ืืื ืืขื ืึทืจืืืงื ืืื ืืืึธืื ืืื ืฆื ืฆืืฉืืขืื ืฉืจืื-ืืืจื-ืฉืจืื ืื ืกืืจืึทืงืฉืึทื ื ืืืืฃ ืืื ืืืจ ืงืขื ืขื ืืขืฉืืืื ื ืฆืขืืืืงืืขื ืื ืืขืจืกื ืกืงืึทืืึทืืืข ืกืืขืืข ืืื ืืขื ืืึธืืขื ื ืืืืึทื ืึทืงืกืขืก ืืืคึผื ืฆืืืจืื ืืืืืจื AnyConnect ืืื Cisco ASA - VPN ืืึทืกืข ืืึทืืึทื ืกืื ื ืงื ืืื.
ืืงืืื: ืคืืืข ืงืึธืืคึผืึทื ืืขืก ืึทืจืื ืื ืืืขืื, ืจืขืื ืฆื ืืขืจ ืงืจืึทื ื ืกืืืืึทืฆืืข ืืื COVID-19, ืืึทืื ืืฉืชืืืืช ืฆื ืึทืจืืืขืจืคืืจื ืืืืขืจ ืขืืคึผืืืืื ืฆื ืืืืึทื ืึทืจืืขื. ืจืขืื ืฆื ืืขืจ ืืืืืืกืคึผืจืขื ืืืขืจืืึทื ื ืฆื ืืืืึทื ืึทืจืืขื, ืื ืืึทืกืข ืืืืฃ ืืืืืกืืื ื VPN ืืืืืืืืื ืคืื ืงืึธืืคึผืึทื ืืขืก ืื ืงืจืืกืื ืงืจืืืืงืึทืื ืืื ืึท ืืืืขืจ ืฉื ืขื ืคืืืืงืืื ืฆื ืืืึธื ืืื ืืื ืคืืจืืื ืื. ืืืืฃ ืื ืื ืืขืจืข ืืึทื ื, ืคืืืข ืงืึธืืคึผืึทื ืืขืก ืืขื ืขื ืืขืฆืืืื ืืขื ืฆื ืืืืกืืึทืื ืืขื ืืขืจ ืืึทืืจืืฃ ืคืื ืืืืึทื ืึทืจืืขื ืคึฟืื ืงืจืึทืฆื.
ืฆื ืืขืืคึฟื ืืขืฉืขืคืื ืืขืฉืืืื ื ืื ืกืืจืืืขื ื ืืึทืงืืืขื, ืืืืขืจ ืืื ืกืงืึทืืึทืืืข ืืืคึผื ืึทืงืกืขืก ืคึฟืึทืจ ืขืืคึผืืืืื, Cisco ืืื ืึทืจืืืฃ ืฆื 13-ืืืึธื ืืืืกืึทื ืกืื ืคึฟืึทืจ ืื ืฉืืจืื-ืจืืึทื AnyConnect SSL-VPN ืงืืืขื ื. .
.
ืืื ืืึธืื ืฆืืืขืืจืืื ืฉืจืื-ืืืจื-ืฉืจืื ืื ืกืืจืึทืงืฉืึทื ื ืคึฟืึทืจ ืึท ืคึผืฉืื ืึธืคึผืฆืืข ืคึฟืึทืจ ืืืคึผืืืืื ื ืึท ืืืคึผื ืืึธืื-ืืึทืืึทื ืกืื ื ืงื ืืื ืืื ืื ืืขืจืกื ืกืงืึทืืึทืืืข ืืืคึผื ืืขืื ืึธืืึธืืืข.
ืืขืจ ืืืืฉืคึผืื ืืื ืื ืืืขื ืืืื ืืึทื ืฅ ืคึผืฉืื ืืื ืื ืคืื ื ืคืื ืืืื ืื ื ืคืื ืื ืึธืืขื ืืึทืงืืืฉืึทื ืืื ืืขืจืืืืืขื ืืฉ ืึทืืืขืจืืืึทืื ืืขื ืืฆื, ืึธืืขืจ ืขืก ืืืขื ืืืื ืึท ืืื ืึธืคึผืฆืืข ืคึฟืึทืจ ืึท ืฉื ืขื ืึธื ืืืื (ืืืึธืก ืืื ืขืคึผืขืก ืืืึธืก ืคืืืข ืืขื ืืฉื ืคืขืื ืืืฆื) ืืื ืื ืืขืืืขืืงืืื ืคืื ืืืฃ ืึทืืึทืคึผืืืืฉืึทื ืฆื ืืืื ืืืืขืจืคืขื ืืฉื ืืขืฉืึทืก ืื ืืืคึผืืืืืึทื ื ืคึผืจืึธืฆืขืก.
