Srodne teme
Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

cisco asa 5505 i p2p vpn

[es] :: Enterprise Networking :: cisco asa 5505 i p2p vpn

[ Pregleda: 2679 | Odgovora: 7 ] > FB > Twit

Postavi temu Odgovori

Autor
Pretraga teme: Traži
Markiranje Štampanje RSS

GORSHTAK
Ivan Matić

Član broj: 136182
Poruke: 285
*.adsl.verat.net.



+5 Profil

icon cisco asa 5505 i p2p vpn11.05.2010. u 23:23 - pre 169 meseci
Treba da osposobim p2p vpn, nije mi toliko bitno da li će biti preko cisco vpn klijenta ili ms klijenta l2tp over ipsec

Gledao sam ovaj link: http://www.cisco.com/en/US/doc...a5505/quick/guide/rem_acc.html i najviše sam pokušavao za cisco klijent

Ne znam skoro ništa o ciscu pa ne znam gde još da potražim i šta još treba

Konfig je:
Code:

denied(config)# show configuration
: Saved
: Written by enable_15 at 17:32:52.179 UTC Tue May 11 2010
!
ASA Version 7.2(4)
!
hostname denied
domain-name default.domain.invalid
enable password <sakrio> encrypted
passwd <sakrio> encrypted
names
name <neki_ip> ime_lokacije
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 172.16.30.252 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address <javna_adresa_cisca> 255.255.255.248
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
object-group service at9955 tcp
 description test
 port-object eq 9955
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service pf_136 tcp-udp
 port-object eq 2222
access-list outside_1_cryptomap extended permit ip host 172.16.30.136 host <sakrio_vpn1>
access-list ping1 extended permit icmp any any echo-reply
access-list ping1 extended permit ip any any
access-list ping2 extended permit icmp any any echo-reply
access-list ping2 extended permit object-group TCPUDP any any object-group pf_136
access-list ping2 extended permit tcp any any object-group at9955
access-list ping2 extended permit ip host ime_lokacije any log debugging
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 host <sakrio_vpn1>
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 host <sakrio_vpn2>
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 <sakrio_vpn3> 255.255.255.248
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 host <sakrio_vpn4>
access-list inside_nat0_outbound extended permit ip any 172.16.30.96 255.255.255.224
access-list inside_nat0_outbound extended permit ip any 172.16.30.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 172.16.30.128 255.255.255.224
access-list inside_nat0_outbound extended permit ip any 172.16.30.144 255.255.255.240
access-list outside_2_cryptomap extended permit ip host 172.16.30.136 host <sakrio_vpn2>
access-list outside_3_cryptomap extended permit ip host 172.16.30.136 <sakrio_vpn3> 255.255.255.248
access-list outside_4_cryptomap extended permit ip host 172.16.30.136 host <sakrio_vpn4>
pager lines 24
logging enable
logging asdm debugging
mtu inside 1500
mtu outside 1500
ip local pool Test 172.16.30.100-172.16.30.120 mask 255.255.255.0
ip local pool test2 172.16.30.121-172.16.30.135 mask 255.255.255.0
ip local pool test3 172.16.30.140-172.16.30.145 mask 255.255.255.0
ip local pool Test4 172.16.30.150-172.16.30.155 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-524.bin
asdm location ime_lokacije 255.255.255.255 inside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 2222 172.16.30.135 2222 netmask 255.255.255.255
static (inside,outside) tcp interface 9955 172.16.30.135 9955 netmask 255.255.255.255
access-group ping1 in interface inside
access-group ping2 in interface outside
route outside 0.0.0.0 0.0.0.0 195.252.89.241 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 172.16.30.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set pfs group1
crypto dynamic-map outside_dyn_map 40 set transform-set TRANS_ESP_3DES_SHA
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer <sakrio>
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 2 match address outside_2_cryptomap
crypto map outside_map 2 set peer <sakrio>
crypto map outside_map 2 set transform-set ESP-3DES-MD5
crypto map outside_map 3 match address outside_3_cryptomap
crypto map outside_map 3 set pfs
crypto map outside_map 3 set peer <sakrio>
crypto map outside_map 3 set transform-set ESP-3DES-MD5
crypto map outside_map 4 match address outside_4_cryptomap
crypto map outside_map 4 set pfs
crypto map outside_map 4 set peer <sakrio>
crypto map outside_map 4 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 5
 lifetime 86400
crypto isakmp policy 30
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 50
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 172.16.30.0 255.255.255.0 inside
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

