问

请教关于思科ipsecvpn问题

IPSec VPN

2021-08-20提问

1关注
1收藏，2227浏览

zhiliao_ECvGu

zhiliao_ECvGu 零段

粉丝：2人关注：0人

问题描述：

思科路由器做ispecvpn分支，拨号联网，
想实现分支用户匹配acl进入vpn隧道，未匹配acl流量丢弃。
实际配置后发现分支用户可以既访问互联网又访问vpn资源，请专家帮忙看看配置是否有问题

组网及组网描述：

Building configuration...

Current configuration : 2648 bytes

version 15.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname tsykm

boot-start-marker

boot-end-marker

enable secret 5

no aaa new-model

ip dhcp excluded-address 172.19.142.1 172.19.142.10

ip dhcp pool pool-tsykm

import all

network 172.19.142.0 255.255.255.0

default-router 172.19.142.1

dns-server 172.16.2.1 172.16.2.2

ip cef

no ipv6 cef

multilink bundle-name authenticated

cts logging verbose

license udi pid CISCO1921/K9

username admin privilege 15 secret 5

redundancy

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

lifetime 1000

crypto isakmp key xxx address 1.1.1.1

crypto ipsec transform-set pix-set esp-3des esp-md5-hmac

mode tunnel

crypto map pix 10 ipsec-isakmp

set peer 1.1.1.1

set transform-set pix-set

match address 101

interface Embedded-Service-Engine0/0

no ip address

shutdown

interface GigabitEthernet0/0

ip address 172.19.142.1 255.255.255.0

duplex auto

speed auto

interface GigabitEthernet0/1

no ip address

duplex auto

speed auto

pppoe enable group global

pppoe-client dial-pool-number 1

interface Dialer0

ip address negotiated

ip mtu 1452

encapsulation ppp

dialer pool 1

dialer-group 1

ppp authentication chap pap callin

ppp chap hostname a18987592365

ppp chap password 0 abc123

ppp pap sent-username a18987592365 password 0 abc123

crypto map pix

ip forward-protocol nd

no ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 Dialer0

dialer-list 1 protocol ip permit

snmp-server community Read@tsydss25 RO

snmp-server host 10.16.254.211 version 2c Read@tsydss25

access-list 101 permit ip 172.19.142.0 0.0.0.255 172.16.0.0 0.0.255.255

access-list 101 permit ip host 172.19.142.1 host 10.16.254.211

access-list 101 permit ip 172.19.142.0 0.0.0.255 host 10.16.253.247

access-list 102 permit ip 172.17.0.0 0.0.255.255 any

access-list 102 permit ip 172.18.0.0 0.0.255.255 any

access-list 102 permit ip 172.19.0.0 0.0.255.255 any

access-list 102 permit ip 172.16.168.0 0.0.1.255 any

access-list 102 permit ip 10.16.254.0 0.0.0.255 any

access-list 102 deny ip any any

control-plane

line con 0

line aux 0

line 2

no activation-character

no exec

transport preferred none

transport output pad telnet rlogin lapb-ta mop udptn v120 ssh

stopbits 1

line vty 0 4

privilege level 15

transport input ssh

scheduler allocate 20000 1000

end

最佳答案

得闲饮汤127

得闲饮汤127 九段

粉丝：42人关注：7人

IPSEC VPN故障排查：
1、检查公网地址的连通性
2、检查ipsec acl是否配置正确（两端ACL以互为镜像的方式配置）
3、检查ike keychain/ike profile 协商参数配置是否正确（工作模式、keychain、identity、本端/对端隧道地址或隧道名称、NAT穿越功能v7自适应）
4、检查ipsec proposal（v5平台） /ipsec transform-set（v7平台）参数两端是否一致（封装模式、安全协议、验证算法、加密算法）
5、检查设备是否创建ipsec策略，并加载协商参数（acl、ike profile 、ipsec transform-set、对端隧道IP）
6、检查ipsec策略是否应用在正确的接口上