Cisco ASA 之 Easy 虚拟专用网

具体原理及参数可以参考：https://blog.51cto.com/14227204/2449696
这里我就不详细说明了，大致原理都一样，我就直接开整了
1、环境如下：

2、开始配置（自行配置接口IP）
ASA 配置如下：

ciscoasa> enPassword:ciscoasa# conf tciscoasa(config)# int e 0/0ciscoasa(config-if)# nameif insideINFO: Security level for "inside" set to 100 by default.ciscoasa(config-if)# ip add 192.168.0.1ciscoasa(config-if)# no shutdownciscoasa(config-if)# exitciscoasa(config)# int e 0/1ciscoasa(config-if)# nameif outsideINFO: Security level for "outside" set to 0 by default.ciscoasa(config-if)# ip add 200.0.0.2ciscoasa(config-if)# no shutdownciscoasa(config)# route outside 0 0 200.0.0.1           # 0代表0.0.0.0 # ASA中的AAA默认开启，所以不需要手动开启了 ciscoasa(config)# username zhangsan password 123123               # 配置AAA认证用户ciscoasa(config)# crypto isakmp enable outside             # 开启IKE协商功能# 阶段一：指定管理连接的相关参数，加密算法等ciscoasa(config)# crypto isakmp policy 10             ciscoasa(config-isakmp-policy)# encryption 3desciscoasa(config-isakmp-policy)# hash sha ciscoasa(config-isakmp-policy)# authentication pre-shareciscoasa(config-isakmp-policy)# group 2ciscoasa(config-isakmp-policy)# exitciscoasa(config)# ip local pool test-pool 192.168.1.200-192.168.1.210          # 创建地址池ciscoasa(config)# access-list split-acl permit ip 192.168.0.0 255.255.255.0 any       # 编写AClciscoasa(config)# group-policy test-group internalciscoasa(config)# group-policy test-group attributesciscoasa(config-group-policy)# split-tunnel-policy tunnelspecifiedciscoasa(config-group-policy)# split-tunnel-network-list value split-aclciscoasa(config-group-policy)# exitciscoasa(config)# tunnel-group test1-group type ipsec-raciscoasa(config)# tunnel-group test1-group general-attributesciscoasa(config-tunnel-general)# address-pool test-pool                 # 应用所创建的地址池ciscoasa(config-tunnel-general)# default-group-policy test-groupciscoasa(config-tunnel-general)# exitciscoasa(config)# tunnel-group test1-group ipsec-attributesciscoasa(config-tunnel-ipsec)# pre-shared-key 321321            # 配置组密钥ciscoasa(config-tunnel-ipsec)# exitciscoasa(config)# crypto ipsec transform-set test-set esp-3des esp-sha-hmacciscoasa(config)# crypto dynamic-map test-dymap 1 set transform-set test-setciscoasa(config)# crypto map test-stamap 1000 ipsec-isakmp dynamic test-dymapciscoasa(config)# crypto map test-stamap int outside            # 应用到接口

客户端安装也可参考：https://blog.51cto.com/14227204/2449696 （后半部分）
3、验证