PIX与VPN client的pre-shared key互连

pixfirewall# sh config 
: Saved 
: 
PIX Version 6.0(1) 
nameif ethernet0 outside security0 
nameif ethernet1 inside security100 
enable password EZt/JroCts.3MWq4 encrypted 
passwd EZt/JroCts.3MWq4 encrypted 
hostname pixfirewall 
domain-name test.com 
fixup protocol ftp 21 
fixup protocol http 80 
fixup protocol h323 1720 
fixup protocol rsh 514 
fixup protocol smtp 25 
fixup protocol sqlnet 1521 
fixup protocol sip 5060 
fixup protocol skinny 2000 
fixup protocol ftp 2121 
names 
access-list test permit icmp host 192.168.0.243 host 192.168.0.254 echo-reply 
access-list 80 permit ip 10.1.1.0 255.255.255.0 10.1.1.0 255.255.255.0 

pager lines 24 
interface ethernet0 auto 
interface ethernet1 auto 
mtu outside 1500 
mtu inside 1500 
ip address outside 192.168.0.254 255.255.255.0 
！定义PIX的outside口IP 
ip address inside 10.1.1.244 255.255.255.0 
！定义PIX的inside口IP 
ip audit info action alarm 
ip audit attack action alarm 
ip local pool dialer 10.1.1.246-10.1.1.247 
!定义分配给VPN client的IP地址池 
no failover 
failover timeout 0:00:00 
failover poll 15 
failover ip address outside 0.0.0.0 
failover ip address inside 0.0.0.0 
pdm location 10.1.1.88 255.255.255.255 inside 
pdm history enable 
arp timeout 14400 
global (outside) 1 interface 
nat (inside) 0 access-list 80 
！定义不进行NAT的流量 
nat (inside) 1 0.0.0.0 0.0.0.0 0 0 
access-group test in interface outside 
route outside 0.0.0.0 0.0.0.0 192.168.0.243 1 
timeout xlate 3:00:00 
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si 
p 0:30:00 sip_media 0:02:00 
timeout uauth 0:05:00 absolute 
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius 
aaa-server myserver protocol tacacs+ 
!定义AAA服务器使用的协议 
aaa-server myserver (inside) host 10.1.1.88 1234 timeout 5 
!定义AAA服务器的IP地址（装了ACS的服务器） 
http server enable 
http 10.1.1.88 255.255.255.255 inside 
no snmp-server location 
no snmp-server contact 
snmp-server community public 
no snmp-server enable traps 
floodguard enable 
sysopt connection permit-ipsec 
!对于所有IPSec流量不检测允许其通过，如果不加这个命令的话，
需要加上ACL到outside口以允许特定的IPSce流量通过，但会控制更加灵活。 
no sysopt route dnat 
crypto ipsec transform-set aaades esp-des esp-md5-hmac 
！定义phase 2的加密和散列算法作为一个transform-set 
crypto dynamic-map dynomap 10 set transform-set aaades 
！把transform-set绑定到dynamic-map 
crypto map vpnpeer 20 ipsec-isakmp dynamic dynomap 
！把dynamic-map绑定到vpnpeer 
crypto map vpnpeer client authentication myserver 
!定义进行xauth使用的AAA服务器 
crypto map vpnpeer interface outside 
！把crypto map绑定到outside口 
isakmp enable outside 
！在outside口绑定isakmp 
isakmp client configuration address-pool local dialer outside 
！配置分配给VPN client的地址池 
isakmp policy 10 authentication pre-share 
!定义phase 1使用pre-shared key进行认证 
isakmp policy 10 encryption des 
！定义phase 1协商用DES加密算法 
isakmp policy 10 hash md5 
！定义phase 1协商用MD5散列算法 
isakmp policy 10 group 2 
!定义phase 1进行IKE协商使用DH group 2 
isakmp policy 10 lifetime 86400 
！定义IKE SA生存期 
vpngroup student0 address-pool dialer 
！定义VPN client拨入使用的vpngroup所分配的IP地址池 
vpngroup student0 idle-time 1800 
！定义vpngroup的空闲时间 
vpngroup student0 password 1234 
！定义vpngroup的pre-shared key 
telnet 10.1.1.88 255.255.255.255 inside 
telnet timeout 5 
ssh 10.1.1.88 255.255.255.255 inside 
ssh timeout 20 
terminal width 80 
Cryptochecksum:693b87faa42d062c2848346a3a0acb43 
pixfirewall# 

crypto map vpnpeer client authentication myserver