Scribd
Upload
13 views

Firewall & VPN

The document describes the configuration of an ASA firewall, router, and VPN between two sites. The ASA firewall is configured with an inside interface on VLAN 2 with an IP of 192.168.1.0/24. NAT is configured to translate the inside network to the outside interface IP of 200.1.1.1. ICMP inspection is enabled. The router is configured with an interface connected to the ASA at 200.1.1.2 and another connected externally at 8.8.8.1. An IPSec VPN is configured between sites using pre-shared keys and AES encryption to connect the 192.168.0.0/24 and 172.16.0

Uploaded by

Stéphane ATIDIGA
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
13 views

Firewall & VPN

The document describes the configuration of an ASA firewall, router, and VPN between two sites. The ASA firewall is configured with an inside interface on VLAN 2 with an IP of 192.168.1.0/24. NAT is configured to translate the inside network to the outside interface IP of 200.1.1.1. ICMP inspection is enabled. The router is configured with an interface connected to the ASA at 200.1.1.2 and another connected externally at 8.8.8.1. An IPSec VPN is configured between sites using pre-shared keys and AES encryption to connect the 192.168.0.0/24 and 172.16.0

Uploaded by

Stéphane ATIDIGA
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 3

ASA 5505

Int vlan 2
ciscoasa(config-if)#ip add 200.1.1.1 255.255.255.0
ciscoasa(config-if)#no shut
ciscoasa(config-if)#exit
ciscoasa(config)#route outside 0.0.0.0 0.0.0.0 200.1.1.2
ciscoasa(config)#object network INSIDE
ciscoasa(config-network-object)#subnet 192.168.1.0 255.255.255.0
ciscoasa(config-network-object)#nat (inside,outside) dynamic interface
ciscoasa(config-network-object)#exit
ciscoasa#conf t
ciscoasa(config)#class-map INSPECTION_DEFAULT
ciscoasa(config-cmap)#match default-inspection-traffic ( ?)
ciscoasa(config-cmap)#exit
ciscoasa(config)#policy-map global_policy
ciscoasa(config-pmap)#class INSPECTION_DEFAULT
ciscoasa(config-pmap-c)#
ciscoasa(config-pmap-c)#inspect icmp
ciscoasa(config-pmap-c)#exit
ciscoasa(config)#service-policy global_policy global

Router

Router(config)#interface GigabitEthernet0/0
Router(config-if)#no shutdown
Router(config-if)#
%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to


up
ip address 200.1.1.2 255.255.255.0
Router(config-if)#ip address 200.1.1.2 255.255.255.0
Router(config-if)#
Router(config-if)#exit
Router(config)#interface GigabitEthernet0/1
Router(config-if)#no shutdown
Router(config-if)#
%LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to


up
ip address 8.8.8.1 255.0.0.0
Router(config-if)#ip address 8.8.8.1 255.0.0.0
Router(config-if)#

SITE1(config)# crypto isakmp enable

SITE1(config)# crypto isakmp policy 10

SITE1(config-isakmp)# encryption aes

SITE1(config-isakmp)# authentication pre-share

SITE1(config-isakmp)# hash sha

SITE1(config-isakmp)# group 2

SITE1(config)# crypto isakmp key pass1234 address 80.2.0.2

SITE1(config)# crypto ipsec transform-set VPNSET esp-aes esp-sha-hmac

SITE1(config)# ip access-list extended VPN

SITE1(config-ext-nacl)# permit ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.0.255

SITE1(config)# crypto map VPNMAP 10 ipsec-isakmp


SITE1(config-crypto-map)# match address VPN

SITE1(config-crypto-map)# set peer 80.2.0.2

SITE1(config-crypto-map)# set transform-set VPNSET

SITE1(config)# interface serial 0/0

SITE1(config-if)# crypto map VPNMAP

SITE2(config)# crypto isakmp enable

SITE2(config)# crypto isakmp policy 10

SITE2(config-isakmp)# encryption aes

SITE2(config-isakmp)# authentication pre-share

SITE2(config-isakmp)# hash sha

SITE2(config-isakmp)# group 2

SITE2(config)# crypto isakmp key pass1234 address 80.1.0.2

SITE2(config)# crypto ipsec transform-set VPNSET esp-aes esp-sha-hmac

SITE2(config)# ip access-list extended VPN

SITE2(config-ext-nacl)# permit ip 172.16.0.0 0.0.0.255 192.168.0.0 0.0.0.255

SITE2(config)# crypto map VPNMAP 10 ipsec-isakmp

SITE2(config-crypto-map)# match address VPN

SITE2(config-crypto-map)# set peer 80.1.0.2

SITE2(config-crypto-map)# set transform-set VPNSET

SITE2(config)# interface serial 0/0

SITE2(config-if)# crypto map VPNMAP

#######################################################################

POUR LA VERIFICATION

 # show crypto isakmp sa

 # show crypto ipsec sa

You might also like