IPSec - PIX到Cisco VPN客戶端萬用字元，預共用，帶擴展身份驗證的模式配置

下載選項

PDF (619.1 KB)
在多種裝置上使用 Adobe Reader 檢視
ePub (465.4 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上的各種應用程式中檢視
Mobi (Kindle) (477.6 KB)
在 Kindle 裝置或多部裝置的 Kindle 應用程式上檢視

已更新: 2008 年 9 月 26 日

文件 ID:10967

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

簡介

此配置示例演示如何使用萬用字元、mode-config、sysopt connection permit-ipsec命令和擴展身份驗證(Xauth)將VPN客戶端連線到PIX防火牆。

要檢視PIX 6.3及更高版本的TACACS+和RADIUS配置，請參閱適用於PIX 6.3和PIX/ASA 7.x的TACACS+和RADIUS配置示例。

VPN客戶端支援高級加密標準(AES)作為Cisco VPN客戶端3.6.1版及更高版本和PIX防火牆6.3中的加密演算法。VPN客戶端僅支援128位和256位的金鑰大小。有關如何配置AES的詳細資訊，請參閱如何使用AES將Cisco VPN客戶端配置為PIX。

請參閱PIX/ASA 7.x和Cisco VPN Client 4.x for Windows with Microsoft Windows 2003 IAS RADIUS身份驗證配置示例，以使用Microsoft Windows 2003 Internet Authentication Service(IAS)RADIUS伺服器在Cisco VPN客戶端(4.x for Windows)和PIX 500系列安全裝置7.x之間設定遠端訪問VPN連線。

請參閱使用RADIUS進行使用者身份驗證和記賬的VPN 3000集中器和VPN Client 4.x for Windows之間的IPsec配置示例，以使用RADIUS進行使用者身份驗證和記賬的Cisco VPN Client 4.x for Windows之間建立IPsec隧道。

請參閱使用RADIUS進行使用者身份驗證在Cisco IOS路由器和Cisco VPN客戶端4.x for Windows之間配置IPsec，以配置路由器和Cisco VPN客戶端4.x之間使用RADIUS進行使用者身份驗證的連線。

必要條件

需求

本文件沒有特定需求。

採用元件

本文中的資訊係根據以下軟體和硬體版本：

Cisco VPN客戶端4.x.與Cisco Secure VPN Client 1.x不同，此產品具有高級VPN功能。
PIX防火牆515E版本6.3(3)。

註：加密技術受出口管制約束。您有責任瞭解關於加密技術出口的法律。詳情請參閱出口管理局網站。如果您對出口管制有任何疑問，請傳送電子郵件至export@cisco.com。

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路正在作用，請確保您已瞭解任何指令可能造成的影響。

慣例

如需文件慣例的詳細資訊，請參閱思科技術提示慣例。

背景資訊

sysopt connection permit-ipsec命令隱式允許來自IPsec隧道的任何資料包繞過IPsec連線的相關access-list、conduit或access-group命令的檢查。Xauth會將IPsec使用者驗證到外部TACACS+或RADIUS伺服器。除了萬用字元預共用金鑰外，使用者還必須提供使用者名稱/密碼。

具有VPN客戶端的使用者從其ISP接收IP地址。該地址由PIX上IP地址池中的IP地址替換。使用者可以訪問防火牆內部的所有內容，包括網路。不運行VPN客戶端的使用者只能使用靜態分配提供的外部地址連線到Web伺服器。

設定

本節提供用於設定本文件中所述功能的資訊。

註：使用Command Lookup Tool(僅限註冊客戶)查詢有關本文檔中使用的命令的更多資訊。

網路圖表

本檔案會使用以下網路設定：

網路圖表說明

即使未建立VPN連線，使用全域性IP地址192.168.1.1訪問Web伺服器的Internet主機也會進行身份驗證。此流量未加密。
一旦建立IPsec隧道，VPN客戶端就可以訪問內部網路(10.89.129.128 /25)中的所有主機。從VPN客戶端到PIX防火牆的所有流量都經過加密。如果沒有IPsec隧道，則它們只能通過其全域性IP地址訪問Web伺服器，但仍需要進行身份驗證。
VPN客戶端來自Internet，其IP地址事先未知。