group-policy DefaultRAGroup_1 internal
group-policy DefaultRAGroup_1 attributes
 wins-server none
 dns-server value <adsl ruter>
group-policy GroupPolicyEP internal
group-policy GroupPolicyEP attributes
 vpn-tunnel-protocol IPSec
 pfs enable
username user1 password <loz1> encrypted
username user2 password <loz2> encrypted privilege 7
username user3 password <loz3> encrypted
tunnel-group DefaultL2LGroup ipsec-attributes
 isakmp keepalive threshold 300 retry 2
tunnel-group DefaultRAGroup general-attributes
 address-pool Test
 address-pool test2
 address-pool test3
 address-pool Test4
 authorization-server-group LOCAL
 authorization-server-group (outside) LOCAL
tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key *
tunnel-group <sakrio_1> type ipsec-l2l
tunnel-group <sakrio_1> ipsec-attributes
 pre-shared-key *
tunnel-group <sakrio_2> type ipsec-l2l
tunnel-group <sakrio_2> ipsec-attributes
 pre-shared-key *
tunnel-group <sakrio_3> type ipsec-l2l
tunnel-group <sakrio_3> ipsec-attributes
 pre-shared-key *
tunnel-group cisco0 type ipsec-ra
tunnel-group cisco0 general-attributes
 address-pool Test
tunnel-group cisco0 ipsec-attributes
 pre-shared-key *
tunnel-group <sakrio_4> type ipsec-l2l
tunnel-group <sakrio_4> ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:f7d7c9afd4b28f5f1e0b9f6e913ef4f8      




Rezultati loga su (da ne zbuni, čita se naopako):
Code:

7|May 11 2010|14:45:43|710005|<ip_adsl_rutera>|195.252.89.247|UDP request discarded from <ip_adsl_rutera>/520 to outside:195.252.89.247/520
4|May 11 2010|14:45:40|713903|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, Error: Unable to remove PeerTblEntry
3|May 11 2010|14:45:40|713902|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, Removing peer from peer table failed, no match!
7|May 11 2010|14:45:40|713906|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, sending delete/delete with reason message
7|May 11 2010|14:45:40|713906|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, IKE SA AM:f624c181 terminating:  flags 0x0104c001, refcnt 0, tuncnt 0
7|May 11 2010|14:45:40|715065|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, IKE AM Responder FSM error history (struct &0x41bcaf0)  <state>, <event>:  AM_DONE, EV_ERROR-->AM_SND_MSG2, EV_SND_MSG-->AM_SND_MSG2, EV_START_TMR-->AM_BLD_MSG2, EV_BLD_MSG2_TRL-->AM_BLD_MSG2, EV_SKEYID_OK-->AM_BLD_MSG2, NullEvent-->AM_BLD_MSG2, EV_GEN_SKEYID-->AM_BLD_MSG2, EV_BLD_MSG2_HDR
7|May 11 2010|14:45:40|713236|||IP = <ip_mreze_sa_koje_sam_pokusao>, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + HASH (8) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 348
7|May 11 2010|14:45:40|715048|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing VID payload
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing Fragmentation VID + extended capabilities payload
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing xauth V6 VID payload
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing Cisco Unity VID payload
7|May 11 2010|14:45:40|715076|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, Computing hash for ISAKMP
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing hash payload
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing ID payload
7|May 11 2010|14:45:40|713906|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, Generating keys for Responder...
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing nonce payload
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing ke payload
7|May 11 2010|14:45:40|715046|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, constructing ISAKMP SA payload
7|May 11 2010|14:45:40|715028|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, IKE SA Proposal # 1, Transform # 10 acceptable  Matches global IKE entry # 2
7|May 11 2010|14:45:40|715047|||Group = DefaultRAGroup, IP = <ip_mreze_sa_koje_sam_pokusao>, processing IKE SA payload
7|May 11 2010|14:45:40|715049|||IP = <ip_mreze_sa_koje_sam_pokusao>, Received Cisco Unity client VID
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing VID payload
7|May 11 2010|14:45:40|715049|||IP = <ip_mreze_sa_koje_sam_pokusao>, Received NAT-Traversal ver 02 VID
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing VID payload
7|May 11 2010|14:45:40|715064|||IP = <ip_mreze_sa_koje_sam_pokusao>, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  False
7|May 11 2010|14:45:40|715049|||IP = <ip_mreze_sa_koje_sam_pokusao>, Received Fragmentation VID
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing VID payload
7|May 11 2010|14:45:40|715049|||IP = <ip_mreze_sa_koje_sam_pokusao>, Received DPD VID
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing VID payload
7|May 11 2010|14:45:40|715049|||IP = <ip_mreze_sa_koje_sam_pokusao>, Received xauth V6 VID
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing VID payload
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing ID payload
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing nonce payload
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing ISA_KE payload
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing ke payload
7|May 11 2010|14:45:40|715047|||IP = <ip_mreze_sa_koje_sam_pokusao>, processing SA payload
7|May 11 2010|14:45:40|713236|||IP = <ip_mreze_sa_koje_sam_pokusao>, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 849
6|May 11 2010|14:45:40|302015|<ip_mreze_sa_koje_sam_pokusao>|<ip_cisca_outside>|Built inbound UDP connection 23308 for outside:<ip_mreze_sa_koje_sam_pokusao>/1963 (<ip_mreze_sa_koje_sam_pokusao>/1963) to NP Identity Ifc:<ip_cisca_outside>/500 (<ip_cisca_outside>/500)
7|May 11 2010|14:45:40|609001|<ip_cisca_outside>||Built local-host NP Identity Ifc:<ip_cisca_outside>
7|May 11 2010|14:45:40|609001|<ip_mreze_sa_koje_sam_pokusao>||Built local-host outside:<ip_mreze_sa_koje_sam_pokusao>