ืงืืจืฅ ืืื ืคึฟืึธืจืืึทืฆืืข: VPN ืืึธืื ืืึทืืึทื ืกืื ื ืงืืึทืกืืขืจ ืืขืื ืึธืืึธืืืข ืืื ื ืืฉื ืึท ืคืืืืึธืืืขืจ ืึธืืขืจ ืึท ืงืืึทืกืืขืจืื ื ืคึฟืื ืงืฆืืข ืืื ืืืื ืืขืืืืจื ืืื ืขื; ืื ืืขืื ืึธืืึธืืืข ืงืขื ืขื ืคืึทืจืืื ืื ืืึธืจ ืคืึทืจืฉืืืขื ืข ASA ืืึธืืขืืก (ืืื ืืืืขืจ ืจืืกืืจืืงืฉืึทื ื) ืืื ืกืืจ ืฆื ืืึทืกืข ืืืึธื ืจืืืึธืื ืึทืงืกืขืก VPN ืงืึทื ืขืงืฉืึทื ื. ืขืก ืืื ืงืืื ืกืื ืืงืจืึทื ืึทืืืืฉืึทื ืคืื ืกืขืฉืึทื ื ืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืฆืืืืฉื ืื ื ืึธืืื ืคืื ืึทืืึท ืึท ืงื ืืื, ืึธืืขืจ ืขืก ืืื ืืขืืืขื ืฆื ืืืืืึธืืึทืืืฉ ืืึทืกืข ืืืคึผื ืงืึทื ืขืงืฉืึทื ื ืืื ืขื ืฉืืจ ืฉืืื ืืึธืืขืจืึทื ืฅ ืคืื VPN ืงืึทื ืขืงืฉืึทื ื ืืื ืืคึผืืืช ืืืื ืึทืงืืืื ื ืึธืืข ืืืืืื ืืื ืืขื ืงื ืืื. ืื ืืึทืกืข ืืื ืืขื ืงื ืืื ืืื ืืึทืืึทื ืกื ืืืืืึธืืึทืืืฉ ืืืคึผืขื ืืื ื ืืืืฃ ืื ืืืขืจืงืืึธืื ืคืื ืื ื ืึธืืื ืืืจื ืื ื ืืืขืจ ืคืื ืืืคึผื ืกืขืฉืึทื ื.
ืคึฟืึทืจ ืฉืืื ืืึธืืขืจืึทื ืฅ ืคืื ืกืคึผืขืฆืืคืืฉ ืงื ืืื ื ืึธืืื (ืืืื ืคืืจืืื ืื), ืืืจ ืงืขื ืขื ื ืืฆื ืึท ืคืืืขืจ, ืึทืืื ืื ืึทืงืืืื ืงืฉืจ ืืืขื ืืืื ืคึผืจืึทืกืขืกื ืืืจื ืื ืขืจืฉืืืง ื ืึธืืข ืคืื โโืื ืคืืืขืจ. ืืขืจ ืืขืงืขืึธืืืขืจ ืืื ื ืื ืึท ื ืืืืืง ืฆืืฉืืึทื ื ืคึฟืึทืจ ืื ืฉืืจืื ื ืฉืืื ืืึธืืขืจืึทื ืฅ ืืื ืื ืืึทืกืข-ืืึทืืึทื ืกืื ื ืงื ืืื; ืืื ืื ืืขืฉืขืขื ืืฉ ืคืื ืึท ื ืึธืืข ืืืจืืคืึทื, ืืขืจ ืงื ืืื ืืื ืืืขื ืึทืจืืืขืจืคืืจื ืื ืืึทื ืืฆืขืจ ืกืขืกืืข ืฆื ืื ืื ืืขืจ ืืขืื ื ืึธืืข, ืึธืืขืจ ืึธื ืืืื ืืืื ืื ื ืื ืงืฉืจ ืกืืึทืืืก, ืืืึธืก ืืื ืคึผืื ืงื ืืืึธืก ืื ืคืืืขืจ ืืื. ืืขืจืืืขืจ, ืื ืฆืืืื ืืขืงื ืึทืืึทืืืฉืื ืงืขื ืขื ืืืื ืงืึทืืืืื ื ืืืื ื ืืืืืง.
ื VPN ืืึทืกืข-ืืึทืืึทื ืกืื ื ืงื ืืื ืงืขื ืขื ืึทื ืืืึทืืื ืืขืจ ืืื ืฆืืืื ื ืึธืืื.
VPN ืืึธืื-ืืึทืืึทื ืกืื ื ืงื ืืื ืืื ืืขืฉืืืฆื ืืืืฃ ASA 5512-X ืืื ืืขืืขืจ.
ืืื ื ืืขืืขืจ ASA ืืื ืื VPN ืืึธืื-ืืึทืืึทื ืกืื ื ืงื ืืื ืืื ืึท ืคืจืืึท ืึทืคึผืึทืจืึทื ืืื ืืขืจืืื ืขื ืคืื ืกืขืืืื ืืก, ืืืจ ืืืจืืคืืจื ืึทืืข ืงืึทื ืคืืืืขืจืืืฉืึทื ืกืืขืคึผืก ืื ืืืืืืืืฉืืึทืื ืืืืฃ ืืขืืขืจ ืืืื ืืืื.
ืื ืืึทืืืฉืืงืึทื ืืึธืคึผืึธืืึธืื ืคืื ืืขื ืืืึทืฉืคึผืื ืืื:
ืขืจืฉื ืืืคึผืืืืืึทื ื:
-
ืืืจ ืฆืขืืืืงืืขื ืึทืกืึทืื ืื ืกืืึทื ืกืื ืคืื ืื ืืขืืคึผืืึทืืขืก ืืืึธืก ืืืจ ืืึทืจืคึฟื (ASAv5/10/30/50) ืคึฟืื ืื ืืืื.
-
ืืืจ ืืึทืฉืืืืขื INSIDE / OUTSIDE ืื ืืขืจืคืืืกืื ืฆื ืืขืจ ืืขืืืืงืขืจ ืืืืึทื (ืึทืจืืืก ืืื ืืืึทื ืืืืื ืืืืึทื, INSIDE ืืื ืืืื ืืืืื, ืึธืืขืจ ืคึผืจืึธืกื ืืื ืื ืงื ืืื, ืืขื ืืึทืคึผืึทืืึทืืืฉื), ืขืก ืืื ืืืืืืืง ืึทื ืื ืืขืจืคืืืกืื ืคืื ืืขืจ ืืขืืืืงืขืจ ืืืคึผ ืืขื ืขื ืืืื ืืื ืืขืจ ืืขืืืืงืขืจ ื 2 ืึธืคึผืฉื ืื.