組態

本檔案會使用這些設定。

PIX配置6.3(3)
VPN客戶端4.0.5配置
VPN客戶端3.5配置
VPN客戶端1.1配置

PIX配置6.3(3)
pixfirewall#show run : Saved : PIX Version 6.3(3) interface ethernet0 100full interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pixfirewall fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names !--- Do not use Network Address Translation (NAT) for inside-to-pool !--- traffic. This should not go through NAT. access-list 101 permit ip 10.89.129.128 255.255.255.240 10.89.129.192 255.255.255.240 !--- Permits Internet Control Message Protocol (ICMP) !--- Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) !--- traffic from any host on the Internet (non-VPN) to the web server. access-list 120 permit icmp any host 10.89.129.131 access-list 120 permit tcp any host 10.89.129.131 access-list 120 permit udp any host 10.89.129.131 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside 192.168.1.1 255.255.255.0 ip address inside 10.89.129.194 255.255.255.240 ip audit info action alarm ip audit attack action alarm !--- Specifies the inside IP address range to be assigned !--- to the VPN Clients. ip local pool VPNpool 10.89.129.200-10.89.129.204 no failover failover timeout 0:00:00 failover poll 15 no failover ip address outside no failover ip address inside pdm history enable arp timeout 14400 !--- Defines a pool of global addresses to be used by NAT. global (outside) 1 192.168.1.6-192.168.1.10 nat (inside) 0 access-list 101 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 !--- Specifies which outside IP address to apply to the web server. static (inside,outside) 192.168.1.11 10.89.129.131 netmask 255.255.255.255 0 0 !--- Apply ACL 120 to the outside interface in the inbound direction. access-group 120 in interface outside !--- Defines a default route for the PIX. route outside 0.0.0.0 0.0.0.0 192.168.1.3 1 !--- Defines a route for traffic within the PIX's !--- subnet to reach other inside hosts. route inside 10.89.129.128 255.255.255.128 10.89.129.193 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local !--- Authentication, authorization, and accounting (AAA) statements !--- for authentication. !--- Use either of these statements to define the protocol of the group AuthInbound. !--- You cannot use both. aaa-server AuthInbound protocol tacacs+ !--- OR aaa-server AuthInbound protocol radius !--- After you define the protocol of the group AuthInbound, define !--- a server of the same type. !--- In this case we specify the TACACS+ server and key of "secretkey". aaa-server AuthInbound (inside) host 10.89.129.134 secretkey timeout 10 !--- Authenticate HTTP, FTP, and Telnet traffic to the web server. aaa authentication include http outside 10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound aaa authentication include ftp outside 10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound aaa authentication include telnet outside 10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable !--- Trust IPsec traffic and avoid going through ACLs/NAT. sysopt connection permit-ipsec !--- IPsec and dynamic map configuration. crypto ipsec transform-set myset esp-des esp-md5-hmac crypto dynamic-map dynmap 10 set transform-set myset crypto map mymap 10 ipsec-isakmp dynamic dynmap !--- Assign IP address for VPN 1.1 Clients. crypto map mymap client configuration address initiate crypto map mymap client configuration address respond !--- Use the AAA server for authentication (AuthInbound). crypto map mymap client authentication AuthInbound !--- Apply the IPsec/AAA/ISAKMP configuration to the outside interface. crypto map mymap interface outside isakmp enable outside !--- Pre-shared key for VPN 1.1 Clients. isakmp key ******** address 0.0.0.0 netmask 0.0.0.0 isakmp identity address !--- Assign address from "VPNpool" pool for VPN 1.1 Clients. isakmp client configuration address-pool local VPNpool outside !--- ISAKMP configuration for VPN Client 3.x/4.x. isakmp policy 10 authentication pre-share isakmp policy 10 encryption des isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 !--- ISAKMP configuration for VPN Client 1.x. isakmp policy 20 authentication pre-share isakmp policy 20 encryption des isakmp policy 20 hash md5 isakmp policy 20 group 1 isakmp policy 20 lifetime 86400 !--- Assign addresses from "VPNpool" for VPN Client 3.x/4.x. vpngroup vpn3000 address-pool VPNpool vpngroup vpn3000 idle-time 1800 !--- Group password for VPN Client 3.x/4.x (not shown in configuration). vpngroup vpn3000 password ******** telnet timeout 5 ssh timeout 5 console timeout 0 terminal width 80 Cryptochecksum:ba54c063d94989cbd79076955dbfeefc : end pixfirewall#

