协商过程 第1阶段 AM模式，不预选协商DH Group强度，所以必须强制指定group2
1.5阶段 XAUTH：认证用户（用户名密码/AAA）
第2阶段 快速模式，三个包
配置 第1阶段 1 2 3 4 5 6 7 crypto isakmp policy 20 encr 3 des authentication pre-share group 2 crypto isakmp client configuration group GROUP key NBMAKEY
1.5阶段 1 2 3 4 5 6 7 8 9 10 11 12 aaa new-model aaa authentication login EZ-XAUTH local aaa authorization network EZ-MODE-CFG local username cisco password 0 cisco ip local pool POOL 11.11 .11.10 11.11 .11.110 crypto isakmp client configuration group EZ-GROUP pool POOL
启用aaa之后建议在设备上开启线下保障策略，确保任何时候都可以使用console口
1 2 3 4 5 6 aaa new aaa authentication login noacs line none line con 0 login authen noacs line aux 0 login authen noacs
第2阶段 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 crypto ipsec transform-set TRANS esp-3 des esp-sha-hmac mode tunnel crypto dynamic-map DYNAMIC-MAP 20 set transform-set TRANS crypto map EZVPN client authentication list EZ-XAUTH crypto map EZVPN isakmp authorization list EZ-MODE-CFG crypto map EZVPN client configuration address respond crypto map EZVPN 20 ipsec-isakmp dynamic DYNAMIC-MAP interface GigabitEthernet0/0 crypto map EZVPN
当一台设备同时配置EzVPN和L2L VPN时，由于启用了全局的xauth认证，所以正常的L2L将无法进行第二阶段协商。
1 crypto isakmp key XXXXX address 61.128 .1.1 no-xauth
二是使用isakmp profile。
isakmp profile ipsec profile的作用是对tunnel口的流量进行保护。而isakmp profile的作用主要是将一阶段的策略和第二阶段的策略进行绑定。常规配置的ipsec存在多个isakmp policy的时候，一二阶段协商过程是逐个查找从小到大进行匹配，并没有绑定对应的关系。
isakmp profile通过match identity来匹配远端设备，如EZVPN的group，L2L的peer address等。
修改上面的配置
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 no crypto map EZVPN client authentication list EZ-XAUTH no crypto map EZVPN isakmp authorization list EZ-MODE-CFG no crypto map EZVPN client configuration address respond crypto isakmp profile EZVPN-PROF match identity group EZ-GROUP client authentication list EZ-XAUTH isakmp authorization list EZ-MODE-CFG client configuration address respond crypto dynamic-map DYNAMIC-MAP 20 set isakmp-profile EZVPN-PROF
L2L IPSec VPN修改：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 crypto keyring L2L-keyring pre-shared-key address 61.128 .1.1 key NBMA-KEY crypto isakmp policy 10 encr 3 des authentication pre-share group 2 crypto isakmp profile L2L-PROFILE keyring L2L-keyring match identity address 61.128 .1.1 255.255 .255.255 crypto ipsec transform-set L2L-SET esp-des esp-md5-hmac mode tunnel crypto map DJ-MAP 10 ipsec-isakmp set peer 61.128 .1.1 set transform-set L2L-SET set isakmp-profile L2L-PROFILE match address BJZB-YZIDC
关于isakmp profile调用的位置：和转换集transform-set在一起调用
ezvpn特性 隧道分离 默认EZVPN是tunnel-everything，所有流量包括直连的局域网的流量全都走到远端。
1 2 3 4 5 6 ip access-list extended tunnel-split permit ip 10.0 .0.0 0.0 .255.255 any crypto isakmp client configuration group EZ-GROUP acl tunnel-split
save-password 默认不允许客户端保存password，可以通过策略启用
1 2 crypto isakmp client configuration group EZ-GROUP save-password
backup-gateway 备用网关，当EZVPN server不可用时，根据策略配置的backup-gateway发起连接请求
1 2 3 crypto isakmp client configuration group EZ-GROUP backup-gateway second.nbma.info backup-gateway 61.128 .1.1
banner 连接成功之后弹出banner
1 2 crypto isakmp client configuration group EZ-GROUP banner ^welcome to nbma!^
硬件客户端 使用思科路由器作为客户端,有3中连接模式client/network-extension/network-plus
1 2 3 4 5 6 7 8 9 10 11 12 13 crypto ispec client EZ-CLIENT connect [manual/auto] group EZ-GROUP key NBMAKEY mode [client/network-extension/network-plus] peer 61.128 .1.1 username cisco password cisco interface f1/0 crypto ipsec client ezvpn EZ-CLIENT outside interface f1/1 crypto ipsec client ezvpn EZ-CLIENT inside
手动连接：
1 2 3 4 5 crypto ipsec client ezvpn connect crypto ipsec client ezvpn xauth 输入用户名密码
模式 client模式 ：客户端身后网络被转换成客户端获取的IP地址，客户端能访问server身后网络，反过来不行network-extension模式 ：不获取地址，两边使用真实地址，可相互访问network-plus模式 ：获取一个IP，用户server身后网络来网管客户端设备，其他和extension模式一样
DVTI技术 之前的硬件客户端没有生成tunnel口，所以不支持动态路由、组播、QOS、acl、vrf等
server配置 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 crypto isakmp policy 20 encr 3 des authentication pre-share group 2 crypto isakmp client configuration group EZ-GROUP key NBMAKEY aaa new-model aaa authentication login EZ-XAUTH local aaa authorization network EZ-MODE-CFG local username cisco password 0 cisco ip access-list extended tunnel-split permit ip 10.0 .0.0 0.0 .255.255 any crypto isakmp client configuration group EZ-GROUP acl tunnel-split crypto isakmp porfile IKS-PROF match identity group EZ-GROUP client authentication list EZ-XAUTH isakmp authorization list EZ-MODE-CFG client configuration address respond virtual-template 100 crypto ipsec transform-set TRANS esp-3 des esp-sha-hmac mode tunnel crypto ipsec profile IPS-PROF set transform-set TRANS set isakmp-profile IKS-PROF interface Virtual-Template 100 type tunnel ip unnumbered f0/0 tunnel source f0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile IPS-PROF
客户端配置 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 interface Virtual-Template 56 type tunnel ip unnumbered f0/0 crypto ipsec client ezvpn DVTI-VPN connect auto group EZ-GROUP key NBMAKEY mode network-extension peer 61.128 .1.1 virtual-interface 56 interface f1/0 crypto ipsec client ezvpn DVTI-VPN outside interface f1/1 crypto ipsec client ezvpn DVTI-VPN inside
连接：
1 2 3 4 5 crypto ipsec client ezvpn connect crypto ipsec client ezvpn xauth 输入用户名密码
客户端生成一个隧道分离的静态路由，出接口是virtual access口.
跑动态路由的话，只能在接口下配置，不能用network宣告，因为虚模板没地址
1 2 3 4 5 6 7 interface Virtual-Template 100 type tunnel ip ospf 1 area 0 interface Virtual-Template 56 type tunnel ip ospf 1 area 0
原文作者:
Mansur
原文链接:
http://nbma.info/ezvpn-base/
许可协议: 除特别声明外，本站文章均采用CC BY-NC 4.0 许可协议，转载请注明出处。