ipsec – لیست های دسترسی Cisco ASA و پیکربندی شبکه

در اینجا پیکربندی من برای این شبکه است. متوجه شدم که ASA ها از طریق یکدیگر پینگ نمی کنند. همچنین وقتی show crypto isakmp SA و IPSec Sa را تایپ می کنم، مطلقاً هیچ چیز را نشان نمی دهد. آیا می توانید آنچه را که اشتباه است یا پیشنهادی برای این پیکربندی برای همه ASA در LA SD SF MI NY پیدا کنید؟ من واقعا آن را قدردانی می کنم

ISP

Int g0/0
ip add 2.2.1.1 255.255.255.252
no shut

Int g0/1
IP add 2.2.2.1 255.255.255.252
no shut

int g0/2
ip add 2.2.3.1 255.255.255.252
no shut

int g0/3
ip add 4.4.129.1 255.255.255.252
no shut

int g0/3
ip add 4.4.128.1 255.255.255.252
no shut

LA، ASA 5506: 8.4 یا بالاتر

!
hostname LA
!
interface G0/0
 nameif outside
 security-level 0
 ip address 2.2.1.2 255.255.255.0
 no shut
!
interface G0/1
 nameif inside
 security-level 100
 ip address 10.10.255.1 255.255.255.0
 no shut
!
route outside 0.0.0.0 0.0.0.0 2.2.1.1
!
!
object network INSIDE_NETWORK
 subnet 10.10.0.0 255.255.0.0
 nat (inside,outside) dynamic interface
!
!
! Allowing ICMP through ASA.
!
!class-map inspection_default
! match default-inspection-traffic
!
policy-map global_policy
 class inspection_default
  inspect icmp 
  inspect icmp error
!
!service-policy global_policy global
!
!
! Allowing ICMP to ASA's inside interface from another site.
!
management-access inside
!
!
! Phase 1 (IKEv1)
!
crypto ikev1 enable outside
!
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400
!
tunnel-group 4.4.128.2 type ipsec-l2l
tunnel-group 4.4.128.2 ipsec-attributes
 ikev1 pre-shared-key LA10toNY20
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
 ikev1 pre-shared-key LA10toSF20
tunnel-group 2.2.3.2 type ipsec-l2l
tunnel-group 2.2.3.2 ipsec-attributes
 ikev1 pre-shared-key LA10toSD20

router eigrp 1
network 10.0.0.0
red stat



!
! Phase 2 (IPSec)
!
object network N_10.10.0.0_16
 subnet 10.10.0.0 255.255.0.0
object network N_10.128.0.0_16
 subnet 10.128.0.0 255.255.0.0
object network N_10.20.0.0_16
 subnet 10.20.0.0 255.255.0.0
object network N_10.30.0.0_16
 subnet 10.30.0.0 255.255.0.0
!
access-list IPSEC_NY_ACL extended permit ip object N_10.10.0.0_16 object N_10.128.0.0_16
access-list IPSEC_SF_ACL extended permit ip object N_10.10.0.0_16 object N_10.20.0.0_16
access-list IPSEC_SD_ACL extended permit ip object N_10.10.0.0_16 object N_10.30.0.0_16
!
! NAT Exemption (No NAT)
! Packet Tracer limitation (Manual NAT is not supported.)
!
nat (inside,outside) source static N_10.10.0.0_16 N_10.10.0.0_16 destination static N_10.128.0.0_16 N_10.128.0.0_16 no-proxy-arp route-lookup
nat (inside,outside) source static N_10.10.0.0_16 N_10.10.0.0_16 destination static N_10.20.0.0_16 N_10.20.0.0_16 no-proxy-arp route-lookup
nat (inside,outside) source static N_10.10.0.0_16 N_10.10.0.0_16 destination static N_10.30.0.0_16 N_10.30.0.0_16 no-proxy-arp route-lookup
!
crypto ipsec ikev1 transform-set IPSEC_SET esp-aes-256 esp-sha-hmac
!
crypto map IPSEC_MAP 10 match address IPSEC_NY_ACL
crypto map IPSEC_MAP 10 set peer 4.4.128.2
crypto map IPSEC_MAP 10 set ikev1 transform-set IPSEC_SET
crypto map IPSEC_MAP 10 set security-association lifetime seconds 86400
crypto map IPSEC_MAP 20 match address IPSEC_SF_ACL
crypto map IPSEC_MAP 20 set peer 2.2.2.2
crypto map IPSEC_MAP 20 set security-association lifetime seconds 86400
crypto map IPSEC_MAP 30 match address IPSEC_SD_ACL
crypto map IPSEC_MAP 30 set peer 2.2.3.2
crypto map IPSEC_MAP 30 set ikev1 transform-set IPSEC_SET
crypto map IPSEC_MAP 30 set security-association lifetime seconds 86400
!
crypto map IPSEC_MAP interface outside
!

