2811#sh run
Building configuration...
Current configuration : 2771 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname 2811
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 18fbN$RM6FsYh4Oc345345eEeDZs60
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
!
aaa session-id common
!
resource policy
!
clock timezone GMT 8
ip subnet-zero
!
!
ip cef
!
!
ip domain name domain.com
!
!
password encryption aes
!
!
username user1 password 7 03135A05245324324hh0116204342413414123249010C
username user2 secret 5 1IT1c$.RUNhgzi3o342teryh46urnh34525gecBA26.
!
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group group_policy
key cisco123
pool vpnpool
acl splittunnel
save-password
netmask 255.255.255.0
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto dynamic-map dynamimap 10
set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
上面的语句实现客户端验证使用 扩展 验证，这样就启用了XAUTHEN，不配则不会产生XAUTHEN，而且这里只是启用而已，如果将userauthen换成随便一个名字，客户端一样正常拨入，
crypto map clientmap isakmp authorization list groupauthor
上面这个语句必配，否则路由器和客户端的IKE策略不匹配，该语句才是实际校验用户用。
crypto map clientmap client configuration address respond
响应客户端的之请求
crypto map clientmap 10 ipsec-isakmp dynamic dynamimap
!
!
!
interface FastEthernet0/0
description LAN
ip address 10.10.70.254 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
description WAN
ip address 222.188.155.177 255.255.255.0
ip access-group internet in
duplex auto
speed auto
crypto map clientmap
!
interface Serial0/0/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/0/1
no ip address
shutdown
clock rate 2000000
!
ip local pool vpnpool 10.70.71.3 10.70.71.100
ip classless
ip route 0.0.0.0 0.0.0.0 222.188.155.2
!
no ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
!
ip access-list extended internet
deny tcp any host 222.188.155.177 eq 161
deny tcp any host 222.188.155.177 eq 162
deny tcp any host 222.188.155.177 eq telnet
permit ip any any
ip access-list extended splittunnel
permit ip 10.10.70.0 0.0.0.255 10.70.71.0 0.0.0.255
!
logging trap warnings
logging 172.20.20.100
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
transport input telnet ssh
line vty 5 1180
transport input telnet ssh
!
scheduler allocate 20000 1000
ntp clock-period 17207854
ntp server 192.168.1.253
!
end
附：客户端组策略参数
2811(config)#crypto isakmp client configuration group group_policy
2811(config-isakmp-group)#?
ISAKMP group policy config commands:
access-restrict Restrict clients in this group to an interface
acl Specify split tunneling inclusion access-list number,启用分割隧道，在客户机中插入路由
backup-gateway Specify backup gateway
dns Specify DNS Addresses
domain Set default domain name to send to client
exit Exit from ISAKMP client group policy configuration mode
firewall Enforce group firewall feature
group-lock Enforce group lock feature
include-local-lan Enable Local LAN Access with no split tunnel ，容许客户机在没有分割隧道时也能访问本地局域网
key pre-shared key/IKE password，client软件建立一个链接时要预配置的KEY
max-logins Set maximum simultaneous logins for users in this group，同一用户能同时登录的最大数
max-users Set maximum number of users for this group
netmask netmask used by the client for local connectivity，指定地址池中的掩码，否则自动按主类分配给客户端
no Negate a command or set its defaults
pfs The client should propose PFS，要求客户端提议完美转发secrecy,(Perfect Forward Secrecy)
pool Set name of address pool
save-password Allows remote client to save XAUTH password,容许客户端软件出现保存密码选项。
split-dns DNS name to append for resolution，详细见：http://www.cisco.com/en/US/products/ps6441/products_feature_guide09186a00806bd780.html
wins Specify WINS Addresses
文章评论