PIX配置6.3(3)

pixfirewall#show run
: Saved
:
PIX Version 6.3(3)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names

!--- Do not use Network Address Translation (NAT) for inside-to-pool !--- traffic. This should not go through NAT.

access-list 101 permit ip 10.89.129.128 255.255.255.240 10.89.129.192 255.255.255.240

!--- Permits Internet Control Message Protocol (ICMP) !--- Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) !--- traffic from any host on the Internet (non-VPN) to the web server.

access-list 120 permit icmp any host 10.89.129.131
access-list 120 permit tcp any host 10.89.129.131
access-list 120 permit udp any host 10.89.129.131

pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.1 255.255.255.0
ip address inside 10.89.129.194 255.255.255.240
ip audit info action alarm
ip audit attack action alarm

!--- Specifies the inside IP address range to be assigned !--- to the VPN Clients.

ip local pool VPNpool 10.89.129.200-10.89.129.204
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm history enable
arp timeout 14400

!--- Defines a pool of global addresses to be used by NAT.

global (outside) 1 192.168.1.6-192.168.1.10

nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

!--- Specifies which outside IP address to apply to the web server.

static (inside,outside) 192.168.1.11 10.89.129.131 netmask 255.255.255.255 0 0

!--- Apply ACL 120 to the outside interface in the inbound direction.

access-group 120 in interface outside

!--- Defines a default route for the PIX.

route outside 0.0.0.0 0.0.0.0 192.168.1.3 1

!--- Defines a route for traffic within the PIX's !--- subnet to reach other inside hosts.

route inside 10.89.129.128 255.255.255.128 10.89.129.193 1

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local


!--- Authentication, authorization, and accounting (AAA) statements !--- for authentication. !--- Use either of these statements to define the protocol of the group AuthInbound. !--- You cannot use both. 
aaa-server AuthInbound protocol tacacs+


!--- OR

aaa-server AuthInbound protocol radius


!--- After you define the protocol of the group AuthInbound, define !--- a server of the same type. !--- In this case we specify the TACACS+ server and key of "secretkey".

aaa-server AuthInbound (inside) host 10.89.129.134 secretkey timeout 10


!--- Authenticate HTTP, FTP, and Telnet traffic to the web server.

aaa authentication include http outside 
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound

aaa authentication include ftp outside
 10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound

aaa authentication include telnet outside 
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound

no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable

!--- Trust IPsec traffic and avoid going through ACLs/NAT.

sysopt connection permit-ipsec

!--- IPsec and dynamic map configuration.

crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap

!--- Assign IP address for VPN 1.1 Clients.

crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond

!--- Use the AAA server for authentication (AuthInbound).

crypto map mymap client authentication AuthInbound

!--- Apply the IPsec/AAA/ISAKMP configuration to the outside interface.

crypto map mymap interface outside
isakmp enable outside

!--- Pre-shared key for VPN 1.1 Clients.

isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address

!--- Assign address from "VPNpool" pool for VPN 1.1 Clients.

isakmp client configuration address-pool local VPNpool outside

!--- ISAKMP configuration for VPN Client 3.x/4.x.

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

!--- ISAKMP configuration for VPN Client 1.x.

isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 1
isakmp policy 20 lifetime 86400

!--- Assign addresses from "VPNpool" for VPN Client 3.x/4.x.

vpngroup vpn3000 address-pool VPNpool

vpngroup vpn3000 idle-time 1800


!--- Group password for VPN Client 3.x/4.x (not shown in configuration).

vpngroup vpn3000 password ********
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:ba54c063d94989cbd79076955dbfeefc
: end
pixfirewall#

VPN客戶端4.0.5配置

完成以下步驟以配置VPN客戶端4.0.5。

選擇Start > Programs > Cisco Systems VPN Client > VPN Client。
按一下New以啟動Create New VPN Connection Entry視窗。
輸入連線條目的名稱和說明。在「主機」框中輸入PIX防火牆的外部IP地址。然後輸入VPN組名稱和密碼，然後按一下Save。
在VPN客戶端主視窗中，按一下要使用的連線，然後按一下Connect按鈕。
出現提示時，輸入Xauth的使用者名稱和密碼資訊，然後按一下OK連線到遠端網路。

