[21전국] 3과제 AnyConnect VPN

CENT-SRV

※배포파일인 anyconnect.xml파일을 /var/www/html안에 acvpn.xml라는 파일로 복사

 

CENT-R

conf t

crypto key generate rsa general-keys label VPN-KEY mod 2048

crypto pki trustpoint VPN-TP

enrollment url http://203.230.10.1

usage ike

usage ssl-server

fqdn vpn.skills2021.kr

subject-name CN=vpn.skills2021.kr

rsakeypair VPN-KEY

revocation-check none

auto-enroll

eku request server-auth client-auth ipsec-end-system ipsec-tunnel ipsec-user

hash sha256

exit

crypto pki authenticate VPN-TP

[yes/no]: yes

crypto pki enroll VPN-TP

※암호: korea2021##

[yes/no]: yes

[no]: no

[yes/no]: yes
do copy tftp://2001:10:202:2::1/acvpn.xml flash:
※acvpn.xml으로 복사하어야 함

crypto vpn anyconnect profile ANYCONNECT flash:acvpn.xml

no crypto ikev2 http-url cert

no ip http server

no ip http secure-server

aaa new-model

ldap server LDAP

ipv4 172.16.0.1

base-dn ou=vpn,dc=skills2021,dc=kr

bind authenticate root-dn "cn=admin,dc=skills2021,dc=kr" password korea2021##

authentication bind-first
exit

aaa authentication login EAP group ldap local

aaa authorization network EAP local

ip local pool POOL 10.2.0.100 10.2.0.200

crypto ikev2 authorization policy AUTH

dns 172.16.0.1

pool POOL

netmask 255.255.255.0

exit

crypto ikev2 proposal VPN-PROPOSAL

encryption aes-cbc-256

integrity sha256

group 14

exit

crypto ikev2 policy VPN-POLICY

proposal VPN-PROPOSAL

exit

crypto ikev2 profile VPN-PROFILE

match identity remote key-id *$AnyConnectClient$*

pki trustpoint VPN-TP

authentication local rsa-sig

authentication remote anyconnect-eap aggregate

aaa authentication anyconnect-eap EAP[i]

aaa authorization group anyconnect-eap list EAP AUTH

aaa authorization user anyconnect-eap cached

anyconnect profile ANYCONNECT

virtual-template 10

dpd 60 2 on-demand

exit

crypto ipsec transform-set VPN-TS esp-aes 256 esp-sha-hmac

mode tunnel

exit

crypto ipsec profile IPSEC-PROFILE

set transform-set VPN-TS

set ikev2-profile VPN-PROFILE

exit

int lo 100

ip add 10.2.0.254 255.255.255.0

exit

interface virtual-template 10 type tunnel

ip unnumbered lo 100

tunnel source gig0/0/1

tunnel mode ipsec ipv4

tunnel protection ipsec profile IPSEC-PROFILE

 

EX-FW
access-list OUT-TO-IN extended permit ip 10.2.0.0 255.255.255.0 172.16.0.0 255.255.255.0
access-group OUT-TO-IN in interface OUTSIDE

 

REMOTE에 VPN 클라이언트 구성

REMOTE
※배포파일인 anyconnect.xml을 remote에 복사해 놓는다.

※배포파일인 .anyconnect-win-4.8.03052-core-vpn-webdeploy-k9.zip를 압축해제하고 anyconnect VPN 클라이언트 프로그램 설치

 

※anyconnect.xml를 acpvn.xml로 바꾸고 C:\programdata\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

파일 경로 안에 복사한다.(C:\programdata는 숨겨져있는 폴더임)

※Anyconnect 클라이언트 프로그램 재시작

 

EX-FW

conf t

policy-map global_policy

class inspection_default

inspect ipsec-pass-thru

 

CENT-FW

conf t

access-list OUT-TO-IN extended permit ip 10.2.0.0 255.255.255.0 172.16.0.0 255.255.255.0

access-group OUT-TO-IN in interface outside