3-24 C-Cisco.note

noteId: WEB5c3188a70611f1392166ac44016132df · 原始路径：/ALL/世赛题目（练习） - 笔记/第48届/02-省赛前集训/3-24 C-Cisco.note · 图片：7 · 附件待处理：1

·基础配置：

no ip domain lo

lin con 0

logg s

exec-t 0 0

login local

ip domain name wsc2024.fr

username admin privilege 15 algorithm-type scrypt secret Pa$$worD

enable algorithm-type scrypt secret Pa$$worD

clock timezone KST 9

banner login !Unauthorized Access is Strictly Prohibited!
 

do wr

·ssh：

crypto key gen rsa lab ssh.key mod 2048

ip ssh version 2

lin vty 0 15

login local

tra input ssh

exit

do wr

·ASA：

crypto key generate rsa label ssh.key modulus 2048
ssh 0.0.0.0 0.0.0.0 inside
aaa authentication ssh console LOCAL

·仅允许192.168.20.0/24访问：

access-list 20 permit 192.168.20.0 0.0.0.255
lin vty 0 15
 access-class 20 in

一、PPPOE（双向chap认证）：

1、PPPOE服务器（ISP）：

# 创建对端chap指定的用户用于与对端做chap认证（用户名最好和对端主机名一样）：
username BR2-RTR password Pa$$worD
 
# 创建pppoe地址池：
ip local pool PPPOE 12.13.14.1
 
# 配置 PPPOE：
bba-group pppoe global
 virtual-template 1
 exit
interface virtual-template 1
 ip unnumbered gigabitEthernet 0/1
 peer default ip address pool PPPOE
 ppp authentication chap
 ppp chap hostname ISP
 ppp chap password Pa$$worD
 exit
interface g0/1
 no sh
 ip add 12.13.14.254 255.255.255.0
 pppoe enable group global

2、PPPOE客户端（BR2-RTR）：

# 创建对端chap指定的用户用于与对端做chap认证：
username ISP password Pa$$worD
 
# 连接 pppoe：
interface dialer 1
 ip address negotiated
 encapsulation ppp
 dialer pool 1
 ppp authentication chap
 ppp chap hostname BR2-RTR
 ppp chap password Pa$$worD
 exit
interface g0/0
 no sh
 pppoe-client dial-pool-number 1

二、BGP：

1、HQ-MAIN 和 HQ-FW建立：

# HQ-MAIN：
router bgp 65001
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 password Pa$$worD


 network 1.1.1.1 mask 255.255.255.255

 
 
# HQ-FW：
router bgp 65001


 address-family ipv4 unicast

  neighbor 10.0.0.1 remote-as 65001
  neighbor 10.0.0.1 password Pa$$worD
  neighbor 10.0.0.1 activate    //这条是自动配置的



  neighbor 10.0.0.1 next-hop-self

2、HQ-MAIN 和 ISP 使用 Loop 建立：

HQ-MAIN 上要配置路由过滤，不接收来自ISP的任何路由

前提：

HQ-MAIN 和 HQ-FW建立

HQ-FW 和 ISP 建立

HQ-FW 上通告公网接口地址

HQ-FW 上对 HQ-MAIN 开启next-hop-self

HQ-MAIN 和 ISP 上通告 Loopback 1接口地址

HQ-FW 上需要允许md5流量通过，否则两边认证无法启动（ASA防火墙默认拒绝md5流量）

HQ-FW 不需要配置NAT

# HQ-FW上放行 md5流量：
access-list ALL permit ip any any
access-group ALL global
 
# 创建map匹配ACL，需要在policy-map中应用
class-map BGP

 match access-list ALL
 
# 在 policy-map 中应用：
policy-map global_policy
 class BGP
  set connection random-sequence-number disable

## 配置BGP
# HQ-FW:
router bgp 65001


 address-family ipv4 unicast    
  neighbor 193.215.24.254 remote-as 64512
  neighbor 193.215.24.254 password Pa$$worD

