현재 Cisco ASA 버전 8.0(4)과 CentOS Linux 서버 간에 IPsec VPN을 설정하려고 합니다.
터널이 성공적으로 연결되었지만 알 수 없는 어떤 이유로 인해 방화벽이 VPN에서 패킷을 삭제하고 있습니다.
ASA sre의 IPsec 설정은 다음과 같습니다.
crypto ipsec transform-set up-transform-set esp-3des esp-md5-hmac
crypto ipsec transform-set up-transform-set2 esp-3des esp-sha-hmac
crypto ipsec transform-set up-transform-set3 esp-aes esp-md5-hmac
crypto ipsec transform-set up-transform-set4 esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map linuxserver 10 match address filtro-encrypt-linuxserver
crypto map linuxserver 10 set peer linuxserver
crypto map linuxserver 10 set transform-set up-transform-set2 up-transform-set3 up-transform-set4
crypto map linuxserver 10 set security-association lifetime seconds 28800
crypto map linuxserver 10 set security-association lifetime kilobytes 4608000
crypto map linuxserver interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption aes
hash sha
group 2
lifetime 28800
crypto isakmp policy 2
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 3
authentication pre-share
encryption aes-256
hash md5
group 2
lifetime 86400
crypto isakmp policy 4
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 5
authentication pre-share
encryption aes-192
hash md5
group 2
group-policy linuxserverip internal
group-policy linuxserverip attributes
vpn-filter value filtro-linuxserverip
tunnel-group linuxserverip type ipsec-l2l
tunnel-group linuxserverip general-attributes
default-group-policy linuxserverip
tunnel-group linuxserverip ipsec-attributes
pre-shared-key *
문제가 어디에 있는지, 해결 방법을 아는 사람이 있나요?
답변1
ASA에 NAT 및 관련 액세스 목록을 표시할 수 있습니까?
예를 들어:
액세스 목록 nat0 확장 허용 IP 192.168.105.0 255.255.255.0 192.168.1.0 255.255.255.0 nat (내부) 0 액세스 목록 nat0
이는 2개의 VPN과 No-Nat 액세스 목록과 실제 VPN 액세스 목록 간의 차이점을 보여주기 위한 ASA 구성의 예외입니다. 기본적으로 비-NAT 액세스 목록은 VPN 액세스 목록의 요약입니다.
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.4.1 255.255.255.0
!
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 10.10.0.0 255.255.0.0
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.7.0 255.255.255.0
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 10.10.0.0 255.255.0.0
access-list TOCHICAGO extended permit ip 192.168.4.0 255.255.255.0 192.168.7.0 255.255.255.0
!
global (outside) 1 interface
nat (inside) 0 access-list nat0
nat (inside) 1 192.168.4.0 255.255.255.0
!
crypto map 2GRMLA 28 match address TONJ
crypto map 2GRMLA 28 set peer xxx.xxx.xxx.xxx
crypto map 2GRMLA 28 set transform-set moishes
crypto map 2GRMLA 71 match address TOCHICAGO
crypto map 2GRMLA 71 set peer ***.***.***.***
crypto map 2GRMLA 71 set transform-set 3DES