一，ASA1配置：
asa1#
asa1# show ver
Cisco Adaptive Security Appliance Software Version 8.0(2)
Compiled on Fri 15-Jun-07 19:29 by builders
System image file is "Unknown, monitor mode tftp booted image"
Config file at boot was "startup-config"
asa1 up 57 secs
Hardware: , 128 MB RAM, CPU Pentium II 2796 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
0: Ext: Ethernet0/0 : address is 00ab.cd92.5200, irq 255
1: Ext: Ethernet0/1 : address is 00ab.cd92.5201, irq 255
2: Ext: Ethernet0/2 : address is 0000.abdf.c502, irq 255
3: Ext: Ethernet0/3 : address is 0000.abfa.3703, irq 255
4: Ext: Ethernet0/4 : address is 0000.aba1.d004, irq 255
5: Ext: Ethernet0/5 : address is 0000.abfc.8705, irq 255
VLANs : 200
Failover : Active/Active
3DES-AES : Enabled
Security Contexts : 20
GTP/GPRS : Enabled
*** Peers : 5000
Web*** Peers : 2500
ADV END SEC : Enabled
Configuration register is 0x0
Configuration has not been modified since last system restart.
asa1# show run
: Saved
:
ASA Version 8.0(2)
!
hostname asa1
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif Inside
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 0
ip address 202.100.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/5
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot config disk0:/.private/startup-config
ftp mode passive
access-list *** extended permit ip 1.1.1.0 255.255.255.0 2.2.2.0 255.255.255.0
pager lines 24
mtu Inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
route outside 0.0.0.0 0.0.0.0 202.100.1.10 1
route Inside 0.0.0.0 0.0.0.0 10.1.1.10 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set Trans esp-des esp-md5-hmac
crypto map cry-map 10 match address ***
crypto map cry-map 10 set pfs
crypto map cry-map 10 set peer 61.128.1.1
crypto map cry-map 10 set transform-set Trans
crypto map cry-map 10 set security-association lifetime seconds 1800
crypto map cry-map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
tunnel-group 61.128.1.1 type ipsec-l2l
tunnel-group 61.128.1.1 ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:9a4bd12084c52f9f42e68ed07755eef4
: end
asa1#
二，路由器配置：
Site2#show run
Building configuration...
Current configuration : 1468 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Site2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
ip domain name lab.local
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key L2Lkey address 202.100.1.1
!
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 202.100.1.1
set transform-set cisco
match address ***
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/0
ip address 61.128.1.1 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
interface FastEthernet3/0
no ip address
shutdown
duplex auto
speed auto
!
no ip http server
no ip http secure-server
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 61.128.1.10
!
!
!
ip access-list extended ***
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
!
!
!
control-plane
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end
Site2#