-
ืืืกืขื ืกืขืก:
- ืืื ืืขืจ ืฆืืื ืคืื ืื ืกืืึทืืืจืื ื, ASAv ืืืขื ื ืืฉื ืืึธืื ืงืืื ืืืืกืึทื ืกืื ืืื ืืืขื ืืืื ืืืืืืขื ืฆื 100 ืงืืื / ืกืขืง.
- ืฆื ืื ืกืืึทืืืจื ืึท ืืขืจืืืืืขื ืืฉ, ืืืจ ืืึทืจืคึฟื ืฆื ืืืฉืขื ืขืจืืื ืึท ืกืืืขื ืืื ืืืื ืกืืึทืจื ืึทืงืึทืื ื ืืฉืืื: -> ืกืืึทืจื ืืืืืืืืืจื ืืืกืขื ืกืื ื
- ืืื ืื ืคึฟืขื ืฆืืขืจ ืืืึธืก ืึธืคึผืขื ืก, ืืื ืื ืงื ืขืคึผื ื ืื ืืึธืงืขื
- ืืึทืื ืืืืขืจ ืึทื ืื ืคืขืื ืืื ืื ืคึฟืขื ืฆืืขืจ ืืืึธืก ืึธืคึผืขื ืก ืืื ืึทืงืืืื ืืื ืื ืืฉืขืงืงืืึธืงืก ืืื ืึธืคึผืืขืฉืืขืื ืืึธืื ืึทืจืืืกืคืืจื-ืงืึทื ืืจืึธืืื ืคืึทื ืืงืฉืึทื ืึทืืืื... ืึธื ืืขื ืึทืงืืืื ืคืขืื, ืืืจ ืืืขื ื ืืฉื ืงืขื ืขื ืฆื ื ืืฆื ืฉืืึทืจืง ืขื ืงืจืืคึผืฉืึทื ืคืึทื ืืงืฉืึทื ื ืืื, ืึทืงืึธืจืืื ืืื, VPN. ืืืื ืืึธืก ืคืขืื ืืื ื ืืฉื ืึทืงืืืื, ืืืืข ืงืึธื ืืึทืงื ืืืื ืืฉืืื ืืึทื ืฉืึทืคึฟื ืฆื ืืขืื ืึทืงืืึทืืืืืฉืึทื.
- ื ืึธื ืืจืื ืืืขื ืืขื ืงื ืขืคึผื ืฉืึทืคึฟื ืืึธืงืขื, ืึท ืกืืืขื ืืืขื ืืืื ืืืฉืืคื ืืืึธืก ืืืจ ืืืขืื ื ืืฆื ืฆื ืงืจืืื ืึท ืืขืจืืืืืขื ืืฉ ืคึฟืึทืจ ASAv, ืงืึธืคึผืืข ืขืก:
- ืืึธืืืจ ืืืืขืจืืืจื ืกืืขืคึผืก C,D,E ืคึฟืึทืจ ืืขืืขืจ ืืืคึผืืืื ืึทืกืึทืื.
- ืฆื ืืึทืื ืขืก ืืจืื ืืขืจ ืฆื ื ืึธืืืึทืื ืื ืกืืืขื, ืืึธืื ืืื ืื ืืขืืคึผืขืจืขืจืึทืื ืืขืื ืืขืื ืขื. ืืึธืืืจ ืงืึทื ืคืืืืขืจ ืืขืืขืจ ASA (ืื ืืืืฉืคึผืื ืืื ืื ืืืึทืกืืจืืืฅ ืื ืกืขืืืื ืืก ืืืืฃ ASA-1). ืืขืื ืขื ืคึฟืื ืึทืจืืืก ืืื ื ืืฉื ืึทืจืืขืื, ืืืื ืืืจ ืืึทืงืข ืืึทืจืคึฟื ืขืก, ืืืืฉื ืื ืืืืขืจืืืื ืืืจืื ืฆื 100 ืฆื ืึทืจืืืก, ืืื ืืืืฉื ืขืก ืฆืืจืืง.
! ciscoasa(config)# int gi0/0 ciscoasa(config)# nameif outside ciscoasa(config)# ip address 192.168.31.30 255.255.255.0 ciscoasa(config)# no shut ! ciscoasa(config)# int gi0/1 ciscoasa(config)# nameif inside ciscoasa(config)# ip address 192.168.255.2 255.255.255.0 ciscoasa(config)# no shut ! ciscoasa(config)# telnet 0 0 inside ciscoasa(config)# username admin password cisco priv 15 ciscoasa(config)# ena password cisco ciscoasa(config)# aaa authentication telnet console LOCAL ! ciscoasa(config)# route outside 0 0 192.168.31.1 ! ciscoasa(config)# wr !- ืฆื ืคืึทืจืฉืจืืึทืื ืึท ืกืืืขื ืืื ืื ืกืืึทืจื ืึทืงืึทืื ื ืืืึธืืงื, ืืืจ ืืืื ืฆืืฉืืขืื ืืื ืืขืจื ืขื ืึทืงืกืขืก ืฆื ASA, .
ืืื ืงืืจืฅ, ASA ืืื ืืืจืฃ:
- ืืื ืืขืจื ืขื ืึทืงืกืขืก ืืืจื ืืืืคึผืก;
- ืฆืืื ืกืื ืืงืจืึทื ืึทืืืืฉืึทื (ืืขืจ ืจืืืืืง ืืืจื NTP);
- ืจืขืืืกืืจืืจื ืื ืก ืกืขืจืืืขืจ;
- ืืืจ ืืืื ืืืจื ืืขืื ืขื ืฆื ืืื ืืืขืจ ASA ืืื ืืึทืื ืกืขืืืื ืืก ืฆื ืึทืงืืึทืืืืื ืื ืืขืจืืืืืขื ืืฉ ืืืจื Smart-Account.