SF، ASA 5506: 8.4 یا بالاتر

!
hostname SF
!
interface G0/0
 nameif outside
 security-level 0
 ip address 2.2.2.2 255.255.255.252
 no shut
!
interface G0/1
 nameif inside
 security-level 100
 ip address 10.20.255.1 255.255.255.252
 no shut
!
route outside 0.0.0.0 0.0.0.0 2.2.2.1
!
!
object network INSIDE_NETWORK
 subnet 10.20.0.0 255.255.0.0
 nat (inside,outside) dynamic interface




! Allowing ICMP through ASA.
!
!class-map inspection_default
! match default-inspection-traffic
!
policy-map global_policy
 class inspection_default
  inspect icmp 
  inspect icmp error
!
!service-policy global_policy global
!
!
! Allowing ICMP to ASA's inside interface from another site.
!
management-access inside


! Phase 1 (IKEv1)
!
crypto ikev1 enable outside
!
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400
!
tunnel-group 2.2.1.2 type ipsec-l2l
tunnel-group 2.2.1.2 ipsec-attributes
 ikev1 pre-shared-key LA10toSF20

router eigrp 1
network 10.0.0.0
red stat



! Phase 2 (IPSec)
!
object network N_10.20.0.0_16
 subnet 10.20.0.0 255.255.0.0
object network N_10.10.0.0_16
 subnet 10.10.0.0 255.255.0.0


access-list IPSEC_SF_ACL extended permit ip object N_10.20.0.0_16 object N_10.10.0.0_16


! NAT Exemption (No NAT)
! Packet Tracer limitation (Manual NAT is not supported.)
!
crypto ipsec ikev1 transform-set IPSEC_SET esp-aes-256 esp-sha-hmac

nat (inside,outside) source static N_10.20.0.0_16 N_10.20.0.0_16 destination static N_10.10.0.0_16 N_10.10.0.0_16 no-proxy-arp route-lookup
crypto map IPSEC_MAP 20 match address IPSEC_SF_ACL
crypto map IPSEC_MAP 20 set peer 2.2.1.2
crypto map IPSEC_MAP 20 set ikev1 transform-set IPSEC_SET
crypto map IPSEC_MAP 20 set security-association lifetime seconds 86400
!
crypto map IPSEC_MAP interface outside
!

SD، ASA 5506: 8.4 یا بالاتر

!
hostname SD
!
interface G0/0
 nameif outside
 security-level 0
 ip address 2.2.3.2 255.255.255.252
 no shut
!
interface G0/1
 nameif inside
 security-level 100
 ip address 10.30.255.1 255.255.255.252
 no shut
!
route outside 0.0.0.0 0.0.0.0 2.2.3.1
!
!
object network INSIDE_NETWORK
 subnet 10.30.0.0 255.255.0.0
 nat (inside,outside) dynamic interface




! Allowing ICMP through ASA.
!
!class-map inspection_default
! match default-inspection-traffic
!
policy-map global_policy
 class inspection_default
  inspect icmp 
  inspect icmp error
!
!service-policy global_policy global
!
!
! Allowing ICMP to ASA's inside interface from another site.
!
management-access inside


! Phase 1 (IKEv1)
!
crypto ikev1 enable outside
!
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400
!
tunnel-group 2.2.1.2 type ipsec-l2l
tunnel-group 2.2.1.2 ipsec-attributes
 ikev1 pre-shared-key LA10toSD20

router eigrp 1
network 10.0.0.0
red stat



! Phase 2 (IPSec)
!
object network N_10.30.0.0_16
 subnet 10.30.0.0 255.255.0.0
object network N_10.10.0.0_16
 subnet 10.10.0.0 255.255.0.0


access-list IPSEC_SD_ACL extended permit ip object N_10.30.0.0_16 object N_10.10.0.0_16


! NAT Exemption (No NAT)
! Packet Tracer limitation (Manual NAT is not supported.)
!
crypto ipsec ikev1 transform-set IPSEC_SET esp-aes-256 esp-sha-hmac

nat (inside,outside) source static N_10.30.0.0_16 N_10.30.0.0_16 destination static N_10.10.0.0_16 N_10.10.0.0_16 no-proxy-arp route-lookup
crypto map IPSEC_MAP 30 match address IPSEC_SD_ACL
crypto map IPSEC_MAP 30 set peer 2.2.1.2
crypto map IPSEC_MAP 30 set ikev1 transform-set IPSEC_SET
crypto map IPSEC_MAP 30 set security-association lifetime seconds 86400
!
crypto map IPSEC_MAP interface outside
!

