Cisco ASA 在其自身和 CentOS 服务器之间删除了 IPsec VPN

Cisco ASA 在其自身和 CentOS 服务器之间删除了 IPsec VPN

目前,我们正在尝试在 Cisco ASA 版本 8.0(4) 和 CentOS Linux 服务器之间建立 IPsec VPN。

隧道成功建立,但由于某些我们无法弄清楚的原因,防火墙丢弃了来自 VPN 的数据包。

ASA 中的 IPsec 设置如下:

crypto ipsec transform-set up-transform-set esp-3des esp-md5-hmac

crypto ipsec transform-set up-transform-set2 esp-3des esp-sha-hmac

crypto ipsec transform-set up-transform-set3 esp-aes esp-md5-hmac

crypto ipsec transform-set up-transform-set4 esp-aes esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map linuxserver 10 match address filtro-encrypt-linuxserver


crypto map linuxserver 10 set peer linuxserver

crypto map linuxserver 10 set transform-set up-transform-set2 up-transform-set3 up-transform-set4

crypto map linuxserver 10 set security-association lifetime seconds 28800

crypto map linuxserver 10 set security-association lifetime kilobytes 4608000

crypto map linuxserver interface outside

crypto isakmp enable outside

crypto isakmp policy 1

authentication pre-share

encryption aes

hash sha

group 2

lifetime 28800

crypto isakmp policy 2

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 3

authentication pre-share

encryption aes-256

hash md5

group 2

lifetime 86400

crypto isakmp policy 4

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 5

authentication pre-share

encryption aes-192

hash md5

group 2

group-policy linuxserverip internal

group-policy linuxserverip attributes

vpn-filter value filtro-linuxserverip

tunnel-group linuxserverip type ipsec-l2l

tunnel-group linuxserverip general-attributes

default-group-policy linuxserverip

tunnel-group linuxserverip ipsec-attributes

pre-shared-key *

有人知道问题出在哪里以及如何解决吗?

答案1

您可以在 ASA 上显示 NAT 和相关访问列表吗?

例如:

访问列表 nat0 扩展允许 ip 192.168.105.0 255.255.255.0 192.168.1.0 255.255.255.0 nat (内部) 0 访问列表 nat0

这是我的 ASA 配置中的例外,用于向您展示 2 个 VPN 以及 No-Nat 访问列表和实际 VPN 访问列表之间的区别。基本上,您的 no-nat 访问列表是您的 VPN 访问列表的摘要:

!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.4.1 255.255.255.0
!
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.1.0 255.255.255.0 
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.100.0 255.255.255.0 
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 10.10.0.0 255.255.0.0 
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.7.0 255.255.255.0 
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 192.168.1.0 255.255.255.0 
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 192.168.100.0 255.255.255.0 
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 10.10.0.0 255.255.0.0 
access-list TOCHICAGO extended permit ip 192.168.4.0 255.255.255.0 192.168.7.0 255.255.255.0 
!
global (outside) 1 interface
nat (inside) 0 access-list nat0
nat (inside) 1 192.168.4.0 255.255.255.0
!
crypto map 2GRMLA 28 match address TONJ
crypto map 2GRMLA 28 set peer xxx.xxx.xxx.xxx 
crypto map 2GRMLA 28 set transform-set moishes
crypto map 2GRMLA 71 match address TOCHICAGO
crypto map 2GRMLA 71 set peer ***.***.***.*** 
crypto map 2GRMLA 71 set transform-set 3DES

相关内容