! ciscoasa(config)# clock set 19:21:00 Mar 18 2020 ciscoasa(config)# clock timezone MSK 3 ciscoasa(config)# ntp server 192.168.99.136 ! ciscoasa(config)# dns domain-lookup outside ciscoasa(config)# DNS server-group DefaultDNS ciscoasa(config-dns-server-group)# name-server 192.168.99.132 ! ! ะัะพะฒะตัะธะผ ัะฐะฑะพัั DNS: ! ciscoasa(config-dns-server-group)# ping ya.ru Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 87.250.250.242, timeout is 2 seconds: !!!!! ! ! ะัะพะฒะตัะธะผ ัะธะฝั ัะพะฝะธะทะฐัะธั NTP: ! ciscoasa(config)# show ntp associations address ref clock st when poll reach delay offset disp *~192.168.99.136 91.189.94.4 3 63 64 1 36.7 1.85 17.5 * master (synced), # master (unsynced), + selected, - candidate, ~ configured ! ! ะฃััะฐะฝะพะฒะธะผ ะบะพะฝัะธะณััะฐัะธั ะฝะฐัะตะน ASAv ะดะปั Smart-Licensing (ะฒ ัะพะพัะฒะตัััะฒะธะธ ั ะะฐัะธะผ ะฟัะพัะธะปะตะผ, ะฒ ะผะพะตะผ ัะปััะฐะต 100ะ ะดะปั ะฟัะธะผะตัะฐ) ! ciscoasa(config)# license smart ciscoasa(config-smart-lic)# feature tier standard ciscoasa(config-smart-lic)# throughput level 100M ! ! ะ ัะปััะฐะต ะฝะตะพะฑั ะพะดะธะผะพััะธ ะผะพะถะฝะพ ะฝะฐัััะพะธัั ะดะพัััะฟ ะฒ ะะฝัะตัะฝะตั ัะตัะตะท ะฟัะพะบัะธ ะธัะฟะพะปัะทัะนัะต ัะปะตะดัััะธะน ะฑะปะพะบ ะบะพะผะฐะฝะด: !call-home ! http-proxy ip_address port port ! ! ะะฐะปะตะต ะผั ะฒััะฐะฒะปัะตะผ ัะบะพะฟะธัะพะฒะฐะฝะฝัะน ะธะท ะฟะพััะฐะปะฐ Smart-Account ัะพะบะตะฝ (<token>) ะธ ัะตะณะธัััะธััะตะผ ะปะธัะตะฝะทะธั ! ciscoasa(config)# end ciscoasa# license smart register idtoken <token>- ืืืจ ืงืึธื ืืจืึธืืืจื ืึทื ืืขืจ ืืืื ืืื ืืฆืืื ืจืขืืืกืืจืืจื ืึท ืืขืจืืืืืขื ืืฉ ืืื ืขื ืงืจืืคึผืฉืึทื ืึธืคึผืฆืืขืก ืืขื ืขื ืื ืืืฆื:
-
ืงืึทื ืคืืืืขืจ ืืงืขืจืืืง SSL-VPN ืืืืฃ ืืขืืขืจ ืืืืืืืื
- ืืขืจื ืึธื, ืืืจ ืงืึทื ืคืืืืขืจ ืึทืงืกืขืก ืืืจื SSH ืืื ASDM:
ciscoasa(config)# ssh ver 2 ciscoasa(config)# aaa authentication ssh console LOCAL ciscoasa(config)# aaa authentication http console LOCAL ciscoasa(config)# hostname vpn-demo-1 vpn-demo-1(config)# domain-name ashes.cc vpn-demo-1(config)# cry key gen rsa general-keys modulus 4096 vpn-demo-1(config)# ssh 0 0 inside vpn-demo-1(config)# http 0 0 inside ! ! ะะพะดะฝะธะผะตะผ ัะตัะฒะตั HTTPS ะดะปั ASDM ะฝะฐ ะฟะพััั 445 ััะพะฑั ะฝะต ะฟะตัะตัะตะบะฐัััั ั SSL-VPN ะฟะพััะฐะปะพะผ ! vpn-demo-1(config)# http server enable 445 !- ืคึฟืึทืจ ASDM ืฆื ืึทืจืืขืื, ืืืจ ืืืื ืขืจืฉืืขืจ ืืจืืคืงืืคืืข ืขืก ืคึฟืื cisco.com, ืืื ืืืื ืคืึทื, ืืึธืก ืืื ืื ืคืืืืขื ืืข ืืขืงืข:
- ืคึฟืึทืจ ืื AnyConnect ืงืืืขื ื ืฆื ืึทืจืืขืื, ืืืจ ืืึทืจืคึฟื ืฆื ืึธืคึผืืึธืืืจื ืึท ืืืื ืฆื ืืขืืขืจ ASA ืคึฟืึทืจ ืืขืืขืจ ืงืืืขื ื ืืขืกืงืืึทืคึผ ืึทืก ืืขืืืืื ื (ืคึผืืึทื ื ืขื ืฆื ื ืืฆื ืืื ืืงืก / Windows / MAC), ืืืจ ืืึทืจืคึฟื ืึท ืืขืงืข ืืื ืืขืึทืืขื ื ืืืคึผืืืืืึทื ื ืคึผืึทืงืงืึทืืข ืืื ืืขื ืืืื:
- ืื ืืึทืื ืืึธืืืื ืืขืงืขืก ืงืขื ืขื ืืืื ืืคึผืืึธืึทืืขื, ืืืฉื, ืฆื ืึท ืคืืคึผ ืกืขืจืืืขืจ ืืื ืืคึผืืึธืึทืืขื ืฆื ืืขืืขืจ ืืืื ืึทืกืึท:
- ืืืจ ืงืึทื ืคืืืืขืจ ASDM ืืื ืืื-ืืขืืชืืขื ืืึทืืืืึทืื ืคึฟืึทืจ SSL-VPN (ืขืก ืืื ืจืขืงืึทืืขื ืืื ืฆื ื ืืฆื ืึท ืืจืึทืกืืื ืืึทืืืืึทืื ืืื ืคึผืจืึธืืืงืฆืืข). ืื ืืขืืจืื ืืขื FQDN ืคืื ืื ืงื ืืื ืืืืจืืืึทื ืึทืืจืขืก (vpn-demo.ashes.cc), ืืื ืืขืืขืจ FQDN ืคึฟืึทืจืืื ืื ืืื ืื ืคืื ืืจืืืกื ืืืง ืึทืืจืขืก ืคืื ืืขืืขืจ ืงื ืืื ื ืึธืืข ืืืื ืืืื ืจืืืึทืืืื ืืื ืื ืคืื ืืจืืืกื ืืืง ืื ืก ืืึธื ืข ืฆื ืื IP ืึทืืจืขืก ืคืื ืื OUTSIDE ืฆืืืื ื (ืึธืืขืจ ืฆื ืื ืืึทืคึผื ืึทืืจืขืก ืืืื ืืืคึผ / 443 ืคึผืึธืจื ืคืึธืจืืืขืจืืื ื ืืื ืืขื ืืฆื (DTLS) ืืื tcp/443 (TLS)). ืืืืืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืืืืขืจืคืขื ืืฉื ืคึฟืึทืจ ืื ืืึทืืืืึทืื ืืื ืกืคึผืขืกืืคืืขื ืืื ืื ืึธืคึผืืืืืื ื ืกืขืจืืืคืืงืึทื ืืืขืจืึทืคืึทืงืืืฉืึทื ืืึทืงืืืืขื ืืืืฉืึทื.