VPN客戶端3.5配置

完成以下步驟以配置VPN客戶端3.5配置。

選擇Start > Programs > Cisco Systems VPN Client > VPN Dialer。
按一下New以啟動New Connection Entry Wizard。
輸入新連線條目的名稱，然後按一下下一步。
輸入用於連線到遠端伺服器的伺服器的主機名或IP地址，然後按一下下一步。
選擇Group Access Information，然後輸入用於驗證對遠端伺服器的訪問的名稱和密碼。按「Next」（下一步）。
按一下Finish以儲存新條目。
選擇撥號器中的Connection Entry，然後按一下Connect。
出現提示時，輸入Xauth的使用者名稱和密碼資訊，然後按一下OK連線到遠端網路。

VPN客戶端1.1配置
Network Security policy: 1- TACconn My Identity Connection security: Secure Remote Party Identity and addressing ID Type: IP subnet 10.89.129.128 255.255.255.128 Port all Protocol all Connect using secure tunnel ID Type: IP address 192.168.1.1 Pre-shared Key=cisco1234 Authentication (Phase 1) Proposal 1 Authentication method: pre-shared key Encryp Alg: DES Hash Alg: MD5 SA life: Unspecified Key Group: DH 1 Key exchange (Phase 2) Proposal 1 Encapsulation ESP Encrypt Alg: DES Hash Alg: MD5 Encap: tunnel SA life: Unspecified no AH 2- Other Connections Connection security: Non-secure Local Network Interface Name: Any IP Addr: Any Port: All

VPN客戶端1.1配置

Network Security policy: 
 1- TACconn
     My Identity
          Connection security: Secure
          Remote Party Identity and addressing
          ID Type: IP subnet
          10.89.129.128
          255.255.255.128
          Port all Protocol all


     Connect using secure tunnel

          ID Type: IP address
          192.168.1.1


     Pre-shared Key=cisco1234


     Authentication (Phase 1)

     Proposal 1
         Authentication method: pre-shared key
         Encryp Alg: DES
         Hash Alg: MD5
         SA life: Unspecified
         Key Group: DH 1

     Key exchange (Phase 2)

     Proposal 1
         Encapsulation ESP
         Encrypt Alg: DES
         Hash Alg: MD5
         Encap: tunnel
         SA life: Unspecified
         no AH

 2- Other Connections
        Connection security: Non-secure
        Local Network Interface
          Name: Any
          IP Addr: Any
          Port: All

新增記帳

要新增記帳的命令的語法為：

aaa accounting include acctg_service
   inbound|outbound l_ip l_mask [f_ip f_mask] server_tag

例如，在PIX配置中，新增以下命令：

aaa accounting include any inbound 
0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInbound

注意：xauth記帳需要使用sysopt connection permit-ipsec命令，而不是sysopt ipsec pl-compatible命令。Xauth記帳不只與sysopt ipsec pl-compatible命令一起使用。Xauth記帳對TCP連線有效，而不是ICMP或UDP。

以下輸出是TACACS+記帳記錄的示例：

07/27/2004 15:17:54 cisco_customer Default Group 10.89.129.200 stop 15 .. 99 1879 .. .. 
   0x5 .. PIX 10.89.129.194 telnet 
07/27/2004 15:17:39 cisco_customer Default Group 10.89.129.200 start .. .. .. .. .. .. 
   0x5 .. PIX 10.89.129.194 telnet

驗證

使用本節內容，確認您的組態是否正常運作。

輸出直譯器工具(僅供已註冊客戶使用)(OIT)支援某些show命令。使用OIT檢視show命令輸出的分析。

附註：使用 debug 指令之前，請先參閱有關 Debug 指令的重要資訊。

啟用思科安全日誌檢視器以檢視客戶端調試。

debug crypto ipsec — 用於檢視階段2的IPsec協商。
debug crypto isakmp — 用於檢視階段1的ISAKMP協商。

疑難排解

本節提供的資訊可用於對組態進行疑難排解。還顯示了調試輸出示例。

疑難排解指令