  neighbor 193.215.24.254 ebgp-multihop 255

  neighbor 193.215.24.254 activate

  network 193.215.24.0
 
# ISP:
router bgp 64512

 bgp log-neighbor-changes

 network 8.8.8.8 mask 255.255.255.255

 neighbor 193.215.24.1 remote-as 65001
 neighbor 193.215.24.1 password Pa$$worD

 neighbor 193.215.24.1 ebgp-multihop 255

三、证书颁发机构：

1、根CA：

crypto key gen rsa la CA mod 2048    //私钥名称要与 pki 名称一致
ip http server
crypto pki server CA
 grant auto
 hash sha256
 issuer cn=CA
 no shutdown

2、申请证书（router）：

HQ-MAIN 需要先在防火墙上配置SNAT，让它能够访问到ISP

crypto key gen rsa la CA mod 2048    //私钥名称要与 trustpoint 名称一致
 
# 证书字段IP写公网地址
crypto pki trustpoint CA
 subject-name cn=1.1.1.1
 fqdn none
 ip-address 1.1.1.1
 revocation-check none
 enrollment url http://8.8.8.8
 exit
 
crypto pki authentication CA
y
crypto pki enroll CA
n
y

3、申请证书（ASA）：

crypto ca gen rsa lab CA mod 2048
 
crypto ca trustpoint CA

 enrollment protocol scep url http://8.8.8.8

 fqdn none

 subject-name cn=193.215.24.1

 ip-address 193.215.24.1
 keypair CA    //不关联私钥无法申请证书
 
crypto ca authentication ca
crypto ca enroll ca
n
y

四、SSLVPN：

1、申请证书：

证书subjnet-name 字段需要写域名

crypto ca trustpoint CA

 enrollment protocol scep url http://8.8.8.8

 fqdn none

 subject-name cn=vpn.wsc2024.fr

 ip-address 193.215.24.1
 keypair CA    //不关联私钥无法申请证书
 
crypto ca authentication ca
crypto ca enroll ca
n
y

2、导出根CA证书给客户端信任：

crypto pki export CA pem terminal
# 导出保存在txt文件中，将后缀改为 .cer

3、配置 radius：

（1）radius服务器：

# HQ-SRV：
apt install -y freeradius

vim /etc/freeradius/3.0/clients.conf

vim /etc/freeradius/3.0/users

systemctl restart freeradius

（2）ASA 连接：

route inside 172.30.33.0 255.255.255.252 10.0.0.1
aaa-server radius protocol radius

aaa-server radius (inside) host 172.30.33.1

 key Pa$$worD 

 authentication-port 1812

 accounting-port 1813

4、配置 SSLVPN：

·（注意）需要关联ssl否则证书会报错不信任

webvpn
 enable outside
 anyconnect image disk0:/sslvpn.pkg 1

 anyconnect enable
 tunnel-group-list enable
 exit
 
group-policy SSLVPN internal

group-policy SSLVPN attributes

 vpn-tunnel-protocol ssl-client 

 split-tunnel-policy tunnelall

 split-tunnel-network-list value SSLVPN

 address-pools value SSLVPN
 exit
 
tunnel-group SSLVPN type remote-access

tunnel-group SSLVPN general-attributes

 default-group-policy SSLVP
 ssl trust-point CA
 authentication-server-group radius    //调用radius
 
tunnel-group SSLVPN webvpn-attributes
 group-alias anyconnect enable
## 如果不加 group-alias 会报错连接不上

五、EIGRP：

1、设置 k值：

在所有EIGRP上配置：
router eigrp 100
 metric weights 0 1 1 1 0 0

2、关闭水平分割：

# dmvpn 建立eigrp 需要关闭水平分割，否则路由不会传给邻居：
## HQ-MAIN、BR1、BR2：
int tunn 0
 no ip split-horizon eigrp 100
 no ip next-hop-self eigrp 100

