ssl vpn 配置

network

ssl vpn 配置

一.拓扑

二. 基本配置:
ASA(config)#int e0/0
ASA(config-if)#ip add 192.168.1.1 255.255.255.0
ASA(config-if)#nameif outside
ASA(config-if)#no shut
ASA(config)#int e0/1
ASA(config-if)#ip add 10.10.1.1 255.255.255.0
ASA(config-if)#nameif inside
ASA(config-if)#no shu
!
ASA(config)#webvpn
ASA(config-webvpn)#enable outside
ASA(config-webvpn)#svc image disk0:/sslclient-win-1.1.2.169.pkg可以去cisco.com下载.(要CCO)
ASA(config-webvpn)#svc enable
!在外接口上启动WebVPN,并且启动SVC(ssl VPN Client)
SSL VPN配置:
ASA(config)#ip local pool ssl-user 192.168.10.1-192.168.10.99 创建SSL VPN用户地址池
ASA(config)#access-list go-vpn permit ip 10.10.1.0 255.255.255.0 192.168.10.0 255.255.255.0
ASA(config)#nat (inside) 0 access-list go vpn 设置SSL VPN数据不作NAT翻译
ASA(config)#grouop-policy mysslvpn-group-policy internal 创建名为mysslvpn-group-policy的组策略
ASA(config-group-policy)#vpn-tunnel-protocol webvpn
ASA(config-group-policy)#webvpn
ASA(config-group-policy-webvpn)#svc enable 在组策略中启SVC
ASA(config)#username test01 passw cisco
ASA(config)#username test01 attributes
ASA(config-username)#vpn-group mysslvpn-group-policy 赋予用户策略
ASA(config)#tunnel-group mysslvpn-group type webvpn
ASA(config)#tunnel-group mysslvpn-group general-attributes
ASA(config-tunnel-general)#address-pool ssl-user  设置SSL VPN用户的地址池
ASA(config)#tunnel-group mysslvpn-group webvpn-attributes
ASA(config-tunnel-webvpn)#group-alias groups enable
ASA(config)#webvpn
ASA(config-webvpn)#tunnel-group-list enable 配置SSL VPN隧道分离
ASA(config)#access-list split-ssl extended per 10.10.1.0 255.255.255.0 any
注意:源地址为ASA的内网口地址,目标地址始终为ANY
ASA(config)#group-policy mysslvpn-group-policy attributes
ASA(config-group-policy)#split-tunnel-policy tunnelspecified
ASA(config-group-policy)#split-tunnel-network-list value split-ssl
三.测试
1.在浏览器中输入:https://192.168.1.1
如下图:

2.登陆后直接启动SSL CLIENT安装程序.如图:

3.选择YES如下图:


4.SSL VPN建立成功,如下图:

5.SVC的状态信息,如图:


四.SSL VPN所用到命令
ip local pool ssl-user 192.168.10.1-192.168.10.99
access-list go-vpn extended ip 10.10.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list split-ssl extended permit ip 10.10.1.0 255.255.255.0 any
nat(inside)0 access-list go-vpn
group-policy mysslvpn-group-policy internal
group-policy mysslvpn-group-policy attributes
vpn-tunnel-protocol webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-ssl
webvpn
svv ena
username test01 pass cisco
username test01 attributes
vpn-group-policy mysslvpn-group-policy
tunnel-group mysslvpn-group type webvpn
tunnel-group mysslvpn-group general-attributes
address-pool ssl-user
tunnel-group mysslvpn-group webvpn-attributes
group-alias group2 enable
webvpn
enable outside
svc image disk0:/sslclient-win-1.1.2.169.pkg 1
svc enable
tunnel-group-list enable