pix站到站点ipsecVPN配置
前提：没有加密通道前，数据能够正常交流。
Step1: 允许pix 外口进来的ipsec数据流
Pix(config)#access-list out_in permit 50 any host 222.254.240.193
Pix(config)#access-list out_in permit 51 any host 222.254.240.193
Pix(config)#access-list out_in permit udp any host 222.254.240.193 eq 500
Sysopt connection permit-ipsec 更简略的方式，只需一条
Step2: 外口启用ISAKMP
Pix1(config)#isakmp enable outside
Pix2(config)#isakmp enable outside
Step3: 配置IKE策略参数
Isakmp policy 10 encryption 3des
Isakmp policy 10 hash md5
Isakmp policy 10 group 2
Isakmp policy 10 lifetime 2400
Isakmp policy 10 autentication pre-share
(Isakmp policy 10 autentication rsa-sig) 启用RSA数字签名认证(缺省)
pix#show isakmp policy 查看策略
step4: 定义预共享密钥
pix1(config)#isakmp key mykey address 202.103.96.112 netmask 255.255.255.255
pix2(config)#isakmp key mykey address 222.254.240.193 netmask 255.255.255.255
pix(config)#isakmp key pubkey address 0.0.0.0 netmask 0.0.0.0 ( 所有通道peer都共享同一密钥)
step5: 定义加密数据流ACL
pix1(config)#
access-list crypto_date permit 192.168.1.1 255.255.255.0 192.168.2.0 255.255.255.0
pix2(config)#
access-list crypto_date permit 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
step6: 定义转换集合 transform set 两边配置一样
pix1(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac
pix2(config)# crypto ipsec transform-set myset esp-des esp-sha-hmac
pix1(config)# show crypto ipsec transform-set
step7: NAT 的问题
pix1(config)# nat 0 access-list cryto_date
pix2(config)# nat 0 access-list cryto_date
step8: 配置加密图 连接policy+transform-set+peer address
pix1(config)# crypto map pix1map 10 ipsec-isakmp
pix1(config)# crypto map pix1map 10 match address crypto_date
pix1(config)# crypto map pix1map 10 set peer 202.103.96.112
pix1(config)# crypto map pix1map 10 set transform-set myset
pix2(config)# crypto map pix2map 10 ipsec-isakmp
pix2(config)# crypto map pix1map 10 match address crypto_date
pix2(config)# crypto map pix1map 10 set peer 222.240.254.193
pix2(config)# crypto map pix1map 10 set transform-set myset
step 9: 绑定加密图到接口
pix1(config)# crypto map pix1map interface outside
pix2(config)# crypto map pix2map interface outside
pix1#show crypto map
pix1#show crypto ipsec sa