六、OSPFv3：

# ISP：
router ospfv3 1
int ra g0/0,g0/3
 ipv6 enable
 ipv6 ospf 1 area 0
 ipv6 ospf network point-to-point
 exit
int g0/4
 ipv6 enable
 ipv6 ospf 1 area 1
 ipv6 ospf network point-to-point
 
# DC-FW、HQ-FW：
ipv6 router ospf 1
## 进入连接ISP的接口：
int g0/0
 ipv6 enable
 ipv6 ospf 1 area 0
 ipv6 ospf network point-to-point non-broadcast
 
# HQ-MAIN和HQ-FW建立邻居：
## HQ-FW：
int g0/1
 ipv6 enable
 ipv6 ospf 1 area 100
 ipv6 ospf network point-to-point non-broadcast
 
## HQ-MAIN：
router ospfv3 1
int g0/0
 ipv6 enable
 ipv6 ospf 1 area 100
 ipv6 ospf network point-to-point
int g0/5
 ipv6 enable
 ipv6 ospf 1 area 100
 ipv6 ospf network point-to-point

·DC-FW 配置路由汇总：

# DC-FW（将area 10的两个 /80路由汇总成 /64）：
ipv6 router ospf 1
 area 10 range 2001:4561:cd:111f::/64
 
int g0/1
 ipv6 enable
 ipv6 ospf 1 area 10
 ipv6 ospf network point-to-point non-broadcast
int g0/2
 ipv6 enable
 ipv6 ospf 1 area 10
 ipv6 ospf network point-to-point non-broadcast

七、SNMPv3：

1、网络设备上配置SNMPv3：

snmp-server group WSC v3 priv 
snmp-server user netmon WSC v3 auth sha Skill39! priv aes 256 Skill39!
# snmp-server user [输入用户名（不需要真实存在）] [输入前面定义的组名] v3 auth sha [输入用户密码] priv aes 256 [输入加密密码]
  

snmp-server location Lyon,France

snmp-server contact admin@wsc2024.fr

2、配置 cacti：

apt install -y cacti

这里用户写错了但是问题不大

八、S2S ipv6 over ipv4：

1、ASA 申请证书：

crypto ca gen rsa lab CA mod 2048
crypto ca trustpoint CA

 enrollment protocol scep url http://8.8.8.8

 fqdn none

 subject-name cn=193.215.24.1

 ip-address 193.215.24.1
 keypair CA    //不关联私钥无法申请证书
 
crypto ca authentication ca
crypto ca enroll ca
n
y

2、配置 ikev2加密：

crypto isakmp identity address
crypto ikev2 enable outside
 
# 配置一阶段加密：   

crypto ikev2 policy 1

 encryption aes-256

 integrity sha512

 group 14

 prf sha512

 
# 配置二阶段加密：
crypto ipsec ikev2 ipsec-proposal PRO

 protocol esp encryption aes

 protocol esp integrity sha-256
 
# 配置 tunnel-gruop：
## 指定对端地址:
tunnel-group 193.215.24.1 type ipsec-l2l

tunnel-group 193.215.24.1 ipsec-attributes

 peer-id-validate nocheck    //不验证对端名称

 ikev2 remote-authentication certificate

 ikev2 local-authentication certificate CA
  
# 配置 IPSec profile：      

crypto ipsec profile PRO

 set ikev2 ipsec-proposal PRO

 set trustpoint CA

3、配置 Tunnel：

# DC-FW：
interface Tunnel0

 nameif tunnel


 ipv6 address abcd:1234::1/64

 ipv6 enable

 tunnel source interface outside

 tunnel destination 193.215.24.1

 tunnel mode ipsec ipv6

 tunnel protection ipsec profile PRO
 
# HQ-FW：
interface Tunnel0

 nameif tunnel


 ipv6 address abcd:1234::2/64

 ipv6 enable

 tunnel source interface outside

 tunnel destination 11.12.13.1

 tunnel mode ipsec ipv6

 tunnel protection ipsec profile PRO

·测试：

、NAT64、NAT46：