思科路由器L2L、EzVPN旁挂方式部署测试

一、概述：

在实际工作中经常可以看到深信服的SSL VPN可以旁路部署，并且支持路由模式和NAT模式：路由器模式需要内网对VPN分派的地址池地址可路由器；NAT模式，VPN客户端访问内网主机时，内网主机看到的地址为VPN接口地址，因此不需要VPN地址池的地址内网可路由。如是想测试一下思科的设备这种部署方式，先测试L2L和EzVPN,如果有时间准备再测试一下SSLVPN。

二、基本思路：

A.总部的L2L VPN和EzVPN都用Dynamic VTI方式配置
B.如果需要以NAT方式部署，在虚拟模板接口配置NAT
C.通过实验也可以很容易看出，通过DVTI方式配置的L2L和EzVPN不会相互干扰

三、测试拓扑：

四、基本配置：
A.Inside_Router
interface Ethernet0/0
ip address 192.168.1.1 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 192.168.1.254
B.ASA842:
interface GigabitEthernet0
nameif Inside
security-level 100
ip address 192.168.1.254 255.255.255.0
no shut
interface GigabitEthernet1
nameif DMZ
security-level 50
ip address 10.1.1.254 255.255.255.0
no shut
interface GigabitEthernet2
nameif Outside
security-level 0
ip address 202.100.1.1 255.255.255.0
no sht
route Outside 0.0.0.0 0.0.0.0 202.100.1.10 1
C.DMZ_VPN：
interface Ethernet0/0
ip address 10.1.1.1 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 10.1.1.254
D.Internet:
interface Ethernet0/0
ip address 202.100.1.10 255.255.255.0
no shut
interface Ethernet0/1
ip address 202.100.2.10 255.255.255.0
no shut
E:Brach:

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/45/104 ms
DMZ_VPN#ping 202.100.1.10

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/48/88 ms
②Branch：
interface Ethernet0/0
ip nat outside
interface Loopback0
ip nat inside
ip access-list extended PAT
deny   ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 172.16.1.0 0.0.0.255 any
ip nat inside source list PAT interface Ethernet0/0 overload
---测试：
Branch#PING 202.100.1.1 SOUrce L0   

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.1.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/36/168 ms
B.静态PAT:
----只在ASA842配置
①静态PAT设置：
object network DMZ_VPN
host 192.168.1.1
object network DMZ_VPN2
host 192.168.1.1
object network DMZ_VPN
nat (DMZ,Outside) static interface service udp 4500 4500
object network DMZ_VPN2
nat (DMZ,Outside) static interface service udp isakmp isakmp
②防火墙策略配置：
access-list OUTSIDE extended permit udp host 202.100.2.1 object DMZ_VPN eq 4500
access-list OUTSIDE extended permit udp host 202.100.2.1 object DMZ_VPN2 eq isakmp
access-list OUTSIDE extended permit esp host 202.100.2.1 object DMZ_VPN
access-group OUTSIDE in interface Outside
五.L2L VPN配置：
A.DMZ_VPN:
①第一阶段策略：

 Interface    User               Mode         Idle     Peer Address
B.NAT模式测试：
①DMZ_VPN配置动态PAT:
interface Ethernet0/0
ip nat outside
interface Virtual-Template1 type tunnel
ip nat inside
ip access-list extended VPN_TO_INSIDE
permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
ip nat inside source list VPN_TO_INSIDE interface Ethernet0/1 overload
②测试：
Branch#telnet 192.168.1.1 /source-interface l0
Trying 192.168.1.1 ... Open
User Access Verification

Password:
Inside_Router>show users
   Line       User       Host(s)              Idle       Location
  0 con 0                idle                 00:09:23  
*130 vty 0                idle                 00:00:00 10.1.1.1

 Interface    User               Mode         Idle     Peer Address
---可以看到连接的地址变成了DMZVPN路由器的接口地址了。
七.EzVPN配置：
A.DMZ_VPN:
①第一阶段策略：
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2crypto isakmp client configuration group Ezvpn_group
key cisco
②第1.5阶段XAUTH配置：
aaa new-model
aaa authentication login noacs line none
line console 0
login authentication noacs
line aux 0
login authentication noacs
username xll password xll
aaa authentication login Xauth local
③第1.5阶段MODE-CFG配置：
ip local pool ippool 123.1.1.100 123.1.1.200
ip access-list extended Split_INSIDE
permit ip 192.168.1.0 0.0.0.255 any
aaa authorization network Mcfg local

---不知道是否是EzVPN客户端原因，拨通之后没有隧道分割对应路由，需要手工添加：
route add 192.168.1.0 mask 255.255.255.0 123.1.1.100
八.EzVPN效果测试：
A.配置ASA842策略：
access-list DMZ extended permit icmp any any
access-list DMZ extended permit tcp 123.1.1.0 255.255.255.0 host 192.168.1.1 eq telnet
access-list DMZ extended permit tcp host 10.1.1.1 host 192.168.1.1 eq telnet
---第三条ACE是为了后面NAT方式测试而添加的
B.路由模式效果测试：
①ASA842添加路由：
route dmz 123.1.1.0 255.255.255.0 10.1.1.1
②客户端连接测试：

----可以看到连接的地址为VPN地址池的地址
B.NAT模式效果测试：
①DMZ_VPN配置动态PAT:
interface Ethernet0/0
ip nat outside
interface Virtual-Template2 type tunnel
ip nat inside
ip access-list extended VPN_TO_INSIDE
permit ip 123.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255
ip nat inside source list VPN_TO_INSIDE interface Ethernet0/1 overload
②测试：

----可以看到，telnet到Inside路由器，路由器看到的地址为DMZ_VPN的接口地址。