Da li je potrebno još nešto da se podesi, acl ili nešto drugo da bi proradilo?
Ima li iko ideju?
 
Odgovor na temu

GORSHTAK
Ivan Matić

Član broj: 136182
Poruke: 285
*.adsl.verat.net.



+5 Profil

icon Re: cisco asa 5505 i p2p vpn12.05.2010. u 21:55 - pre 169 meseci
Niko ne zna?
Zar stvarno postavljam tako teška pitanja?
 
Odgovor na temu

srndach

Član broj: 58095
Poruke: 242
212.200.85.*



+2 Profil

icon Re: cisco asa 5505 i p2p vpn13.05.2010. u 07:10 - pre 169 meseci
Vrlo cesto, u situacijama kad je sve konfigurisano kako treba, a ipak ne radi, restart sa obe strane uz istovremeni ping, je resavao problem ...
Eventualno ponovno unosenje PRE-Shared KEYs na obe strane ...
Timere podesi na unlimited ...

I iskljuci PFS ...
"...
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer <sakrio>
crypto map outside_map 1 set transform-set ESP-3DES-SHA ..."
 
Odgovor na temu

GORSHTAK
Ivan Matić

Član broj: 136182
Poruke: 285
*.static.sbb.rs.



+5 Profil

icon Re: cisco asa 5505 i p2p vpn13.05.2010. u 16:55 - pre 169 meseci
Ovo mi liči kao site to site, elem restart nije pomogao, a ping je neizvodljiv dok se ne uspostavi konekcija (valjda).

Inače napravio sam mali pomak na tu temu, u tunel group name sam uneo svoju ip adresu, i stiglo je do nivoa da kaže:
Code:
Error, peer has indicated that something is wrong with our message.  This could indicate a pre-shared key mismatch.

Cisco vpn klijent nije izbacio prozor da se unese PSK.
PFS sam isključio, opet nema efekta.

Jel mora da se unosi ip adrese u tunel group name?

Pokušaj preko ms vpn-a, u logu dobijem:
Code:
TCP request discarded from moj_ip/2791 to outside:cisco_ip/1723


U acl-u sam definisao da sa svog ip-a mogu svuda da priđem, sta mi još fali?

