Cloud Native应用交付
  • 首页
  • 关于本站
  • 个人介绍
  • Downloads
  • Repo
    • Github
    • Container
  • F5
    • F5 Python SDK
    • F5-container
    • F5-LBaaS
  • 社交
    • 联系我
    • 微信/微博
    • 公众号
    • 打赏赞助
行至水穷处 坐看云起时
☁️We are in new App Mesh era: imesh.club ☁️
  1. 首页
  2. 路由器技术
  3. 正文

再整理VPN,vpn client to IOS

2007年10月16日 5256点热度 0人点赞 0条评论

2811#sh run
Building configuration...

Current configuration : 2771 bytes
!

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname 2811
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 18fbN$RM6FsYh4Oc345345eEeDZs60
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local

!
aaa session-id common
!
resource policy
!
clock timezone GMT 8
ip subnet-zero
!
!
ip cef
!
!
ip domain name domain.com
!        
!
password encryption aes
!
!
username user1 password 7 03135A05245324324hh0116204342413414123249010C
username user2 secret 5 1IT1c$.RUNhgzi3o342teryh46urnh34525gecBA26.
!
!
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2

!
crypto isakmp client configuration group  group_policy
 key cisco123
 pool vpnpool
 acl splittunnel
 save-password
 netmask 255.255.255.0

!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto dynamic-map dynamimap 10
 set transform-set myset

!
!
crypto map clientmap client authentication list userauthen  
上面的语句实现客户端验证使用 扩展 验证,这样就启用了XAUTHEN,不配则不会产生XAUTHEN,而且这里只是启用而已,如果将userauthen换成随便一个名字,客户端一样正常拨入,
crypto map clientmap isakmp authorization list groupauthor
上面这个语句必配,否则路由器和客户端的IKE策略不匹配,该语句才是实际校验用户用。
crypto map clientmap client configuration address respond
响应客户端的之请求
crypto map clientmap 10 ipsec-isakmp dynamic dynamimap

!
!
!
interface FastEthernet0/0
 description LAN
 ip address 10.10.70.254 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 description WAN
 ip address 222.188.155.177 255.255.255.0
 ip access-group internet in
 duplex auto
 speed auto
 crypto map clientmap
!
interface Serial0/0/0
 no ip address
 shutdown
 clock rate 2000000
!
interface Serial0/0/1
 no ip address
 shutdown
 clock rate 2000000
!
ip local pool vpnpool 10.70.71.3 10.70.71.100
ip classless
ip route 0.0.0.0 0.0.0.0 222.188.155.2
!
no ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
!
ip access-list extended internet
 deny   tcp any host 222.188.155.177 eq 161
 deny   tcp any host 222.188.155.177 eq 162
 deny   tcp any host 222.188.155.177 eq telnet
 permit ip any any
ip access-list extended splittunnel
 permit ip 10.10.70.0 0.0.0.255 10.70.71.0 0.0.0.255

!
logging trap warnings
logging 172.20.20.100
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
 transport input telnet ssh
line vty 5 1180
 transport input telnet ssh
!
scheduler allocate 20000 1000
ntp clock-period 17207854
ntp server 192.168.1.253
!
end

 附:客户端组策略参数

 2811(config)#crypto isakmp client configuration group group_policy
2811(config-isakmp-group)#?
ISAKMP group policy config commands:
  access-restrict    Restrict clients in this group to an interface
  acl                Specify split tunneling inclusion access-list number,启用分割隧道,在客户机中插入路由
  backup-gateway     Specify backup gateway
  dns                Specify DNS Addresses
  domain             Set default domain name to send to client
  exit               Exit from ISAKMP client group policy configuration mode
  firewall           Enforce group firewall feature
  group-lock         Enforce group lock feature
  include-local-lan  Enable Local LAN Access with no split tunnel ,容许客户机在没有分割隧道时也能访问本地局域网
  key                pre-shared key/IKE password,client软件建立一个链接时要预配置的KEY
  max-logins         Set maximum simultaneous logins for users in this group,同一用户能同时登录的最大数
  max-users          Set maximum number of users for this group
  netmask            netmask used by the client for local connectivity,指定地址池中的掩码,否则自动按主类分配给客户端
  no                 Negate a command or set its defaults
  pfs                The client should propose PFS,要求客户端提议完美转发secrecy,(Perfect Forward Secrecy) 
  pool               Set name of address pool
  save-password      Allows remote client to save XAUTH password,容许客户端软件出现保存密码选项。
  split-dns          DNS name to append for resolution,详细见:http://www.cisco.com/en/US/products/ps6441/products_feature_guide09186a00806bd780.html
  wins               Specify WINS Addresses

