SSL & get vpn Comprehensive Lab questions

SSL & get vpn Integrated Experiment 1. Network Topology

 

650) this. width = 650; "border =" 0 "alt =" Network Topology "src =" http://www.bkjia.com/uploads/allimg/131227/0SJK0R-0.jpg "/>

2. network requirements

KS establishes a get vpn with Inside1, Inside2, and DMZ2, And the ASA provides an ssl vpn externally.

3. Specific Configuration

KS:

Ip domain name yeslab.net

Crypto key generate rsa modulus 1024 label getvpnkey

Crypto isakmp policy 10
Authentication pre-share
Crypto isakmp key cisco address 10.1.2.1
Crypto isakmp key cisco address 10.1.3.1
Crypto isakmp key cisco address 10.1.4.1
Crypto isakmp key cisco address 10.1.4.10

Crypto ipsec transform-set cisco esp-des esp-md5-hmac

Crypto ipsec profile ipsecprof
Set transform-set cisco

Crypto gdoi group yeslabgroup
Identity number 666888
Server local
Rekey algorithm aes 192
Rekey retransmit 20 number 5
Rekey authentication mypubkey rsa getvpnkey
Rekey transport unicast
Sa ipsec 1
Profile ipsecprof
Match address ipv4 getvpntraffic
Replay time window-size 20
Address ipv4 10.1.1.1

Router ospf 1
Area 0 authentication message-digest
Network 10.1.1.0 0.0.255 area 0

Interface FastEthernet0/0
Ip address 10.1.1.1 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123

Ip access-list extended getvpntraffic
Deny udp 10.0.0.0 0.20.255.255 10.0.0.0 0.20.255.255 eq 848
Permit ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255
 

ASA:

Interface Ethernet0/0
Nameif outside
Security-level 0
Ip address 202.100.1.10 255.255.255.0
Ospf message-digest-key 1 md5 <removed>
!
Interface Ethernet0/1
Nameif DMZ1
Security-level 60
Ip address 10.1.1.10 255.255.255.0
Ospf message-digest-key 1 md5 <removed>
!
Interface Ethernet0/2
Nameif inside
Security-level 100
Ip address 10.1.3.10 255.255.255.0
Ospf message-digest-key 1 md5 <removed>
!
Interface Ethernet0/3
Nameif DMZ2
Security-level 50
Ip address 10.1.2.10 255.255.255.0
Ospf message-digest-key 1 md5 <removed>

Object-group network dmz2
Network-object 10.1.3.0 255.255.255.0
Network-object 10.1.4.0 255.255.255.0
Network-object 10.10.4.0 255.255.255.0
Network-object 10.10.3.0 255.255.255.0
Access-list dmz2 extended permit udp host 10.1.2.1 eq 848 host 10.1.1.1 eq 848
Access-list dmz2 extended permit esp host 10.10.2.1 object-group dmz2

Access-group dmz2 in interface DMZ2

Router ospf 1
Network 10.1.1.0 255.255.255.0 area 0
Network 10.1.2.0 255.255.255.0 area 0
Network 10.1.3.0 255.255.255.0 area 0
Network 202.100.1.0 255.255.255.0 area 0
Area 0 authentication message-digest

Webvpn
Enable outside
Port-forward PF 55555 10.10.2.1 telnet
Group-policy for-localuser internal
Group-policy for-localuser attributes
Banner value welcome yeslab
Webvpn
Port-forward enable PF
Hidden-shares visible
File-entry disable
Url-entry disable
Username localuser password VPMnI7Ryh0/c7eki encrypted

 

DMZ.2:

Username chen password 0 cisco

Crypto isakmp policy 10
Authentication pre-share
Crypto isakmp key cisco address 10.1.1.1

Cmap mymap 10 gdoi
Set group yeslabgroup

Crypto gdoi group yeslabgroup
Identity number 666888
Server address ipv4 10.1.1.1

Crypto
Match address telnet

Interface Loopback0
Ip address 10.10.2.1 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123

Interface FastEthernet0/0
Ip address 10.1.2.1 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123
Crypto map mymap

Router ospf 1
Area 0 authentication message-digest
Network 10.1.2.0 0.0.0.255 area 0
Network 10.10.2.0 0.0.0.255 area 0

Ip access-list extended telnet
Deny tcp host 10.10.2.1 eq telnet host 10.1.2.10
Deny ospf any

Line vty 0 15
Login local

 

Inside.1:

Crypto isakmp policy 10
Authentication pre-share
Crypto isakmp key cisco address 10.1.1.1

Cmap mymap 10 gdoi
Set group yeslabgroup

Crypto gdoi group yeslabgroup
Identity number 666888
Server address ipv4 10.1.1.1

Interface Loopback0
Ip address 10.10.3.1 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123

Interface FastEthernet0/0
Ip address 10.1.3.1 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123
Crypto map mymap

