网络工程 - ASA 站点到站点 VPN 配置 - 吾爱随笔录

我有一些关于两个 ASA 防火墙之间的站点到站点 vpn 配置的问题。我有两个防火墙 FW1 和 FW2，其中 FW1 = 192.168.1.0 和 FW2 = 192.168.2.0

我为 FW1 使用了以下模板，显然为 FW2 切换了配置。- 这很完美！第 1 阶段和第 2 阶段出现了，我能够 ping 每一端。

      object network REMOTE_NETWORK
    subnet 192.168.2.0 255.255.255.0
  object network LOCAL_NETWORK
    subnet 192.168.1.0 255.255.255.0
  access-list CRYPTOMAP_ACL line 1 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 
  group-policy GroupPolicy_REMOTE_IP internal
  group-policy GroupPolicy_REMOTE_IP attributes
    vpn-tunnel-protocol ikev1
  exit
  tunnel-group REMOTE_IP type ipsec-l2l
  tunnel-group REMOTE_IP general-attributes
  tunnel-group REMOTE_IP ipsec-attributes
    ikev1 pre-shared-key **********

  crypto ikev1 policy 5
    group 5
    encryption aes-256

  crypto ikev1 enable  outside
  crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  crypto map CRYPTOMAP_NAME 1 match address CRYPTOMAP_ACL
  crypto map CRYPTOMAP_NAME 1 set  peer  REMOTE_PEER_IP
  crypto map CRYPTOMAP_NAME 1 set  ikev1 transform-set  ESP-AES-256-SHA
  crypto map CRYPTOMAP_NAME interface  outside
  nat (inside,outside) 1 source static LOCAL_NETWORK LOCAL_NETWORK destination static REMOTE_NETWORK REMOTE_NETWORK no-proxy-arp route-lookup

然后我想..如果我的局域网上有多个子网需要通过隧道怎么办..如果我有三个子网怎么办..所以我制作了两个名为 LOCAL_SUBNETS 和 REMOTE_SUBNETS 的网络对象并将以下内容放入他们每个人

192.168.1.0/24 192.168.10.0/24 192.168.100.0/24

192.168.2.0/24 192.168.20.0/24 192.168.200.0/24

更改了我的加密 ACL 以允许来自本地对象组和远程对象组的 IP 流量，并更改了我的 nat 豁免规则以匹配对象而不是旧的 IP 地址。由于某种原因，我无法再让它工作了。第 1 阶段已启动，但无论我尝试什么，我都无法 ping 另一端。

这是与之前相同部分的配置.. FW2 显然具有相同的配置，但 ACL 和 NAT 交换了

    object-group network LOCAL_SUBNETS
network-object 192.168.1.0 255.255.255.0
network-object 192.168.10.0 255.255.255.0
network-object 192.168.100.0 255.255.255.0

object-group network REMOTE_SUBNETS
network-object 192.168.2.0 255.255.255.0
network-object 192.168.20.0 255.255.255.0
network-object 192.168.200.0 255.255.255.0
access-list CRYPTOMAP_ACL extended permit ip object-group LOCAL_SUBNETS object-group REMOTE_SUBNETS 
  group-policy GroupPolicy_REMOTE_IP internal
  group-policy GroupPolicy_REMOTE_IP attributes
    vpn-tunnel-protocol ikev1
  exit
  tunnel-group REMOTE_IP type ipsec-l2l
  tunnel-group REMOTE_IP general-attributes
  tunnel-group REMOTE_IP ipsec-attributes
    ikev1 pre-shared-key **********

  crypto ikev1 policy 5
    group 5
    encryption aes-256

  crypto ikev1 enable  outside
  crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  crypto map CRYPTOMAP_NAME 1 match address CRYPTOMAP_ACL
  crypto map CRYPTOMAP_NAME 1 set  peer  REMOTE_PEER_IP
  crypto map CRYPTOMAP_NAME 1 set  ikev1 transform-set  ESP-AES-256-SHA
  crypto map CRYPTOMAP_NAME interface  outside
  nat (inside,outside) source static LOCAL_SUBNETS LOCAL_SUBNETS destination static REMOTE_SUBNETS REMOTE_SUBNETS no-proxy-arp route-lookup

谁能看到我的配置有什么问题？