|
针对使用路由器组网的时候经常遇到的VPN流量过滤的方法，下文会做一个大致的说明，也会介绍ACL（访问控制列表）的处理流程情况，也会相应的针对常见的一些问答给出一定的帮助。
目的：Inside只能访问Private的www流量,Private只能telnet Inside.
ACL处理流程
Inbound
Outbound
Configuration:
Inside:
interface FastEthernet1/0
ip address 1.1.1.1 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 1.1.1.10
GW1:
crypto keyring cisco
pre-shared-key address 64.1.1.1 key cisco
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp profile isaprof
keyring cisco
match identity address 64.1.1.1 255.255.255.255
!
crypto ipsec transform-set SET esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 64.1.1.1
set transform-set SET
set isakmp-profile isaprof
match address vpn
!
interface FastEthernet1/0
ip address 1.1.1.10 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1/1
ip address 202.1.1.1 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
ip route 0.0.0.0 0.0.0.0 202.1.1.10
!
ip access-list extended vpn
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255
Internet:
interface FastEthernet1/0
ip address 202.1.1.10 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1/1
ip address 64.1.1.10 255.255.255.0
duplex auto
speed auto
GW2:
crypto keyring cisco
pre-shared-key address 202.1.1.1 key cisco
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp profile isaprof
keyring cisco
match identity address 202.1.1.1 255.255.255.255
!
crypto ipsec transform-set SET esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 202.1.1.1
set transform-set SET
set isakmp-profile isaprof
match address vpn
!
interface FastEthernet1/0
ip address 64.1.1.1 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
interface FastEthernet1/1
ip address 2.2.2.10 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 64.1.1.10
!
ip access-list extended vpn
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
Private:
interface FastEthernet1/0
ip address 2.2.2.2 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 2.2.2.10
增加控制:
GW1:
ip access-list extended gw1.inbound
permit udp host 64.1.1.1 eq isakmp host 202.1.1.1 eq isakmp
permit esp host 64.1.1.1 host 202.1.1.1
ip access-list extended gw1.outbound
permit esp host 202.1.1.1 host 64.1.1.1
interface FastEthernet1/1
ip access-group gw1.inbound in
ip access-group gw1.outbound out
ip access-list extended crypto.inbound
permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255
ip access-list extended crypto.outbound
permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255
crypto map cisco 10 ipsec-isakmp
set ip access-group crypto.inbound in
set ip access-group crypto.outbound out
GW2:
ip access-list extended gw2.inbound
permit udp host 202.1.1.1 eq isakmp host 64.1.1.1 eq isakmp
permit esp host 202.1.1.1 host 64.1.1.1
ip access-list extended gw2.outbound
permit esp host 64.1.1.1 host 202.1.1.1
interface FastEthernet1/0
ip access-group gw2.inbound in
ip access-group gw2.outbound out
ip access-list extended crypto.inbound
permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255
ip access-list extended crypto.outbound
permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255
crypto map cisco 10 ipsec-isakmp
set ip access-group crypto.inbound in
set ip access-group crypto.outbound out
只能访问www,不能PING
只能telnet,不能PING
| 
