VERTRIEB: 1-800-867-1380

Cisco ASR-Vorlagen

Letzte Aktualisierung: März 2014

Die folgenden Vorlagen sind für die Cisco ASR-Gerätefamilie konzipiert. Eine Liste aller verfügbaren Gerätevorlagen finden Sie unter Informationen zu VPN-Geräten für virtuelle Netzwerke. Weitere Informationen zum Konfigurieren einer Gerätevorlage für Ihre Umgebung finden Sie unter Informationen zur Konfiguration von VPN-Gerätevorlagen.

! Microsoft Corporation
! Windows Azure Virtual Network

! This configuration template applies to Cisco ASR 1000 Series Aggregation Services Routers running IOS XE 15.1.
! It configures an IPSec VPN tunnel connecting your on-premise VPN device with the Azure gateway.

! ---------------------------------------------------------------------------------------------------------------------
! ACL rules
! 
! Proper ACL rules are needed for permitting cross-premise network traffic.
! You should also allow inbound UDP/ESP traffic for the interface which will be used for the IPSec tunnel.
access-list <RP_AccessList> permit ip <SP_OnPremiseNetworkIpRange> <SP_OnPremiseNetworkWildcardBits> <SP_AzureNetworkIpRange> <SP_AzureNetworkWildcardBits>

! ---------------------------------------------------------------------------------------------------------------------
! Internet Key Exchange (IKE) configuration
! 
! This section specifies the authentication, encryption, hashing, Diffie-Hellman, and lifetime parameters for the Phase
! 1 negotiation and the main mode security association. We have picked an arbitrary policy # "10" as an example. If
! that happens to conflict with an existing policy, you may choose to use a different policy #.
crypto isakmp policy 10
 authentication pre-share
 encryption aes 256
 hash sha
 group 2
 lifetime 28800
 exit
crypto isakmp key <SP_PresharedKey> address <SP_AzureGatewayIpAddress>

! ---------------------------------------------------------------------------------------------------------------------
! IPSec configuration
! 
! This section specifies encryption, authentication, tunnel mode properties for the Phase 2 negotiation
crypto ipsec transform-set <RP_IPSecTransformSet> esp-aes 256 esp-sha-hmac
 mode tunnel
 exit

! ---------------------------------------------------------------------------------------------------------------------
! Crypto map configuration
!
! This section defines a crypto map that binds the cross-premise network traffic to the
! IPSec transform set and remote peer. We have picked an arbitrary ID # "10" as an example. If
! that happens to conflict with an existing crypto map, you may choose to use a different ID #.
crypto map <RP_IPSecCryptoMap> 10 ipsec-isakmp
 set peer <SP_AzureGatewayIpAddress>
 set security-association lifetime seconds 3600
 set security-association lifetime kilobytes 102400000
 set transform-set <RP_IPSecTransformSet>
 match address <RP_AccessList>
 exit
 
! ---------------------------------------------------------------------------------------------------------------------
! External interface configuration
!
! This section binds to the external interface of the router so that the cross-premise network traffic matching the
! traffic selector defined in the crypto map will be properly encrypted and transmitted via the IPSec VPN tunnel. It
! also adjusts the TCPMSS value properly to avoid fragmentation
interface <NameOfYourOutsideInterface>
 no crypto map
 crypto map <RP_IPSecCryptoMap>
 ip tcp adjust-mss 1350
 exit

[Diese Funktion ist derzeit nur als Vorschau verfügbar. Die Inhalte zu dieser Funktion sind vorläufig.]

! Microsoft Corporation
! Windows Azure Virtual Network

! This configuration template applies to Cisco ASR 1000 Series Aggregation Services Routers running IOS XE 15.2.
! It configures an IPSec VPN tunnel connecting your on-premise VPN device with the Azure gateway.

! ---------------------------------------------------------------------------------------------------------------------
! ACL rules
! 
! Proper ACL rules are needed for permitting cross-premise network traffic.
! You should also allow inbound UDP/ESP traffic for the interface which will be used for the IPSec tunnel.
access-list <RP_AccessList> permit ip <SP_OnPremiseNetworkIpRange> <SP_OnPremiseNetworkWildcardBits> <SP_AzureNetworkIpRange> <SP_AzureNetworkWildcardBits>

! ---------------------------------------------------------------------------------------------------------------------
! Internet Key Exchange (IKE) configuration
! 
! This section specifies the authentication, encryption, hashing, and Diffie-Hellman group parameters for the Phase
! 1 negotiation and the main mode security association. 
crypto ikev2 proposal <RP_IkeProposal>
  encryption aes-cbc-256 aes-cbc-128 3des
  integrity sha1
  group 2
  exit

crypto ikev2 policy <RP_IkePolicy>
  proposal <RP_IkeProposal>
  exit

crypto ikev2 keyring <RP_IkeKeyring>
  peer <SP_AzureGatewayIpAddress>
    address <SP_AzureGatewayIpAddress>
    pre-shared-key <SP_PresharedKey>
    exit
  exit

crypto ikev2 profile <RP_IkeProfile>
  match address local interface <NameOfYourOutsideInterface>
  match identity remote address <SP_AzureGatewayIpAddress> 255.255.255.255
  authentication remote pre-share
  authentication local pre-share
  keyring local <RP_IkeKeyring>
  exit

! ---------------------------------------------------------------------------------------------------------------------
! IPSec configuration
! 
! This section specifies encryption, authentication, tunnel mode properties for the Phase 2 negotiation
crypto ipsec transform-set <RP_IPSecTransformSet> esp-aes 256 esp-sha-hmac
 mode tunnel
 exit

! ---------------------------------------------------------------------------------------------------------------------
! Crypto map configuration
!
! This section defines a crypto profile that binds the cross-premise network traffic to the IPSec transform
! set and remote peer.  We also bind the IPSec policy to the virtual tunnel interface, through which 
! cross-premise traffic will be transmitted.  We have picked an arbitrary tunnel id "1" as an example. If
! that happens to conflict with an existing virtual tunnel interface, you may choose to use a different id.
crypto ipsec profile <RP_IPSecProfile>
  set transform-set <RP_IPSecTransformSet>
  set ikev2-profile <RP_IkeProfile>
  exit

int tunnel 1
  ip address 169.254.0.1 255.255.255.0
  ip tcp adjust-mss 1350
  tunnel source <NameOfYourOutsideInterface>
  tunnel mode ipsec ipv4
  tunnel destination <SP_AzureGatewayIpAddress>
  tunnel protection ipsec profile <RP_IPSecProfile>
  exit

ip route <SP_AzureNetworkCIDR> tunnel 1

Siehe auch

Fanden Sie dies hilfreich?
(1500 verbleibende Zeichen)
Vielen Dank für Ihr Feedback.
Anzeigen:
© 2014 Microsoft