Interface FastEthernet0/1
Ip address 10.1.4.1 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123
Crypto map mymap

Router ospf 1
Area 0 authentication message-digest
Network 10.1.3.0 0.0.0.255 area 0
Network 10.1.4.0 0.0.0.255 area 0
Network 10.10.3.0 0.0.0.255 area 0

Inside.2:

Crypto isakmp policy 10
Authentication pre-share
Crypto isakmp key cisco address 10.1.1.1

Cmap mymap 10 gdoi
Set group yeslabgroup

Crypto gdoi group yeslabgroup
Identity number 666888
Server address ipv4 10.1.1.1

Interface Loopback0
Ip address 10.10.4.1 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123

Interface FastEthernet0/0
Ip address 10.1.4.10 255.255.255.0
Ip ospf message-digest-key 1 md5 yeslab123
Crypto map mymap

Router ospf 1
Area 0 authentication message-digest
Network 10.1.4.0 0.0.0.255 area 0
Network 10.10.4.0 0.0.0.255 area 0

 

4. Result Verification

KS # show crypto gdoi
GROUP INFORMATION

Group Name: yeslabgroup (Unicast)
Group Identity: 666888
Group Members: 3
IPSec SA Direction: Both
Active Group Server: Local
Group Rekey Lifetime: 86400 secs
Group Rekey
Remaining Lifetime: 85691 secs
Rekey Retransmit Period: 20 secs
Rekey Retransmit Attempts: 5
Group Retransmit
Remaining Lifetime: 0 secs

IPSec SA Number: 1
IPSec SA Rekey Lifetime: 3600 secs
Profile Name: ipsecprof
Replay method: Time Based
Replay Window Size: 20
SA Rekey
Remaining Lifetime: 2892 secs
ACL Configured: access-list getvpntraffic

Group Server list: Local

 

KS # show crypto gdoi group yeslabgroup
Group Name: yeslabgroup (Unicast)
Group Identity: 666888
Group Members: 3
IPSec SA Direction: Both
Active Group Server: Local
Group Rekey Lifetime: 86400 secs
Group Rekey
Remaining Lifetime: 85319 secs
Rekey Retransmit Period: 20 secs
Rekey Retransmit Attempts: 5
Group Retransmit
Remaining Lifetime: 0 secs

IPSec SA Number: 1
IPSec SA Rekey Lifetime: 3600 secs
Profile Name: ipsecprof
Replay method: Time Based
Replay Window Size: 20
SA Rekey
Remaining Lifetime: 2520 secs
ACL Configured: access-list getvpntraffic

Group Server list: Local

DMZ.2 # sh crypto gdoi
GROUP INFORMATION

Group Name: yeslabgroup
Group Identity: 666888
Rekeys received: 1
IPSec SA Direction: Both
Active Group Server: 10.1.1.1
Group Server list: 10.1.1.1

GM Reregisters in: 2425 secs
Rekey Received (hh: mm: ss): 00:18:36

Rekeys received
Cumulative: 1
After registration: 1
Rekey Acks sent: 1

ACL Downloaded From KS 10.1.1.1:
Access-list deny udp 10.0.0.0 0.20.255.255 10.0.0.0 0.20.255.255 port = 848
Access-list permit ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255

Kek policy:
Rekey Transport Type: Unicast
Lifetime (secs): 86399
Encrypt Algorithm: AES
Keys Size: 192
Sig Hash Algorithm: HMAC_AUTH_SHA
Sig Key size (bits): 1024

Tek policy:
FastEthernet0/0:
IPsec SA:
Sa direction: inbound
Spi: 0x6A08A4C6 (1778951366)
Transform: esp-des esp-md5-hmac
Sa timing: remaining key lifetime (sec): (2441)
Anti-Replay (Time Based): 20 sec interval

IPsec SA:
Sa direction: outbound
Spi: 0x6A08A4C6 (1778951366)
Transform: esp-des esp-md5-hmac
Sa timing: remaining key lifetime (sec): (2441)
Anti-Replay (Time Based): 20 sec interval

IPsec SA:
Sa direction: inbound
Spi: 0xE34224AE (3812762798)
Transform: esp-des esp-md5-hmac
Sa timing: remaining key lifetime (sec): (2481)
Anti-Replay (Time Based): 20 sec interval

IPsec SA:
Sa direction: outbound
Spi: 0xE34224AE (3812762798)
Transform: esp-des esp-md5-hmac
Sa timing: remaining key lifetime (sec): (2481)
Anti-Replay (Time Based): 20 sec interval

 

 

650) this. width = 650; "border =" 0 "alt =" "src =" http://www.bkjia.com/uploads/allimg/131227/0SJK548-1.jpg "/>

 

Note: This is probably the case, but there are many errors. Please pay attention to it when you try again. Do not trust it!

 

 

This article is from the "Dragon Chuan Ren" blog, please be sure to keep this source http://596699244.blog.51cto.com/378357/565260