VENDAS: 1-800-867-1389

Modelos de Cisco ASR

Atualizado: março de 2014

Os modelos abaixo são destinados para dispositivos da família do dispositivo Cisco ASR. Para obter uma lista de todos os modelos de dispositivo disponíveis, consulte Sobre dispositivos VPN da rede virtual. Para obter informações sobre como configurar um modelo de dispositivo para seu ambiente, consulte Sobre como configurar modelos de dispositivo VPN.

! Microsoft Corporation
! Windows Azure Virtual Network

! This configuration template applies to Cisco ASR 1000 Series Aggregation Services Routers running IOS XE 15.1.
! It configures an IPSec VPN tunnel connecting your on-premise VPN device with the Azure gateway.

! ---------------------------------------------------------------------------------------------------------------------
! ACL rules
! 
! Proper ACL rules are needed for permitting cross-premise network traffic.
! You should also allow inbound UDP/ESP traffic for the interface which will be used for the IPSec tunnel.
access-list <RP_AccessList> permit ip <SP_OnPremiseNetworkIpRange> <SP_OnPremiseNetworkWildcardBits> <SP_AzureNetworkIpRange> <SP_AzureNetworkWildcardBits>

! ---------------------------------------------------------------------------------------------------------------------
! Internet Key Exchange (IKE) configuration
! 
! This section specifies the authentication, encryption, hashing, Diffie-Hellman, and lifetime parameters for the Phase
! 1 negotiation and the main mode security association. We have picked an arbitrary policy # "10" as an example. If
! that happens to conflict with an existing policy, you may choose to use a different policy #.
crypto isakmp policy 10
 authentication pre-share
 encryption aes 256
 hash sha
 group 2
 lifetime 28800
 exit
crypto isakmp key <SP_PresharedKey> address <SP_AzureGatewayIpAddress>

! ---------------------------------------------------------------------------------------------------------------------
! IPSec configuration
! 
! This section specifies encryption, authentication, tunnel mode properties for the Phase 2 negotiation
crypto ipsec transform-set <RP_IPSecTransformSet> esp-aes 256 esp-sha-hmac
 mode tunnel
 exit

! ---------------------------------------------------------------------------------------------------------------------
! Crypto map configuration
!
! This section defines a crypto map that binds the cross-premise network traffic to the
! IPSec transform set and remote peer. We have picked an arbitrary ID # "10" as an example. If
! that happens to conflict with an existing crypto map, you may choose to use a different ID #.
crypto map <RP_IPSecCryptoMap> 10 ipsec-isakmp
 set peer <SP_AzureGatewayIpAddress>
 set security-association lifetime seconds 3600
 set security-association lifetime kilobytes 102400000
 set transform-set <RP_IPSecTransformSet>
 match address <RP_AccessList>
 exit
 
! ---------------------------------------------------------------------------------------------------------------------
! External interface configuration
!
! This section binds to the external interface of the router so that the cross-premise network traffic matching the
! traffic selector defined in the crypto map will be properly encrypted and transmitted via the IPSec VPN tunnel. It
! also adjusts the TCPMSS value properly to avoid fragmentation
interface <NameOfYourOutsideInterface>
 no crypto map
 crypto map <RP_IPSecCryptoMap>
 ip tcp adjust-mss 1350
 exit

[Este recurso está disponível somente como versão de visualização. O conteúdo relacionado a esse recurso é preliminar.]

! Microsoft Corporation
! Windows Azure Virtual Network

! This configuration template applies to Cisco ASR 1000 Series Aggregation Services Routers running IOS XE 15.2.
! It configures an IPSec VPN tunnel connecting your on-premise VPN device with the Azure gateway.

! ---------------------------------------------------------------------------------------------------------------------
! ACL rules
! 
! Proper ACL rules are needed for permitting cross-premise network traffic.
! You should also allow inbound UDP/ESP traffic for the interface which will be used for the IPSec tunnel.
access-list <RP_AccessList> permit ip <SP_OnPremiseNetworkIpRange> <SP_OnPremiseNetworkWildcardBits> <SP_AzureNetworkIpRange> <SP_AzureNetworkWildcardBits>

! ---------------------------------------------------------------------------------------------------------------------
! Internet Key Exchange (IKE) configuration
! 
! This section specifies the authentication, encryption, hashing, and Diffie-Hellman group parameters for the Phase
! 1 negotiation and the main mode security association. 
crypto ikev2 proposal <RP_IkeProposal>
  encryption aes-cbc-256 aes-cbc-128 3des
  integrity sha1
  group 2
  exit

crypto ikev2 policy <RP_IkePolicy>
  proposal <RP_IkeProposal>
  exit

crypto ikev2 keyring <RP_IkeKeyring>
  peer <SP_AzureGatewayIpAddress>
    address <SP_AzureGatewayIpAddress>
    pre-shared-key <SP_PresharedKey>
    exit
  exit

crypto ikev2 profile <RP_IkeProfile>
  match address local interface <NameOfYourOutsideInterface>
  match identity remote address <SP_AzureGatewayIpAddress> 255.255.255.255
  authentication remote pre-share
  authentication local pre-share
  keyring local <RP_IkeKeyring>
  exit

! ---------------------------------------------------------------------------------------------------------------------
! IPSec configuration
! 
! This section specifies encryption, authentication, tunnel mode properties for the Phase 2 negotiation
crypto ipsec transform-set <RP_IPSecTransformSet> esp-aes 256 esp-sha-hmac
 mode tunnel
 exit

! ---------------------------------------------------------------------------------------------------------------------
! Crypto map configuration
!
! This section defines a crypto profile that binds the cross-premise network traffic to the IPSec transform
! set and remote peer.  We also bind the IPSec policy to the virtual tunnel interface, through which 
! cross-premise traffic will be transmitted.  We have picked an arbitrary tunnel id "1" as an example. If
! that happens to conflict with an existing virtual tunnel interface, you may choose to use a different id.
crypto ipsec profile <RP_IPSecProfile>
  set transform-set <RP_IPSecTransformSet>
  set ikev2-profile <RP_IkeProfile>
  exit

int tunnel 1
  ip address 169.254.0.1 255.255.255.0
  ip tcp adjust-mss 1350
  tunnel source <NameOfYourOutsideInterface>
  tunnel mode ipsec ipv4
  tunnel destination <SP_AzureGatewayIpAddress>
  tunnel protection ipsec profile <RP_IPSecProfile>
  exit

ip route <SP_AzureNetworkCIDR> tunnel 1

Consulte também

Isso foi útil para você?
(1500 caracteres restantes)
Agradecemos os seus comentários
Mostrar:
© 2014 Microsoft