{思科CCNA-SEC}IOS-ASA IKEv2 crypto map

配置ikev2 proposal （相当于之前v1时多个policy的集合，也可以做多个）

Outsite(config)#crypto ikev2 proposal ikev2-proposal

Outsite(config-ikev2-proposal)#encryption 3des aes-cbc-256

Outsite(config-ikev2-proposal)#integrity sha256 sha512

Outsite(config-ikev2-proposal)#group 2 5 15

策略中调用 proposal

Outsite(config)#crypto ikev2 policy ikev2_policy

Outsite(config-ikev2-policy)#proposal ikev2_proposal

Ikev2 key配置

Outsite(config)#crypto ikev2 keyring ikev2_key

Outsite(config-ikev2-keyring)#peer asa   //只有标识意义

Outsite(config-ikev2-keyring-peer)#address 202.200.200.2

Outsite(config-ikev2-keyring-peer)#pre-shared-key cisco

配置ikev2 profile

Outsite(config)#crypto ikev2 profile ikev2_profile

IKEv2 profile MUST have:

   1. A local and a remote authentication method.

   2. A match identity or a match certificate statement.

Outsite(config-ikev2-profile)#authentication remote pre-share 

Outsite(config-ikev2-profile)#authentication local pre-share

Outsite(config-ikev2-profile)#keyring local ikev2_key  //调用key

Outsite(config-ikev2-profile)#match identity remote address 202.200.200.2 255.255.255.255  //对端地址

Outsite(config-ikev2-profile)#identity local address 202.100.100.1  //本地端点地址

配置ipsec 转换集

Outsite(config)#crypto ipsec transform-set myset esp-3des esp-sha-hmac 

Outsite(cfg-crypto-trans)#mode tunnel //思科设备可协商

配置 crypto map

Outsite(config)#access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255

Outsite(config)#crypto map mymap 1 ipsec-isakmp 

Outsite(config-crypto-map)#set peer 202.200.200.2

Outsite(config-crypto-map)#set transform-set myset //可配置调用多个

Outsite(config-crypto-map)#set ikev2-profile ikev2_profile

Outsite(config-crypto-map)#match address 100

调用map

Outsite(config)#int f0/0

Outsite(config-if)#crypto map mymap

ASA

配置启用IKEv2

ASA(config)# crypto ikev2 enable outside

建立ikev2 策略

ASA(config)# crypto ikev2 policy 10

ASA(config-ikev2-policy)# encryption aes-256 des

ASA(config-ikev2-policy)# integrity sha256 sha

ASA(config-ikev2-policy)# group 2 1

ASA(config-ikev2-policy)# prf sha256 sha  //注意默认策略匹配

配置tunnel-group

ASA(config)# tunnel-group 202.100.100.1 type ipsec-l2l 

ASA(config)# tunnel-group 202.100.100.1 ipsec-attributes

ASA(config-tunnel-ipsec)# ikev2 local-authentication pre-shared-key cisco

ASA(config-tunnel-ipsec)# ikev2 remote-authentication pre-shared-key cisco

配置IKEv2 proposal

ASA(config)# crypto ipsec ikev2 ipsec-proposal ikev2_proposal

ASA(config-ipsec-proposal)# protocol esp encryption 3des 

ASA(config-ipsec-proposal)# protocol esp integrity sha

感兴趣数据流

ASA(config)# access-list 100 permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0

配置crypto map

ASA(config)# crypto map mymap 1 match address 100

ASA(config)# crypto map mymap 1 set peer 202.100.100.1

ASA(config)# crypto map mymap 1 set ikev2 ipsec-proposal ikev2_proposal

ASA(config)# crypto map mymap interface outside   //调用

注意：ASA没有默认策略集，修改配置需要和ios端匹配