Evo acl liste
Code:

object-group service pf_136 tcp-udp
 port-object eq 2222
object-group service ptcpudp_1723 tcp-udp
 port-object eq 1723
access-list outside_1_cryptomap extended permit ip host 172.16.30.136 host <local_vpn_1>
access-list ping1 extended permit icmp any any echo-reply
access-list ping1 extended permit ip any any
access-list ping1 extended permit ip host Eplus2 any
access-list ping1 extended permit tcp host Eplus2 any
access-list ping1 extended permit udp host Eplus2 any
access-list ping1 extended permit tcp host Eplus2 any eq pptp
access-list ping2 extended permit icmp any any echo-reply
access-list ping2 extended permit object-group TCPUDP any any object-group pf_136
access-list ping2 extended permit tcp any any object-group at9955
access-list ping2 extended permit ip host Eplus2 any log debugging
access-list ping2 extended permit ip host ac_office any
access-list ping2 extended permit tcp host Eplus2 any eq pptp
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 host <local_vpn_1>
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 host <local_vpn_2>
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 <local_vpn_3> 255.255.255.248
access-list inside_nat0_outbound extended permit ip host 172.16.30.136 host 172.31.235.71
access-list inside_nat0_outbound extended permit ip any 172.16.30.96 255.255.255.224
access-list inside_nat0_outbound extended permit ip any 172.16.30.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 172.16.30.128 255.255.255.224
access-list inside_nat0_outbound extended permit ip any 172.16.30.144 255.255.255.240
access-list inside_nat0_outbound extended permit ip 172.16.30.0 255.255.255.0 172.16.30.168 255.255.255.248
access-list inside_nat0_outbound extended permit ip 172.16.30.0 255.255.255.0 172.16.30.96 255.255.255.224
access-list inside_nat0_outbound extended permit ip any <A.B.C.D> 255.255.255.128
access-list inside_nat0_outbound extended permit ip 172.16.30.0 255.255.255.0 <A.B.C.D> 255.255.255.128
access-list outside_2_cryptomap extended permit ip host 172.16.30.136 host <local_vpn_2>
access-list outside_3_cryptomap extended permit ip host 172.16.30.136 <local_vpn_3> 255.255.255.248
access-list outside_4_cryptomap extended permit ip host 172.16.30.136 host 172.31.235.71



[Ovu poruku je menjao GORSHTAK dana 13.05.2010. u 18:22 GMT+1]
 
Odgovor na temu

srndach

Član broj: 58095
Poruke: 242
212.200.85.*



+2 Profil

icon Re: cisco asa 5505 i p2p vpn14.05.2010. u 07:39 - pre 169 meseci
Result of the command: "sh run"

: Saved
:
ASA Version 8.2(1)11
!
hostname BLABLA
domain-name BLABLA.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address INTERNI_SEGMENT 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address A.B.C.D 255.255.255.240
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
boot system disk0:/asa821-11-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name BLABLA.com
object-group service pluton-tcp tcp
port-object eq ftp
port-object eq ftp-data
port-object eq https
port-object eq www
object-group network UDL1-TO-UDL2
network-object BLABLA1 255.255.255.0
object-group network UDL1-TO-CENT
network-object BLABLA1 255.255.255.0
object-group network UDL2-TO-UDL1
network-object BLABLA2 255.255.255.0
object-group network CENT-TO-UDL1
svi mrezni segmenti u centrali
access-list inside_outbound_nat0_acl extended permit ip object-group UDL1-TO-CENT object-group CENT-TO- UDL1
access-list inside_outbound_nat0_acl extended permit ip object-group UDL1-TO- UDL2 object-group UDL2-TO-UDL1
access-list inside_access_in extended permit ip object-group UDL1-TO- CENT object-group CENT -TO- UDL1
access-list inside_access_in extended permit ip object-group UDL1-TO- UDL2 object-group UDL2-TO- UDL1
access-list outside_access_in extended permit ip object-group CENT -TO- UDL1 object-group UDL1-TO- CENT
access-list outside_access_in extended permit ip object-group UDL2-TO- UDL1 object-group UDL1-TO- UDL2
access-list outside_access_in extended permit gre any any
access-list outside_cryptomap_80 extended permit ip object-group UDL1-TO- UDL2object-group UDL2-TO-PODGORICA
access-list outside_cryptomap_20 extended permit ip object-group UDL1-TO- CENT object-group CENT -TO-PODGORICA
pager lines 24
logging enable
logging timestamp
logging trap notifications
logging history informational
logging asdm informational
logging host inside venera
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-623.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) A.B.C.D2 pluton netmask 255.255.255.255
static (inside,outside) A.B.C.D1 jupiter netmask 255.255.255.255
access-group inside_access_out in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 A.B.C.D 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authorization command LOCAL
http server enable
*******
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer JAVNA_Adresa_CENT
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 80 match address outside_cryptomap_80
crypto map outside_map 80 set peer JAVNA_Adresa_UDL2
crypto map outside_map 80 set transform-set ESP-AES-128-SHA
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 40
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption aes
hash sha
group 5
lifetime 86400
crypto isakmp policy 80
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh *******
*******
ssh timeout 5
console timeout 0
management-access inside
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server ******** source outside prefer
webvpn
username ********** password **************** encrypted privilege 15
tunnel-group JAVNA_Adresa_UDL2 type ipsec-l2l
tunnel-group JAVNA_Adresa_UDL2 ipsec-attributes
pre-shared-key *
isakmp keepalive disable
isakmp keepalive disable
tunnel-group JAVNA_Adresa_CENT type ipsec-l2l
tunnel-group JAVNA_Adresa_CENT ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect rsh
inspect rtsp
inspect sqlnet
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
prompt hostname context
Cryptochecksum:*****************************
: end