! vpn-demo-1(config)# crypto ca trustpoint SELF vpn-demo-1(config-ca-trustpoint)# enrollment self vpn-demo-1(config-ca-trustpoint)# fqdn vpn-demo.ashes.cc vpn-demo-1(config-ca-trustpoint)# subject-name cn=*.ashes.cc, ou=ashes-lab, o=ashes, c=ru vpn-demo-1(config-ca-trustpoint)# serial-number vpn-demo-1(config-ca-trustpoint)# crl configure vpn-demo-1(config-ca-crl)# cry ca enroll SELF % The fully-qualified domain name in the certificate will be: vpn-demo.ashes.cc Generate Self-Signed Certificate? [yes/no]: yes vpn-demo-1(config)# ! vpn-demo-1(config)# sh cry ca certificates Certificate Status: Available Certificate Serial Number: 4d43725e Certificate Usage: General Purpose Public Key Type: RSA (4096 bits) Signature Algorithm: SHA256 with RSA Encryption Issuer Name: serialNumber=9A439T02F95 hostname=vpn-demo.ashes.cc cn=*.ashes.cc ou=ashes-lab o=ashes c=ru Subject Name: serialNumber=9A439T02F95 hostname=vpn-demo.ashes.cc cn=*.ashes.cc ou=ashes-lab o=ashes c=ru Validity Date: start date: 00:16:17 MSK Mar 19 2020 end date: 00:16:17 MSK Mar 17 2030 Storage: config Associated Trustpoints: SELF CA Certificate Status: Available Certificate Serial Number: 0509 Certificate Usage: General Purpose Public Key Type: RSA (4096 bits) Signature Algorithm: SHA1 with RSA Encryption Issuer Name: cn=QuoVadis Root CA 2 o=QuoVadis Limited c=BM Subject Name: cn=QuoVadis Root CA 2 o=QuoVadis Limited c=BM Validity Date: start date: 21:27:00 MSK Nov 24 2006 end date: 21:23:33 MSK Nov 24 2031 Storage: config Associated Trustpoints: _SmartCallHome_ServerCA- ืฆื ืงืึธื ืืจืึธืืืจื ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโASDM, ืืึธื ื ืื ืคืึทืจืืขืกื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืื ืคึผืึธืจื, ืืืฉื:
- ืืึธืืืจ ืืืจืืคืืจื ืืงืขืจืืืง ืืื ืขื ืกืขืืืื ืืก:
- ืืืจ ืืืขืื ืืึทืื ืื ืคึฟืืจืืข ื ืขืฅ ืฆืืืจืืืืขื ืืืจื ืึท ืืื ืขื ืืื ืคืึทืจืืื ืื ืื ืืื ืืขืจื ืขื ืืืืึทื (ื ืืฉื ืื ืืขืจืกื ืืืืขืจ ืืืคึฟื ืืื ืืขืจ ืึทืืืขืง ืคืื ืืืืขืจืืืื ืืืืืขื ืืืืฃ ืื ืงืึทื ืขืงืืื ื ืืึทืืขืืึธืก, ืขืก ืืื ืืขืืืขื ืฆื ืืืจืื ืขืืขื ืืืจื ืึท ืื ืคืขืงืืึทื ืืึทืืขืืึธืก ืืื ืจืขืืืืืึทื ืคึฟืืจืืข ืืึทืื, ืึธืคึผืฆืืข. ืฉืคึผืึทืืื-ืืื ืขื-ืคึผืึธืืืืืง ืืื ืขืืึทืื ืืืขื ืืึธืื ืึทืืข ืืึทืืขืืึธืก ืคืึทืจืงืขืจ ืืื ืืขื ืืื ืขื. ืืื ืฉืคึผืึทืืื-ืืื ืขื ืืืื ืขืก ืืขืืืขื ืฆื ืืึทืคืจืืึทืขื ืื VPN ืืืืืืืื ืืื ื ืืฉื ืคึผืจืึทืกืขืกืื ื ืืึทืืขืืึธืก ืืื ืืขืจื ืขื ืคืึทืจืงืขืจ)
- ืืืจ ืืืขืื ืึทืจืืืกืืขืื ืืื ืืช ืืื ืืขื ืืื ืขื ืืื ืึทืืจืขืกืขืก ืคึฟืื ืื ืกืืื ืขื 192.168.20.0/24 (ืึท ืืขืงื ืคืื 10 ืฆื 30 ืึทืืจืขืกืขืก (ืคึฟืึทืจ ื ืึธืืข #1)). ืืขืืขืจ ื ืึธืืข ืืื ืืขื ืงื ืืื ืืืื ืืึธืื ืืืื ืืืืืขื ืข VPN ืืขืงื.
