cisco easy vpn

Building configuration...

Current configuration : 2341 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname test
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication login USER-AUTH local
aaa authorization network GROUP-AUTH local
!
aaa session-id common
memory-size iomem 5
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
no ip dhcp use vrf connected
!
ip dhcp pool test
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 100.100.100.50
!
!
no ip domain lookup
ip domain name lab.local
!
!
!
!
username test password 0 test
!
!
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group RA-VPN-GROUP
key test
dns 10.10.10.1
wins 10.10.10.1
domain test
pool VPN-POOL
acl 110
crypto isakmp profile VPN-CLIENT
match identity group RA-VPN-GROUP
client authentication list USER-AUTH
isakmp authorization list GROUP-AUTH
client configuration address respond
!
!
crypto ipsec transform-set 3DES-MD5 esp-3des esp-md5-hmac
!
crypto dynamic-map DYMAP 10
set transform-set 3DES-MD5
set isakmp-profile VPN-CLIENT
reverse-route
!
crypto dynamic-map DYNMAP 10
set transform-set 3DES-MD5
set isakmp-profile VPN-CLIENT
reverse-route
!
!
crypto map DMAP 1 ipsec-isakmp dynamic DYNMAP
!
!
!
interface FastEthernet0/0
ip address 100.100.100.100 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map DMAP
!
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
ip local pool VPN-POOL 10.10.10.1 10.10.10.250
ip forward-protocol nd
!
ip http server
no ip http secure-server
ip nat inside source list 10 interface FastEthernet0/0 overload
!
access-list 10 permit 192.0.0.0 0.255.255.255
access-list 110 permit ip 10.10.10.0 0.0.0.255 any
access-list 150 permit esp any any
access-list 150 permit udp any any eq isakmp
access-list 150 permit udp any any eq non500-isakmp
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
!
!
end

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa authorization network easy_vpn_group_aaa local

ip local pool EASY_VPN_POOL 10.10.10.1 10.10.10.254

crypto ipsec transform-set TSET_TUNNEL_3DES_SHA esp-3des esp-sha-hmac
mode tunnel

crypto dynamic-map EASY_VPN_DYN_MAP 1
set transform-set TSET_TUNNEL_3DES_SHA
reverse-route

crypto map EASY_VPN_CMAP 65535 ipsec-isakmp dynamic EASY_VPN_DYN_MAP

interface FastEthernet1/0
ip address 100.100.100.100 255.255.255.0
crypto map EASY_VPN_CMAP

crypto isakmp policy 1
authentication pre-share
encr 3des
hash sha
group 2
lifetime 86400

crypto isakmp xauth timeout 15

crypto map EASY_VPN_CMAP isakmp authorization list easy_vpn_group_aaa
crypto map EASY_VPN_CMAP client authentication list default
crypto map EASY_VPN_CMAP client configuration address respond

crypto isakmp client configuration group easyvpn_group
key 0 easyvpn_group_key
! при необходимости split tunneling: "acl 100" и соответственно: "access-list 100 permit ip 1.1.1.0 0.0.0.255 any"
pool EASY_VPN_POOL
netmask 255.255.255.0

username easyvpn1 privilege 2 secret 0 easyvpn1
username easyvpn2 privilege 2 secret 0 easyvpn2

crypto ipsec client ezvpn EZVPN_CLIENT
{none (auto) | connect manual | connect acl (и тогда еще access-list 100 permit ip 192.168.1.0 0.0.0.255 any)}
group easyvpn_group key 0 easyvpn_group_key
peer 100.100.100.100
username easyvpn1 password 0 easyvpn1
xauth userid mode local { none (console) | xauth userid mode http-intercept }

interface FastEthernet0/1
crypto ipsec client ezvpn EZVPN_CLIENT inside

interface FastEthernet0/0
crypto ipsec client ezvpn EZVPN_CLIENT outside