Ovo je malko prepravljeno sa ASA 5505 na udaljenoj lokaciji, ima podignut tunel ka centralnoj lokaciji (CENT) i ka jos jednoj udaljenoj lokaciji (UDL2) ...
Iskljucena je inspekcija h323, esmtp ... nije prolazio voice i mail ... pa sam skinuo ...
Svi timeri su unlimited ...
Jedna velika glupost, koja se cesto desava, je i ta da ljudi zaborave da Cisco ASA po defaultu ima oborene interfejse, i moras da uradis NO SHUT na SVAKI koji planiras da koristis ... mnogi cesto to zaborave ....

JAKO bi bilo dobro da sve sto radis, nateras da proradi na stolu, ispred tebe ...
Sto ne znaci da ce raditi i u realnom svetu, narocito ako na udaljenoj lokaciji imas ADSL ...
Kakav pristup internetu imas sa strane ASA 5505 ?
 
Odgovor na temu

GORSHTAK
Ivan Matić

Član broj: 136182
Poruke: 285
*.adsl.verat.net.



+5 Profil

icon Re: cisco asa 5505 i p2p vpn14.05.2010. u 19:12 - pre 169 meseci
Užas, vpn mi je radio svo vreme, jedino što nisam znao kako se pravilno koristi vpn klijent....

Da se i drugi ne zeznu, prvo se unosi naziv grupe pod kojim je definisan vpn i psk, pa tek onda će se pojaviti prozor za user pass


no shut? Reci mi detalnije o tome...
 
Odgovor na temu

dragansar
Sarajevo

Član broj: 84903
Poruke: 612
91.191.22.*

Sajt: https://nf-tel.com


+22 Profil

icon Re: cisco asa 5505 i p2p vpn15.05.2010. u 22:09 - pre 169 meseci
Citat:
no shut? Reci mi detalnije o tome...

Nadam se da ovo nije ironicno bilo...
Pod "no shut" @srndach je mislio na sintaksu komande sa kojom ces dati interface podici, ili ti ukljuciti....a citava komanda je
Router(config-if)#no shutdown
Šaka
 
Odgovor na temu

GORSHTAK
Ivan Matić

Član broj: 136182
Poruke: 285
*.adsl.verat.net.



+5 Profil

icon Re: cisco asa 5505 i p2p vpn16.05.2010. u 00:43 - pre 169 meseci
Nije ironično, pošto ne znam ništa o ciscu.

Jel to isto što i ifup/ifdown u linuxu?
 
Odgovor na temu

[es] :: Enterprise Networking :: cisco asa 5505 i p2p vpn

[ Pregleda: 2679 | Odgovora: 7 ] > FB > Twit

Postavi temu Odgovori

Srodne teme
Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.