路由器的VPN流量过滤

www.ttep.cn

目的：Inside只能访问Private的www流量,Private只能telnet Inside.
ACL处理流程
Inbound

Outbound

Configuration:
Inside:
interface FastEthernet1/0
ip address 1.1.1.1 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 1.1.1.10

GW1:
crypto keyring cisco
pre-shared-key address 64.1.1.1 key cisco
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp profile isaprof
keyring cisco
match identity address 64.1.1.1 255.255.255.255
!
crypto ipsec transform-set SET esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 64.1.1.1
set transform-set SET
set isakmp-profile isaprof
match address vpn
!
interface FastEthernet1/0
ip address 1.1.1.10 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1/1
ip address 202.1.1.1 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
ip route 0.0.0.0 0.0.0.0 202.1.1.10
!
ip access-list extended vpn
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

Internet:
interface FastEthernet1/0
ip address 202.1.1.10 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1/1
ip address 64.1.1.10 255.255.255.0
duplex auto
speed auto

GW2:
crypto keyring cisco
pre-shared-key address 202.1.1.1 key cisco
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp profile isaprof
keyring cisco
match identity address 202.1.1.1 255.255.255.255
!
crypto ipsec transform-set SET esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 202.1.1.1
set transform-set SET
set isakmp-profile isaprof
match address vpn
!
interface FastEthernet1/0
ip address 64.1.1.1 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
interface FastEthernet1/1
ip address 2.2.2.10 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 64.1.1.10
!
ip access-list extended vpn
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255

Private:
interface FastEthernet1/0
ip address 2.2.2.2 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 2.2.2.10




增加控制:
GW1:
ip access-list extended gw1.inbound
permit udp host 64.1.1.1 eq isakmp host 202.1.1.1 eq isakmp
permit esp host 64.1.1.1 host 202.1.1.1
ip access-list extended gw1.outbound
permit esp host 202.1.1.1 host 64.1.1.1
interface FastEthernet1/1
ip access-group gw1.inbound in
ip access-group gw1.outbound out
ip access-list extended crypto.inbound
permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255
ip access-list extended crypto.outbound
permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255
crypto map cisco 10 ipsec-isakmp
set ip access-group crypto.inbound in
set ip access-group crypto.outbound out
GW2:
ip access-list extended gw2.inbound
permit udp host 202.1.1.1 eq isakmp host 64.1.1.1 eq isakmp
permit esp host 202.1.1.1 host 64.1.1.1
ip access-list extended gw2.outbound
permit esp host 64.1.1.1 host 202.1.1.1
interface FastEthernet1/0
ip access-group gw2.inbound in
ip access-group gw2.outbound out
www.ttep.cn
ip access-list extended crypto.inbound
permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255
ip access-list extended crypto.outbound
permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255
crypto map cisco 10 ipsec-isakmp
set ip access-group crypto.inbound in
set ip access-group crypto.outbound out
只能访问www,不能PING

只能telnet,不能PING


来源 http://q3322095.blog.51cto---/3312095/992149