PIX 6.x ：简单的PIX间的VPN隧道配置示例

PIX Version 6.3(5)
interface ethernet0 auto 
interface ethernet1 auto 
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname PIX-01
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names

!--- Defines interesting traffic that is protected by the IPSec tunnel. 

access-list 101 permit ip 10.1.1.0 255.255.255.0 172.16.1.0 255.255.255.0

!--- Do not perform NAT for traffic to other PIX Firewall. 

access-list NoNAT permit ip 10.1.1.0 255.255.255.0 172.16.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
mtu intf2 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500

!--- Sets the outside address on the PIX Firewall. 

ip address outside 192.168.1.52 255.255.255.0

!--- Sets the inside address on the PIX Firewall. 

ip address inside 10.1.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm history enable
arp timeout 14400

!--- This command tells the PIX not to NAT any traffic !--- deemed interesting for IPSec.

nat (inside) 0 access-list NoNAT

!--- Sets the default route to the default gateway.

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable

!--- Allows IPSec traffic to pass through the PIX Firewall !--- and does not require an additional conduit !--- or access-list statements to permit IPSec traffic.

sysopt connection permit-IPSec

!--- IKE Phase 2: !--- The IPSec transform-set "chevelle" uses esp-md5-hmac to provide !--- data authentication. 

crypto IPSec transform-set chevelle esp-des esp-md5-hmac

!--- Crypto maps set up the SAs for IPSec traffic. !--- Indicates that IKE is used to establish IPSec SAs.

crypto map transam 1 IPSec-isakmp

!--- Assigns interesting traffic to peer 172.22.112.12.

crypto map transam 1 match address 101

!--- Sets the IPSec peer.

crypto map transam 1 set peer 172.22.112.12

!--- Sets the IPSec transform set "chevelle" !--- to be used with the crypto map entry "transam".

crypto map transam 1 set transform-set chevelle

!--- Assigns the crypto map transam to the interface.

crypto map transam interface outside

!--- IKE Phase 1: !--- Enables IKE on the interface used to terminate the IPSec tunnel

isakmp enable outside

!--- Sets the ISAKMP identity of the peer and !--- sets the pre-shared key between the IPSec peers. !--- The same preshared key must be configured on the !--- IPSec peers for IKE authentication.

isakmp key ******** address 172.22.112.12 netmask 255.255.255.255

!--- The PIX uses the IP address method by default !--- for the IKE identity in the IKE negotiations.

isakmp identity address

!--- The ISAKMP policy defines the set of parameters !--- that are used for IKE negotiations. !--- If these parameters are not set, the default parameters are used. !--- The show isakmp policy command shows the differences in !--- the default and configured policy.

isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 1000
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
: end

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname PIX-02
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names

!--- Defines interesting traffic that is protected by the IPSec tunnel. 

access-list 101 permit ip 172.16.1.0 255.255.255.0 10.1.1.0 255.255.255.0

!--- Do not perform NAT for traffic to other PIX Firewall.

access-list NoNAT permit ip 172.16.1.0 255.255.255.0 10.1.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
mtu intf2 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500

!--- Sets the outside address on the PIX Firewall.

ip address outside 172.22.112.12 255.255.255.0

!--- Sets the inside address on the PIX Firewall.

ip address inside 172.16.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm history enable
arp timeout 14400

!--- This command tells the PIX not to NAT any traffic !--- deemed interesting for IPSec.

nat (inside) 0 access-list NoNAT

!--- Sets the default route to the default gateway.

route outside 0.0.0.0 0.0.0.0 172.22.112.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable

!--- Allows IPSec traffic to pass through the PIX Firewall !--- and does not require an additional conduit !--- or access-list statements to permit IPSec traffic.

sysopt connection permit-IPSec

!--- IKE Phase 2:  !--- The IPSec transform set defines the negotiated security policy !--- that the peers use to protect the data flow. !--- The IPSec transform-set "toyota" uses hmac-md5 authentication header !--- and encapsulates the payload with des.

crypto IPSec transform-set toyota esp-des esp-md5-hmac

!--- Crypto maps set up the SAs for IPSec traffic. !--- Indicates that IKE is used to establish IPSec SAs.

crypto map bmw 1 IPSec-isakmp

!--- Assigns interesting traffic to peer 192.168.1.52.

crypto map bmw 1 match address 101

!--- Sets IPSec peer.

crypto map bmw 1 set peer 192.168.1.52

!--- Sets the IPSec transform set "toyota" !--- to be used with the crypto map entry "bmw".