本作品采用 知识共享署名 4.0 国际许可协议 进行许可
标签: VPN IPSec
最后更新:2007年10月16日

纳米

http://linjing.io

打赏 点赞
< 上一篇
下一篇 >

文章评论

取消回复

纳米

http://linjing.io

☁️迈向Cloud Native ADC ☁️

认证获得:
Kubernetes: CKA #664
Microsoft: MCSE MCDBA
Cisco: CCNP
Juniper: JNCIS
F5:
F5 Certified Solution Expert, Security
F5 Certified Technology Specialist, LTM/GTM/APM/ASM
F5 Certified BIG-IP Administrator
  • 点击查看本博技术要素列表
  • 分类目录
    • Avi Networks (3)
    • Cisco ACI (1)
    • CISCO资源 (21)
    • F5 with ELK (8)
    • F5-Tech tips (38)
    • F5技术 (203)
    • Juniper (4)
    • Linux (7)
    • Nginx (18)
    • SDN (4)
    • ServiceMesh (19)
    • WEB编程 (8)
    • WINDOWS相关 (7)
    • 业界文章 (18)
    • 交换机技术 (20)
    • 化云为雨/Openstack (35)
    • 协议原理 (52)
    • 容器/k8s (64)
    • 我的工作 (19)
    • 我的生活 (70)
    • 网站技术 (19)
    • 路由器技术 (80)
    • 项目案例 (28)
    文章归档
    标签聚合
    F5 k8s openstack nginx istio DNS envoy gtm docker network flannel api irule bigip neutron cc kubernetes ELK vxlan BGP dhcp VPN IPSec lbaas ingress ingress controller nginx plus sidecar IPSec VPN NAT sql
    最新 热点 随机
    最新 热点 随机
    Say hello for 2021 二进制flannel部署,非cni网络模式下与k8s CIS结合方案 又是一年国庆 Service Account Token Volume Projection Istio ingressgateway 静态TLS证书加载与SDS发现方式配置区别 Istio里Gateway的port定义与实际ingressgateway的listener端口关系及规则 Helm 3 部署NGINX Ingress Controller 应用交付老兵眼中的Envoy, 云原生时代下的思考 Istio sidecar iptables以及流量控制分析 Istio 熔断策略及envoy配置
    Say hello for 2021
    [推荐]任何人都可以用上IE7了! Neutron Networking: Neutron Routers and the L3 Agent 【案例】江苏电信F5双活数据中心 BIND从9.4.1-P1开始在递归设置的微妙变化 2009,我的这一年 【转】Vxlan基础理解 下载天网防火墙规则 FOR 天网3.0个人零售版本 Aspen Mesh a service mesh product from F5 Networks. some free CA Authentication, Authorization, and Accounting (AAA) and case study
    链接表
    • Jimmy Song‘s Blog
    • SDNap
    • SDNlab
    • SDN论坛
    • Service Mesh社区
    • 三斗室
    • 个人profile

    COPYRIGHT © 2020 Cloud Native应用交付. ALL RIGHTS RESERVED.

    THEME KRATOS MADE BY VTROIS

    京ICP备14048088号-1

    京公网安备 11010502041506号

    [ Placeholder content for popup link ] WordPress Download Manager - Best Download Management Plugin