MI، ASA 5506: 8.4 یا بالاتر

!
hostname MI
!
interface G0/0
 nameif outside
 security-level 0
 ip address 4.4.129.2 255.255.255.252
 no shut
!
interface G0/1
 nameif inside
 security-level 100
 ip address 10.129.255.1 255.255.255.252
 no shut
!
route outside 0.0.0.0 0.0.0.0 4.4.129.1
!
!
object network INSIDE_NETWORK
 subnet 10.129.0.0 255.255.0.0
 nat (inside,outside) dynamic interface




! Allowing ICMP through ASA.
!
!class-map inspection_default
! match default-inspection-traffic
!
policy-map global_policy
 class inspection_default
  inspect icmp 
  inspect icmp error
!
!service-policy global_policy global
!
!
! Allowing ICMP to ASA's inside interface from another site.
!
management-access inside


! Phase 1 (IKEv1)
!
crypto ikev1 enable outside
!
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400
!
tunnel-group 4.4.128.2 type ipsec-l2l
tunnel-group 4.4.128.2 ipsec-attributes
 ikev1 pre-shared-key NY10toMI20

router eigrp 1
network 10.0.0.0
red stat


! Phase 2 (IPSec)
!
object network N_10.129.0.0_16
 subnet 10.129.0.0 255.255.0.0
object network N_10.128.0.0_16
 subnet 10.128.0.0 255.255.0.0


access-list IPSEC_MI_ACL extended permit ip object N_10.129.0.0_16 object N_10.128.0.0_16


! NAT Exemption (No NAT)
! Packet Tracer limitation (Manual NAT is not supported.)
!
crypto ipsec ikev1 transform-set IPSEC_SET esp-aes-256 esp-sha-hmac

nat (inside,outside) source static N_10.129.0.0_16 N_10.129.0.0_16 destination static N_10.128.0.0_16 N_10.128.0.0_16 no-proxy-arp route-lookup
crypto map IPSEC_MAP 20 match address IPSEC_MI_ACL
crypto map IPSEC_MAP 20 set peer 4.4.128.2
crypto map IPSEC_MAP 20 set ikev1 transform-set IPSEC_SET
crypto map IPSEC_MAP 20 set security-association lifetime seconds 86400
!
crypto map IPSEC_MAP interface outside
!

NY، ASA 5506: 8.4 یا بالاتر

!
hostname NY
!
interface G0/0
 nameif outside
 security-level 0
 ip address 4.4.128.2 255.255.255.252
 no shut
!
interface G0/1
 nameif inside
 security-level 100
 ip address 10.128.255.1 255.255.255.252
 no shut
!
route outside 0.0.0.0 0.0.0.0 4.4.128.1
!
!
object network INSIDE_NETWORK
 subnet 10.128.0.0 255.255.0.0
 nat (inside,outside) dynamic interface




! Allowing ICMP through ASA.
!
!class-map inspection_default
! match default-inspection-traffic
!
policy-map global_policy
 class inspection_default
  inspect icmp 
  inspect icmp error
!
!service-policy global_policy global
!
!
! Allowing ICMP to ASA's inside interface from another site.
!
management-access inside


! Phase 1 (IKEv1)
!
crypto ikev1 enable outside
!
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400
!
tunnel-group 4.4.129.2 type ipsec-l2l
tunnel-group 4.4.129.2 ipsec-attributes
 ikev1 pre-shared-key NY10toMI20
tunnel-group 2.2.1.2 type ipsec-l2l
tunnel-group 2.2.1.2 ipsec-attributes
 ikev1 pre-shared-key LA10toNY20

router eigrp 1
network 10.0.0.0
red stat


! Phase 2 (IPSec)
!
object network N_10.128.0.0_16
 subnet 10.128.0.0 255.255.0.0
object network N_10.129.0.0_16
 subnet 10.129.0.0 255.255.0.0
object network N_10.128.0.0_16
 subnet 10.128.0.0 255.255.0.0
object network N_10.10.0.0_16
 subnet 10.10.0.0 255.255.0.0


access-list IPSEC_MI_ACL extended permit ip object N_10.128.0.0_16 object N_10.129.0.0_16
access-list IPSEC_NY_ACL extended permit ip object N_10.128.0.0_16 object N_10.10.0.0_16


! NAT Exemption (No NAT)
! Packet Tracer limitation (Manual NAT is not supported.)
!
crypto ipsec ikev1 transform-set IPSEC_SET esp-aes-256 esp-sha-hmac

nat (inside,outside) source static N_10.128.0.0_16 N_10.128.0.0_16 destination static N_10.129.0.0_16 N_10.129.0.0_16 no-proxy-arp route-lookup
nat (inside,outside) source static N_10.128.0.0_16 N_10.128.0.0_16 destination static N_10.10.0.0_16 N_10.10.0.0_16 no-proxy-arp route-lookup
crypto map IPSEC_MAP 10 match address IPSEC_NY_ACL
crypto map IPSEC_MAP 10 set peer 2.2.1.2
crypto map IPSEC_MAP 10 set ikev1 transform-set IPSEC_SET
crypto map IPSEC_MAP 10 set security-association lifetime seconds 86400
crypto map IPSEC_MAP 20 match address IPSEC_MI_ACL
crypto map IPSEC_MAP 20 set peer 4.4.129.2
crypto map IPSEC_MAP 20 set ikev1 transform-set IPSEC_SET
crypto map IPSEC_MAP 20 set security-association lifetime seconds 86400
!
crypto map IPSEC_MAP interface outside