- ืืึธืืืจ ืืืจืืคืืจื ืืงืขืจืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืื ืึท ืืึธืืงืึทืื ืืืฉืืคื ืืึทื ืืฆืขืจ ืืืืฃ ืื ASA (ืืึธืก ืืื ื ืืฉื ืจืขืงืึทืืขื ืืื, ืืึธืก ืืื ืื ืกืืืคึผืืึทืกื ืืืคึฟื), ืขืก ืืื ืืขืกืขืจ ืฆื ืืึธื ืึธืืขื ืืึทืงืืืฉืึทื ืืืจื LDAP/RADIUS, ืึธืืขืจ ืืขืกืขืจ ื ืึธื, ืืื ื ืืืืื-ืคืึทืงืืึธืจ ืึธืืขื ืืึทืงืืืฉืึทื (MFA)ืคึฟืึทืจ ืืืึทืฉืคึผืื ืกืืกืงืึธ ืืืึธ.
! vpn-demo-1(config)# ip local pool vpn-pool 192.168.20.10-192.168.20.30 mask 255.255.255.0 ! vpn-demo-1(config)# access-list split-tunnel standard permit 192.168.0.0 255.255.0.0 ! vpn-demo-1(config)# group-policy SSL-VPN-GROUP-POLICY internal vpn-demo-1(config)# group-policy SSL-VPN-GROUP-POLICY attributes vpn-demo-1(config-group-policy)# vpn-tunnel-protocol ssl-client vpn-demo-1(config-group-policy)# split-tunnel-policy tunnelspecified vpn-demo-1(config-group-policy)# split-tunnel-network-list value split-tunnel vpn-demo-1(config-group-policy)# dns-server value 192.168.99.132 vpn-demo-1(config-group-policy)# default-domain value ashes.cc vpn-demo-1(config)# tunnel-group DefaultWEBVPNGroup general-attributes vpn-demo-1(config-tunnel-general)# default-group-policy SSL-VPN-GROUP-POLICY vpn-demo-1(config-tunnel-general)# address-pool vpn-pool ! vpn-demo-1(config)# username dkazakov password cisco vpn-demo-1(config)# username dkazakov attributes vpn-demo-1(config-username)# service-type remote-access ! vpn-demo-1(config)# ssl trust-point SELF vpn-demo-1(config)# webvpn vpn-demo-1(config-webvpn)# enable outside vpn-demo-1(config-webvpn)# anyconnect image disk0:/anyconnect-win-4.8.03036-webdeploy-k9.pkg vpn-demo-1(config-webvpn)# anyconnect enable !- (ืึทืคึผืฉืึทื ืึทื): ืืื ืื ืืืืื ืืืึทืฉืคึผืื, ืืืจ ืืขืืืืื ื ืึท ืืืืข ืืึทื ืืฆืขืจ ืืืืฃ ืื ืคืืืจืืืึทื ืฆื ืึธืืขื ืืึทืงืืื ืืืืึทื ื ืืฆืขืจืก, ืืืึธืก ืคืื ืงืืจืก ืืื ืคืื ืงืืืื ื ืืฆื ืึทืืืฅ ืืื ืืขืจ ืืึทืืึธืจืึทืืึธืจืืข. ืืื ืืืขื ืืขืื ืึท ืืืึทืฉืคึผืื ืคืื ืืื ืฆื ืืขืฉืืืื ื ืึทืืึทืคึผื ืื ืกืขืืึทืคึผ ืคึฟืึทืจ ืึธืืขื ืืึทืงืืืฉืึทื ืืืืฃ ืจืึทืืืืก ืกืขืจืืืขืจ, ืคึฟืึทืจ ืืืึทืฉืคึผืื Cisco Identity Services Engine:
vpn-demo-1(config-aaa-server-group)# dynamic-authorization vpn-demo-1(config-aaa-server-group)# interim-accounting-update vpn-demo-1(config-aaa-server-group)# aaa-server RADIUS (outside) host 192.168.99.134 vpn-demo-1(config-aaa-server-host)# key cisco vpn-demo-1(config-aaa-server-host)# exit vpn-demo-1(config)# tunnel-group DefaultWEBVPNGroup general-attributes vpn-demo-1(config-tunnel-general)# authentication-server-group RADIUS !ืื ืื ืึทืืจืืืฉืึทื ืืื ืขืก ืืขืืืขื ื ืืฉื ืืืืื ืฆื ืืขืฉืืืื ื ืืืกืฉืืืืขื ืื ืึธืืขื ืืึทืงืืืฉืึทื ืคึผืจืึธืฆืขืืืจ ืืื ืื AD Directory ืืื ืกื, ืึธืืขืจ ืืืื ืฆื ืืืกืืืืื ืฆื ืื ืงืึธื ื ืขืงืืขื ืงืึธืืคึผืืืืขืจ ืืขืืขืจื ืฆื AD, ืคึฟืึทืจืฉืืืื ืฆื ืขืก ืืื ืึท ืคึฟืืจืืข ืืืื ืึธืืขืจ ืึท ืคืขืจืืขื ืืขืืข ืืืื, ืืื ืึทืกืกืขืกืก ืื ืฉืืึทื ืคืื ืื ืงืึธื ื ืขืงืืขื. ืืืื.
