WZ-2A10-SAS5525-0938# show running-config

: Saved

:

: Serial Number: FCH17307098

: Hardware:   ASA5525, 8192 MB RAM, CPU Lynnfield 2394 MHz, 1 CPU (4 cores)

:

ASA Version 9.8(2)

!

hostname WZ-2A10-SAS5525-0938

enable password $sha512$5000$HztVSx0o3cSsFEoY7TKS8A==$lJrGN+VDV6hYZDCSxnx4SQ== pbkdf2

names

ip local pool vpnpool 10.254.232.1-10.254.232.254 mask 255.255.255.0

ip local pool idcicpvpnpool 192.168.41.100-192.168.41.199 mask 255.255.255.0     ######vpn本地地址池，自定义名字和ip段

!

interface GigabitEthernet0/0

 description To:2A10-0457-G1/0/41

 nameif outside                                       ###定义为外部区域外网

 security-level 0                                       ###level  0-100 ，值越大，区域代表越安全，这是外网区域所以是0

 ip address 173.248.xxx.xx 255.255.xxx.xxx

!

interface GigabitEthernet0/1

 description To:2A10-0457-G1/0/42

 nameif inside                                         ###定义为内部区域内网，

 security-level 100

 ip address 10.2.32.1 255.255.255.0

!

interface GigabitEthernet0/2

 shutdown

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet0/3

 shutdown

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet0/4

 shutdown

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet0/5

 shutdown

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet0/6

 shutdown

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet0/7

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Management0/0

 management-only

 nameif management                    ###这是管理口，网线口

 security-level 100

 ip address 192.168.232.1 255.255.255.0

!

ftp mode passive

same-security-traffic permit intra-interface      ####默认防火墙是不允许同个接口（比如outside进outside出，会被定义为异常流量），这命令开启同个接口区域进出

object network in-net

 subnet 10.2.32.0 255.255.255.248

object network remote-net1

object network vpn-net

 subnet 10.254.232.0 255.255.255.0

object network idcicpvpn-net                               ###这些是nat地址段

 subnet 192.168.41.0 255.255.255.0

access-list vpn-traffic standard permit 10.2.32.0 255.255.255.0

access-list topnet extended permit ip any host 10.2.32.2

access-list topnet extended permit ip any host 10.2.32.3

access-list topnet extended permit ip any host 10.2.32.4

access-list topnet extended permit icmp any any

access-list no-nat extended permit ip 10.2.32.0 255.255.255.0 192.168.41.0 255.255.255.0     ###创建兴趣流（即inside内网口访问vpn-pool地址池网段），对应到不做nat规则。相当于inside内网网段可以直接访问从vpn拨入进来的地址网段

pager lines 24

logging enable

logging timestamp

logging buffer-size 102400

logging buffered warnings

logging asdm informational

logging host outside 173.248.xxx.xxx ##这个地址设置和snmp一致

mtu outside 1500

mtu inside 1500

mtu management 1500

no failover

no monitor-interface service-module

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

arp rate-limit 16384

nat (inside,outside) source static in-net in-net destination static vpn-net vpn-net route-lookup

nat (inside,outside) source static in-net in-net destination static idcicpvpn-net idcicpvpn-net route-lookup   ###将之前定义的兴趣流设置为不NAT，这样才能保证正常访问内网网段，设置到这vpn拨号后获得vpn-pool地址池ip已经可以和inside内网通讯了

!

object network in-net

 nat (inside,outside) dynamic interface

object network idcicpvpn-net

 nat (outside,outside) dynamic interface    ####需要拨号访问外网google的设置都是outside，进出都是外网。

access-group topnet in interface outside

route outside 0.0.0.0 0.0.0.0 173.248.xxx.xxx 1   ###这是默认路由

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

timeout conn-holddown 0:00:15

timeout igp stale-route 0:01:10

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication login-history

snmp-server host outside 173.248.xx.xx community ***** version 2c   ###设置指定ip可以snmp

no snmp-server location

no snmp-server contact

crypto ipsec ikev1 transform-set vpnset esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set idcicpvpnset esp-3des esp-md5-hmac

