0AF 559DC5A1 C3410699 01DE7654 8D6D59B6 20DBDD76 84A64EA0 E7864236
  FFCB276F CD112B19 B8F91E7B BE3243DF 66293484 58BA275D 0605A176 8CAD1058
  3F9EB2B1 4A4BDDF0 CE374796 9BF3D8E6 6AAFB995 E993455F 0E50600E 83
  B48D0E
        quit
 certificate testca 5524AFAF35AEC78047EB27D64889D672
  30820374 3082025C A0030201 02021055 24AFAF35 AEC78047 EB27D648 89D67230
  0D06092A 864886F7 0D010105 05003013 3111300F 06035504 03130856 504E4D41
  47434130 1E170D30 38303930 31303733 3830385A 170D3138 30393031 30373436
  35395A30 13311130 0F060355 04031308 56504E4D 41474341 30820122 300D0609
  2A864886 F70D0101 01050003 82010F00 3082010A 02820101 00BC8512 96AF1B87
  16509C0F CC7719EB 46ACEFFC 387136DD 299FB9B7 5267FCBC 002C359C 7AA90098
  1006839B 51337F8A 737A73FE D8835AC9 B8B88F07 5B1EAD9F C641B204 7A9C9F5B
  1F420F61 E9C22936 E774CB4D A41EB945 E24EA655 B338003A C3492DBE C4C5930A
  8318863C A76BE327 E5DDD537 C144E8E0 6CD6FE92 C6E9F913 AACBEAED 36C14CC7
  3BBD9005 F9186970 31EDF7A2 65923C7E DE46E628 DAA54A6F 7D928913 26AFFA72
  FAC8CE7C 42DEAB18 62B1CB55 9E4FCF41 EDA1A5AA F6094A7A 7AF49092 FC4D48E2
  042F63A6 282067C5 AEBF2546 85B3F2F1 8F0E9D19 0B22B069 D8E18F0F C8278831
  5383412F D155A51E A990A1D0 2FC8BC84 0278DAD0 85D3A1E8 A7020301 0001A381
  C33081C0 300B0603 551D0F04 04030201 86300F06 03551D13 0101FF04 05300301
  01FF301D 0603551D 0E041604 144CDD4B 1D4789D9 B209201B 67C0E2C0 984AA79C
  67306F06 03551D1F 04683066 3064A062 A060862D 68747470 3A2F2F71 6774672E
  626A6C6F 742E636F 6D2F4365 7274456E 726F6C6C 2F56504E 4D414743 412E6372
  6C862F66 696C653A 2F2F5C5C 71677467 2E626A6C 6F742E63 6F6D5C43 65727445
  6E726F6C 6C5C5650 4E4D4147 43412E63 726C3010 06092B06 01040182 37150104
  03020100 300D0609 2A864886 F70D0101 05050003 82010100 8A85DCD5 B226D702
  BD7613DE 38C0048D 5B7BA71D 509EC421 BE1FB5E7 C6B25D71 707B3352 AC8F3C83
  2E25F3EE C3B46553 783B7E6B 9C1BAE99 FFC62616 EFBCDFED 16AA1DC1 5E35D038
  B599E36B EB90D9A9 78ABBDE9 9EBD8FFC 9ABCE5E3 3ECD9EE8 EA0C9520 505C22C7
  74D30D0F CBDED144 6A66B344 1F59520F EF427D5E 8E370D7D 28197B65 A3112861
  2CF18376 056F22D2 FFCFA132 A582B551 945E36D6 36C11342 74988633 3AE18457
  B86A5243 037849D7 6492CC7F 08529B6C 52CC9D95 4AA2F699 31CF271A E444830A
  D3868965 77A53F97 52BCD517 0BAE0C25 7CF4E1FD 0E52A3F5 E13EB918 62457702
  6545F6C7 57203B9B 82C41BFC 30299A77 D76770EC 647740FE
        quit

ip domain name domain.com

username user privilege 15 password 0 passwd

crypto isakmp policy 1     //必需和server一致
 encr aes 256
 group 2
crypto isakmp keepalive 100
!
crypto isakmp client configuration group testgroup
 key 123
 domain domain.com
crypto isakmp profile pro     //profile
   ca trust-point testca     //指定证书
   match identity group testgroup 
   client configuration address respond
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set set1 esp-aes 256 esp-sha-hmac     //和policy对应

crypto ipsec client ezvpn ezvpn
 connect auto
 mode network-extension
 peer 10.10.10.10     //VPN Server地址
 xauth userid mode interactive
!
!
crypto dynamic-map dymap 1
 set transform-set set1
 set isakmp-profile pro
 reverse-route
!
!
crypto map mymap isakmp authorization list rtr-remote
crypto map mymap client configuration address respond
crypto map mymap 10 ipsec-isakmp dynamic dymap

interface Loopback0
 description inside
 ip address 192.168.1.1 255.255.255.0
 crypto ipsec client ezvpn ezvpn inside     //inside接口必须指定,而且是双up

interface GigabitEthernet0     //outside接口
 ip address dhcp
 duplex auto
 speed auto
 crypto map mymap
 crypto ipsec client ezvpn ezvpn

0

阅读 评论 收藏 转载 喜欢 打印举报
  • 评论加载中,请稍候...
发评论

    发评论

    以上网友发言只代表其个人观点,不代表新浪网的观点或立场。

      

    新浪BLOG意见反馈留言板 电话:4006900000 提示音后按1键(按当地市话标准计费) 欢迎批评指正

    新浪简介 | About Sina | 广告服务 | 联系我们 | 招聘信息 | 网站律师 | SINA English | 会员注册 | 产品答疑

    新浪公司 版权所有