- ืืึธืืืจ ืงืึทื ืคืืืืขืจ ืืจืึทื ืกืคึผืึทืจืขื ื NAT ืึทืืื ืึทื ืคืึทืจืงืขืจ ืฆืืืืฉื ืื ืงืืืขื ื ืืื ื ืขืฅ ืจืขืกืืจืกื ืคืื ืื ืคึฟืืจืืข ื ืขืฅ ืืื ื ืืฉื ืื ืืขืจืคืืจื ืืื:
vpn-demo-1(config-network-object)# subnet 192.168.20.0 255.255.255.0 ! vpn-demo-1(config)# nat (inside,outside) source static any any destination static vpn-users vpn-users no-proxy-arp- (ืึธืคึผืืืึธื ืึทื): ืฆื ืืืกืฉืืขืื ืืื ืืืขืจ ืงืืืืึทื ืฅ ืฆื ืื ืืื ืืขืจื ืขื ืืืจื ASA (ืืืขื ื ืืฆื tunnelall ืึธืคึผืฆืืขืก) ื ืืฆื PAT, ืืื ืืืื ืึทืจืืืกืืึทื ื ืืืจื ืืขืจ ืืขืืืืงืขืจ OUTSIDE ืฆืืืื ื ืคึฟืื ืืื ืืื ืืขื ืขื ืงืึธื ื ืขืงืืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืื ืื ืคืืืืขื ืืข ืกืขืืืื ืืก
vpn-demo-1(config-network-object)# nat (outside,outside) source dynamic vpn-users interface vpn-demo-1(config)# nat (inside,outside) source dynamic any interface vpn-demo-1(config)# same-security-traffic permit intra-interface !- ืขืก ืืื ืืึธืจ ืืืืืืืง ืืืขื ื ืืฆื ืึท ืงื ืืื ืฆื ืืขืื ืื ืื ืขืจืืขื ื ืขืฅ ืฆื ืคึฟืึทืจืฉืืืื ืืืึธืก ASA ืฆื ืืึทืจืฉืจืื ืฆืืจืืงืงืืืขื ืคืึทืจืงืขืจ ืฆื ืืกืขืจืก; ืคึฟืึทืจ ืืขื ืขืก ืืื ื ืืืืืง ืฆื ืจืืืืกืืจืืืืืืื ื ืื ืจืืฅ / 32 ืึทืืจืขืกืขืก ืืจืืืก ืฆื ืงืืืืึทื ืฅ.
ืืื ืืขืจ ืืึธืืขื ื, ืืืจ ืืึธืื ื ืืฉื ื ืึธื ืงืึทื ืคืืืืขืจื ืื ืงื ืืื, ืึธืืขืจ ืืืจ ืืึธืื ืฉืืื ืืจืืขืื VPN ืืืืืืืืื ืฆื ืืืึธืก ืืืจ ืงืขื ืขื ืื ืืืืืืืืฉืืึทืื ืคืึทืจืืื ืื ืืืจื FQDN ืึธืืขืจ IP.
ืืืจ ืืขื ืื ืงืึธื ื ืขืงืืขื ืงืืืขื ื ืืื ืื ืจืืืื ื ืืืฉ ืคืื ืืขืจ ืขืจืฉืืขืจ ASA:
ืึทืืื ืึทื ืืื ืืืขืจ ืืึทื ืฅ ืืืคึผื ืงื ืืื ืืื ืื ืืื ืฆืข ืคึฟืืจืืข ื ืขืฅ ืืืืกื ืื ืืึทืจืฉืจืื ืฆื ืืื ืืืขืจ ืงืืืขื ื, ืืืจ ืืืขืื ืจืืืืกืืจืืืืื ืืขื ืงืืืขื ื ืคึผืจืขืคืืงืก ืืื ืึท ืืื ืึทืืืฉ ืจืืืื ื ืคึผืจืึธืืึธืงืึธื, ืืืฉื OSPF:
! vpn-demo-1(config)# route-map RMAP-VPN-REDISTRIBUTE permit 1 vpn-demo-1(config-route-map)# match ip address VPN-REDISTRIBUTE ! vpn-demo-1(config)# router ospf 1 vpn-demo-1(config-router)# network 192.168.255.0 255.255.255.0 area 0 vpn-demo-1(config-router)# log-adj-changes vpn-demo-1(config-router)# redistribute static metric 5000 subnets route-map RMAP-VPN-REDISTRIBUTEืืืฆื ืืืจ ืืึธืื ืึท ืืึทืจืฉืจืื ืฆื ืืขื ืงืืืขื ื ืคึฟืื ืื ืจืืข ASA-2 ืืืืืืืื ืืื ืืืืขืจื ืงืึธื ื ืขืงืืขื ืฆื ืคืึทืจืฉืืืขื ืข VPN ืืืืืืืืื ืืื ืืขื ืงื ืืื ืงืขื ืขื, ืืืฉื, ืืืขืจืืขืื ืืืืึทื ืืืจื ืึท ืคึฟืืจืืข ืกืึธืคืืคืึธื ืข, ืคึผืื ืงื ืืื ืื ืฆืืจืืงืงืขืจ ืคืึทืจืงืขืจ ืคืื ืื ืจืขืกืืจืกื ืืขืืขืื ืืืจื ืืขืจ ืืึทื ืืฆืขืจ ืืืขื ืึธื ืงืืืขื. ืืื ืื ืืขืืขืื VPN ืืืืืืืื:
-
ืืึธืืืจ ืคืึธืจืืขืฆื ืฆื ืืึทืฉืืขืืืงื ืื ืืึทืกืข-ืืึทืืึทื ืกืื ื ืงื ืืื.
