本文共 4812 字，大约阅读时间需要 16 分钟。
一.概述： L2L ***第一阶段可以配置成aggressive-mode，因为aggressive-mode没有Main-mode安全，所以一般用在客户端拨号中。 A.测试路由器与防火墙以第一阶段aggressive-mode建立 L2L *** interface Ethernet0/0 ip address 192.168.1.1 255.255.255.0 no shut ip route 0.0.0.0 0.0.0.0 192.168.1.2 interface Ethernet0/0 ip address 192.168.1.2 255.255.255.0 ip nat inside interface Ethernet0/1 ip address 202.100.1.2 255.255.255.0 ip nat outside ip route 0.0.0.0 0.0.0.0 202.100.1.3 ip access-list extended PAT deny ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255 permit ip 192.168.1.0 0.0.0.255 any ip nat inside source list PAT interface Ethernet0/1 overload interface Ethernet0/0 ip address 202.100.1.3 255.255.255.0 interface Ethernet0/1 ip address 202.100.2.3 255.255.255.0 interface GigabitEthernet0 nameif Inside security-level 100 ip address 172.16.1.10 255.255.255.0 interface GigabitEthernet1 nameif Outside security-level 0 ip address 202.100.2.10 255.255.255.0 route Outside 0.0.0.0 0.0.0.0 202.100.2.3 object network Inside_net subnet 172.16.1.0 255.255.255.0 nat (Inside,Outside) dynamic interface policy-map global_policy class inspection_default interface Ethernet0/0 ip address 172.16.1.4 255.255.255.0 ip route 0.0.0.0 0.0.0.0 172.16.1.10 crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key cisco123 hostname ASA842 （这个是多余的，不需要配置） crypto isakmp identity hostname crypto isakmp keepalive 10 periodic crypto isakmp peer address 202.100.2.10 set aggressive-mode password cisco123 set aggressive-mode client-endpoint ipv4-address 202.100.1.2 （这个必须有，否则无法从路由器这侧主动发起***) crypto ipsec transform-set transet esp-3des esp-md5-hmac ip access-list extended *** permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255 crypto map crymap 10 ipsec-isakmp set peer 202.100.2.3 set transform-set transet set pfs group2 match address *** reverse-route crypto ikev1 policy 10 authentication pre-share encryption 3des hash md5 group 2 crypto isakmp identity hostname tunnel-group 202.100.1.2 type ipsec-l2ltunnel-group 202.100.1.2 ipsec-attributes ikev1 pre-shared-key cisco123 crypto ipsec ikev1 transform-set transet esp-3des esp-md5-hmac access-list *** extended permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0 object network Inside_net subnet 172.16.1.0 255.255.255.0object network Remote_net subnet 192.168.1.0 255.255.255.0 nat (Inside,Outside) source static Inside_net Inside_net destination static Remote_net Remote_net crypto map crymap 10 match address *** crypto map crymap 10 set pfscrypto map crymap 10 set peer 202.100.1.2crypto map crymap 10 set ikev1 phase1-mode aggressivecrypto map crymap 10 set ikev1 transform-set transetcrypto map crymap 10 set reverse-route crypto map crymap interface Outside crypto ikev1 enable Outside A.第一阶段，aggressive mode一共三个包，第三个包才是加密的
B.路由器 set aggressive-mode client-endpoint设置的是fqdn还是IP地址，只能决定路由器主动发起连接时使用的是什么 -----如果防火墙侧主动发起，路由器都是以自己的主机名作为回复，而部署配置中的FQDN或IP
C.路由器如果client-endpoint用的是IP，则路由器主动发起aggressive mode时用的是IP地址 D.路由器如果client-endpoint用的是fqdn,则路由器主动发起aggressive mode时用的是设置的FQDN地址 E.不管client-endpoint用的是fqdn，还是IP，如果由防火墙侧主动发起，路由器回复的identity都是自己的主机名 ---如果将ASA842改为PIX8.0，PIX的配置如下： interface Ethernet0 nameif Inside security-level 100 ip address 172.16.1.10 255.255.255.0 interface Ethernet1 nameif Outside security-level 0 ip address 202.100.2.10 255.255.255.0 route Outside 0.0.0.0 0.0.0.0 202.100.2.3 access-list PAT extended permit ip 172.16.1.0 255.255.255.0 any nat (Inside) 1 access-list PAT global (Outside) 1 interface access-list OUTSIDE extended permit icmp any any access-group OUTSIDE in interface OutsideB.***配置： crypto isakmp policy 10 authentication pre-share encryption 3des hash md5 group 2 crypto isakmp identity hostname tunnel-group 202.100.1.2 type ipsec-l2l tunnel-group 202.100.1.2 ipsec-attributes ---备注：tunnel-group也可以用对方的FQDN， crypto map crymap 10 set transform-set transet access-list *** extended permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list NONAT extended permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0 nat (Inside) 0 access-list NONAT crypto map crymap 10 match address ***crypto map crymap 10 set pfscrypto map crymap 10 set peer 202.100.1.2crypto map crymap 10 set transform-set transetcrypto map crymap 10 set phase1-mode aggressive group2（group2为默认值，show不会出现）crypto map crymap 10 set reverse-routecrypto map crymap interface Outside crypto isakmp enable Outside 转载地址：http://nqyoa.baihongyu.com/