crypto ipsec security-association pmtu-aging infinite

crypto dynamic-map dymap 50000 set ikev1 transform-set vpnset

crypto dynamic-map dymap 50000 set security-association lifetime seconds 86400

crypto dynamic-map dymap 50000 set reverse-route

crypto dynamic-map idcicpdymap 50001 set ikev1 transform-set idcicpvpnset

crypto dynamic-map idcicpdymap 50001 set security-association lifetime seconds 86400    ###备默认配置

crypto dynamic-map idcicpdymap 50001 set reverse-route                                                          ###代表这个路由从哪里就从哪里去

crypto map vpnmap 10000 ipsec-isakmp dynamic dymap

crypto map vpnmap 10001 ipsec-isakmp dynamic idcicpdymap                                         #### 静态map只能一个，不像上面动态地图随意创建，这边创建了vpnmap后，优先级ID为10，静态地图可对应多个动态的地图，设立不同优先级即可。

crypto map vpnmap interface outside                                                                             ##将静态地图应用到出接口outside

crypto ca trustpool policy

crypto ikev1 enable outside                                                                                           ## 出接口使能ikev1(或者其他版本isakmp)

crypto ikev1 policy 10

 authentication pre-share                                                                                       #### 认证方式预共享密钥

 encryption 3des

 hash md5

 group 2

 lifetime 86400

telnet timeout 5

ssh stricthostkeycheck

ssh 173.248.x.0 255.255.255.0 outside 设置指定段可以ssh远程

ssh 0.0.0.0 0.0.0.0 management

ssh timeout 10

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

group-policy mygroup internal                                  //隧道分离的策略，有三种，这里选择隧道指定分离

group-policy mygroup attributes

 dns-server value 8.8.8.8

 vpn-idle-timeout 720

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value vpn-traffic                        //与前面acl列表匹配的流量，才会加入到VPN隧道中。

group-policy idcicpgrouppolicy internal                           ##建立组策略mygrouppolicy

group-policy idcicpgrouppolicy attributes

 dns-server value 8.8.8.8                                                       ###定义分配dns参数

 vpn-idle-timeout 1800

 split-tunnel-policy tunnelall                                                      ###设置隧道不分流，指所有流量j加入隧道，这个组策略用来上外网的，不同于另一个组策略mygroup

dynamic-access-policy-record DfltAccessPolicy

username test01 password $sha512$5000$fmWat2hp9BXoMCdrxH3O2g==$4P78z0G/ZPXZKTdVusCP3A== pbkdf2

username hydz01 password $sha512$5000$BwTlllmTZC6K7xQrHAAYyg==$gOgaxlaxp2q7BVD8t/l58w== pbkdf2

username admin password $sha512$5000$kVWg+pCWjCdGFWJ74Z+Uew==$2ra3lBuFlpAdEJjsxT0sIg== pbkdf2

username topdata password $sha512$5000$/LpLPZcYgLv9U0t4jI2yeA==$s1wfz4vTvKhj35NLgv7lxQ== pbkdf2 privilege 15

tunnel-group hangyidianzi type remote-access

tunnel-group hangyidianzi general-attributes

 address-pool vpnpool

 default-group-policy mygroup

tunnel-group hangyidianzi ipsec-attributes

 ikev1 pre-shared-key *****

 isakmp keepalive threshold 300 retry 5

tunnel-group idcicpmygroup type remote-access                      ###创建隧道组

tunnel-group idcicpmygroup general-attributes

 address-pool idcicpvpnpool                                                    ### 指定关联到之前定义的地址池

 default-group-policy idcicpgrouppolicy                                    ####默认组策略引用idcicpgrouppolicy

tunnel-group idcicpmygroup ipsec-attributes

 ikev1 pre-shared-key *****                                                         ###组密钥，登录的时候需要用到

 isakmp keepalive threshold 301 retry 5

!

!

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:888d6f380050265e5c38fb64a5d4b5cb

: end

WZ-2A10-SAS5525-0938#