ืื ืึทืืจืขืก 192.168.31.40 ืืืขื ืืืขืจื ืืขื ืืฆื ืืื ืึท ืืืืจืืืึทื IP (ืืืืคึผ - ืึทืืข VPN ืงืืืืึทื ืฅ ืืืขืื ืืืืืขืก ืคืึทืจืืื ืื ืฆื ืขืก), ืคึฟืื ืืขื ืึทืืจืขืก, ืืขืจ ืงืืึทืกืืขืจ ืืืจ ืืืขื ืจืืืขืจืขืงื ืฆื ืึท ืืืืื ืืงืขืจ ืืึธืืืื ืงื ืืื ื ืึธืืข. ืื ืืืืกื ื ืืฉื ืคืึทืจืืขืกื ืฆื ืจืขืืืกืืจืืจื ืคืึธืจืืืก ืืื ืคืึทืจืงืขืจื ืื ืก ืจืขืงืึธืจืืก ืืืืืข ืคึฟืึทืจ ืืขืืขืจ ืคืื ืืจืืืกื ืืืง ืึทืืจืขืก / FQDN ืคืื ืืขืืขืจ ืงื ืืื ื ืึธืืข, ืืื ืคึฟืึทืจ ืืืืคึผ.
vpn-demo-1(config)# vpn load-balancing vpn-demo-1(config-load-balancing)# interface lbpublic outside vpn-demo-1(config-load-balancing)# interface lbprivate inside vpn-demo-1(config-load-balancing)# priority 10 vpn-demo-1(config-load-balancing)# cluster ip address 192.168.31.40 vpn-demo-1(config-load-balancing)# cluster port 4000 vpn-demo-1(config-load-balancing)# redirect-fqdn enable vpn-demo-1(config-load-balancing)# cluster key cisco vpn-demo-1(config-load-balancing)# cluster encryption vpn-demo-1(config-load-balancing)# cluster port 9023 vpn-demo-1(config-load-balancing)# participate vpn-demo-1(config-load-balancing)#- ืืืจ ืงืึธื ืืจืึธืืืจื ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืงื ืืื ืืื ืฆืืืื ืงืึธื ื ืขืงืืขื ืงืืืืึทื ืฅ:
- ืืึธืื ืืื ืื ืืึทืื ืื ืงืื ื ืืขืจืคืึทืจืื ื ืืขืจ ืืึทืงืืืขื ืืื ืึทื ืืืืืึธืืึทืืืฉ ืืึทืื ืืึธืืืื AnyConnect ืคึผืจืึธืคืื ืืืจื ASDM.
ืืืจ ื ืขืืขื ืืขื ืคึผืจืึธืคืื ืืืืฃ ืึท ืืึทืงืืืขื ืืืขื ืืื ืคืึทืจืืื ืื ืืื ืืืขืจ ืืจืืคึผืข ืคึผืึธืืืืืง ืืื ืืื:
ื ืึธื ืืขืจ ืืืืึทืืขืจ ืงืืืขื ื ืคึฟืึทืจืืื ืืื ื, ืืขื ืคึผืจืึธืคืื ืืืขื ืืืื ืืืืืึธืืึทืืืฉ ืืึทืื ืืึธืืืื ืืื ืืื ืกืืึทืืืจื ืืื ืื AnyConnect ืงืืืขื ื, ืึทืืื ืืืื ืืืจ ืืึทืจืคึฟื ืฆื ืคืึทืจืืื ืื, ืืืจ ื ืึธืจ ืืึทืจืคึฟื ืฆื ืกืขืืขืงืืืจื ืขืก ืคึฟืื ืืขืจ ืจืฉืืื:
ืืื ื ืื ื ืืฆื ืคืื ASDM ืืืจ ืืืฉืืคื ืืขื ืคึผืจืึธืคืื ืืืืฃ ืืืืื ืืืื ืึทืกืึท, ืืึธื ื ืื ืคืึทืจืืขืกื ืฆื ืืืืขืจืืืจื ืื ืกืืขืคึผืก ืืืืฃ ืื ืจืืขื ืึทืกืึทืก ืืื ืืขื ืงื ืืื.
ืืกืงื ื: ืืืื, ืืืจ ืืขืฉืืืื ื ืืืคึผืืืื ืึท ืงื ืืื ืคืื ืขืืืขืืข VPN ืืืืืืืืื ืืื ืึธืืึทืืึทืืืง ืืึทืกืข ืืึทืืึทื ืกืื ื. ืขืก ืืื ืืจืื ื ืฆื ืืืืื ื ืืึทืข ื ืึธืืื ืฆื ืืขื ืงื ืืื, ืึทืืฉืืืืื ื ืคึผืฉืื ืืึธืจืืืึธื ืืึทื ืกืงืืืืื ื ืืืจื ืืืคึผืืืืื ื ื ืืึท ืึทืกืึทืื ืืืืจืืืึทื ืืืฉืื ืขื ืึธืืขืจ ื ืืฆื ืืึทืื ืืืึทืจื ืึทืกืึทืก. ืืขืจ ืฉืืจืื-ืจืืึทื AnyConnect ืงืืืขื ื ืงืขื ืขื ืฉืืืจืง ืคืึทืจืืขืกืขืจื ืืืื ืืืืขืจ ืืืืึทื ืงืฉืจ ืงืืืคึผืึทืืืืึทืืื ืืื ืื ืืึทืืื ืืื (ืฉืืึทื ืึทืกืขืกืืึทื ืฅ), ืจืืึฟ ืืคืขืงืืืืืื ืืขื ืืฆื ืืื ืงืึทื ืืืฉืึทื ืืงืฉืึทื ืืื ืึท ืกืขื ืืจืึทืืืืื ืึทืงืกืขืก ืงืึธื ืืจืึธื ืืื ืึทืงืึทืื ืืื ื ืกืืกืืขื ืืืืขื ืืืืขื ืืึทืืื ืื ืืก ืืึธืืึธืจ.
ืืงืืจ: www.habr.com