Tunel VPN na Cisco ASA
Zestawiony zostanie tunel IPsec między firewallami. Tunelowany będzie ruch między sieciami lan 192.168.1.0/24 i 192.168.5.0/24.

Symulujemy sieci lan z jednej strony przy użyciu SW1 z drugiej R6.
Konfiguracja ASA1

access-list partner-dmz_1_cryptomap line 1 extended permit ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
tunnel-group 192.168.4.1 type ipsec-l2l
tunnel-group 192.168.4.1 ipsec-attributes pre-shared-key **********
isakmp keepalive threshold 10 retry 2
crypto isakmp policy 30 authen pre-share
crypto isakmp policy 30 encrypt 3des
crypto isakmp policy 30 hash sha
crypto isakmp policy 30 group 2
crypto isakmp policy 30 lifetime 86400
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map partner-dmz_map 1 match address partner-dmz_1_cryptomap
crypto map partner-dmz_map 1 set pfs group1
crypto map partner-dmz_map 1 set peer 192.168.4.1
crypto map partner-dmz_map 1 set transform-set ESP-3DES-SHA

Konfiguracja ASA2

access-list partner-dmz_1_cryptomap line 1 extended permit ip 192.168.5.0 255.255.255.0 192.168.1.0 255.255.255.0
tunnel-group 192.168.2.1 type ipsec-l2l
tunnel-group 192.168.2.1 ipsec-attributes pre-shared-key **********
isakmp keepalive threshold 10 retry 2
crypto isakmp policy 30 authen pre-share
crypto isakmp policy 30 encrypt 3des
crypto isakmp policy 30 hash sha
crypto isakmp policy 30 group 2
crypto isakmp policy 30 lifetime 86400
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map partner-dmz_map 1 match address partner-dmz_1_cryptomap
crypto map partner-dmz_map 1 set pfs group1
crypto map partner-dmz_map 1 set peer 192.168.2.1
crypto map partner-dmz_map 1 set transform-set ESP-3DES-SHA

Weryfikacja:

Ping z sw1 do R6

Polecenia:

sh crypto isakmp sa
sh crypto ipsec sa
debug crypto isakmp sa