crypto map bmw 1 set transform-set toyota

!--- Assigns the crypto map bmw to the interface.

crypto map bmw interface outside

!--- IKE Phase 1: !--- Enables IKE on the interface used to terminate IPSec tunnel.

isakmp enable outside

!--- Sets the ISAKMP identity of the peer and !--- sets the preshared key between the IPSec peers. !--- The same preshared key must be configured on the !--- IPSec peers for IKE authentication.

isakmp key ******** address 192.168.1.52 netmask 255.255.255.255

!--- The PIX uses the IP address method by default !--- for the IKE identity in the IKE negotiations.

isakmp identity address

!--- The ISAKMP policy defines the set of parameters !--- that are used for IKE negotiations. !--- If these parameters are not set, the default parameters are used.

isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 1000
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
: end

PIX-01#show crypto IPSec sa
interface: outside
Crypto map tag: transam, local addr. 192.168.1.52

local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
current_peer: 172.22.112.12
PERMIT, flags={origin_is_acl,}

!--- This verifies that encrypted packets are being sent !--- and received without any errors.
 
#pkts encaps: 3, #pkts encrypt: 3, #pkts digest 3
#pkts decaps: 3, #pkts decrypt: 3, #pkts verify 3
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 2, #recv errors 0

local crypto endpt.: 192.168.1.52, remote crypto endpt.: 172.22.112.12
path mtu 1500, IPSec overhead 56, media mtu 1500
current outbound spi: 6f09cbf1

!--- Shows inbound SAs that are established.
 
inbound esp sas:
spi: 0x70be0c04(1891503108)
transform: esp-des esp-md5-hmac
in use settings ={Tunnel, }
slot: 0, conn id: 1, crypto map: transam
sa timing: remaining key lifetime (k/sec): (4607999/28430)
IV size: 8 bytes
replay detection support: Y

inbound ah sas:

inbound pcp sas:

!--- Shows outbound SAs that are established.

outbound ESP sas:
spi: 0x6f09cbf1(1862913009)
transform: esp-des esp-md5-hmac
in use settings ={Tunnel, }
slot: 0, conn id: 2, crypto map: transam
sa timing: remaining key lifetime (k/sec): (4607999/28430)
IV size: 8 bytes
replay detection support: Y

outbound ah sas:

outbound PCP sas:


 !--- The ISAKMP SA is in the quiescent state (QM_IDLE) when it exists. !--- The ISAKMP SA is idle. The ISAKMP SA remains authenticated with its !--- peer and can be used for subsequent Quick Mode exchanges. 

PIX-01#show crypto isakmp sa
     dst             src          state      pending        created   
172.22.112.12    192.168.1.52    QM_IDLE        0        1Maui-PIX-01#

PIX-02#show crypto IPSec sa

interface: outside
Crypto map tag: bmw, local addr. 172.22.112.12

local ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
current_peer: 192.168.1.52
PERMIT, flags={origin_is_acl,}

!--- This verifies that encrypted packets are !--- being sent and recede without any errors.
 
#pkts encaps: 3, #pkts encrypt: 3, #pkts digest 3
#pkts decaps: 3, #pkts decrypt: 3, #pkts verify 3
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. Failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: 172.22.112.12, remote crypto endpt.: 192.168.1.52
path mtu 1500, IPSec overhead 56, media mtu 1500
current outbound spi: 70be0c04

!--- Shows inbound SAs that are established.

Inbound ESP sas:
spi: 0x6f09cbf1(1862913009)
transform: esp-des esp-md5-hmac
in use settings ={Tunnel, }
slot: 0, conn id: 1, crypto map: bmw
sa timing: remaining key lifetime (k/sec): (4607999/28097)
IV size: 8 bytes
replay detection support: Y

inbound ah sas:

inbound PCP sas:

!--- Shows outbound SAs that are established.

Outbound ESP sas:
spi: 0x70be0c04(1891503108)
transform: esp-des esp-md5-hmac
in use settings ={Tunnel, }
slot: 0, conn id: 2, crypto map: bmw
sa timing: remaining key lifetime (k/sec): (4607999/28097)
IV size: 8 bytes
replay detection support: Y

outbound ah sas:

outbound PCP sas:


 !--- The ISAKMP SA is in the quiescent state (QM_IDLE) when it exists. !--- The ISAKMP SA is idle. The ISAKMP SA remains authenticated with its !--- peer and can be used for subsequent Quick Mode exchanges.

PIX-02#show crypto isakmp sa
     dst             src          state      pending       created   
172.22.112.12    192.168.1.52    QM_IDLE        0       PIX-02#