最近有人在网上说CCSP和CCNP Security没啥变化，安全技术在不断的变化，需要对技术的专注于追求。当年PIX从6.x变到7.x的时候，变化是翻天覆地的，当时学6.x的学员基本需要重新学7.x。现在ASA 8.3之后，NAT，×××和透明墙这三个非常核心部分再次出现巨大变化。如果大家没有学习过到了现场绝对抓虾。而且现在Cisco都已经抛弃了CCSP，进入了CCNP Security时代，希望那些说话不腰疼的人，本着以学员负责的态度，认认真真的研究一下技术，给学员提供最新最全的技术服务才是培训中心应该干的。天天就讨论谁第一个过有什么意义，第一，你还不配和我说安全版本的问题，第二，老师的第一任务是让学员学到更多的东西，而不是学员一来就尽快的让他考过，至少让那些希望学习的学员能够真正学到东西。别天天就想在网上如何制造谣言来重伤对方。

再回应一句话，“团队是需要英雄，但是英雄离开团队只有两条路，1.变狗熊2.覆灭”我感觉我在Yeslab活得挺好，招收的学员比以前多一倍，场地比以前大一倍，每年出的视频比以前多一倍。再也不受限制，如鱼得水，但是那个“团队”还想内部运转不灵吧，回你一句话“没有英雄的团队，只有两条路，1.树倒猢狲散，2.内讧”，好像你们两种现象都出现了，这个结果可能比英雄出去重新立山惨多了吧！再说了有了英雄自然有团队，现在我们北京安全就有两个老师负责，大大提高了管理力度和服务能力！你们每一个分部就一个老师，谁是光杆司令谁知道。

===============================RootCA配置==============================

hostname RootCA
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
clock timezone GMT 8
!
!
ip cef
ip domain name yeslab.net
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
crypto pki server RootCA
issuer-name cn=RootCA.yeslab.net, ou=YeslabSec, o=Yeslab, l=qygy701, c=cn
grant auto
!
crypto pki trustpoint RootCA
revocation-check crl
rsakeypair RootCA
!
!
crypto pki certificate chain RootCA
certificate ca 01
30820299 30820202 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
60310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311A30 18060355 04031311 526F6F74 43412E79 65736C61 622E6E65
74301E17 0D313130 37313430 38323233 345A170D 31343037 31333038 32323334
5A306031 0B300906 03550406 1302636E 3110300E 06035504 07130771 79677937
3031310F 300D0603 55040A13 06596573 6C616231 12301006 0355040B 13095965
736C6162 53656331 1A301806 03550403 1311526F 6F744341 2E796573 6C61622E
6E657430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
DEC89D24 B861E619 45817408 246EFBD8 8F7431CC 06C2FCC2 FD3AB9BB 1AA87DA3
11572635 2DF5E40F 2B6C84C6 826C845F FE940ECC A9882212 015ECA4F 70F8B08A
69B4F4C6 23581C25 EB164F8B 574FADC3 F8D0577D DACB0E8A 93131299 9C880D48
DFEA8169 E71EDEDE FA549A33 DBB03488 D847CE7F 3F340EE5 CF9EA55F 1D2A0F4D
02030100 01A36330 61300F06 03551D13 0101FF04 05300301 01FF300E 0603551D
0F0101FF 04040302 0186301F 0603551D 23041830 168014D7 357888DB D7CEF6A2
D8DE5240 EE6AB590 74C7C430 1D060355 1D0E0416 0414D735 7888DBD7 CEF6A2D8
DE5240EE 6AB59074 C7C4300D 06092A86 4886F70D 01010405 00038181 00DD866F
55856974 32EF8994 147F93DA B2AF14F4 7894ABB8 D768AC31 1449FF5D B7DCCCC9
0401DC30 F1B8BD84 EA98BCA3 898D96C5 25686629 A72E07B0 9DBC5F7F 8A16C1E2
884D1E04 3A5BAAC1 F84B6887 49E5DA3F DD4F800F 624B03CD 6F6C839F 3A1967AA
97C258EB 8F6218B7 5A17CB18 AFE94913 B627288B 90182932 FF0845EF 92
quit
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.200 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet3/0
no ip address
shutdown
duplex auto
speed auto
!
ip http server
no ip http secure-server
ip forward-protocol nd
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
ntp master
!
end
===============================SUB-CA-1配置==============================
hostname SUB-CA-1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
clock timezone GMT 8
!
!
ip cef
ip domain name yeslab.net
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
crypto pki server SUB-CA-1
issuer-name cn=SUB-CA-1.yeslab.net, ou=YeslabSec, o=Yeslab, l=qygy701, c=cn
grant auto
mode sub-cs
!
crypto pki trustpoint SUB-CA-1
enrollment url http://10.1.1.200:80
revocation-check crl
rsakeypair SUB-CA-1
!
!
crypto pki certificate chain SUB-CA-1
certificate 03
30820298 30820201 A0030201 02020103 300D0609 2A864886 F70D0101 04050030
60310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311A30 18060355 04031311 526F6F74 43412E79 65736C61 622E6E65
74301E17 0D313130 37313430 38323430 385A170D 31323037 31333038 32343038
5A306231 0B300906 03550406 1302636E 3110300E 06035504 07130771 79677937
3031310F 300D0603 55040A13 06596573 6C616231 12301006 0355040B 13095965
736C6162 53656331 1C301A06 03550403 13135355 422D4341 2D312E79 65736C61
622E6E65 7430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100D9C6 55200BBB D4E3D339 626C7D9C FCEC05C4 FE8EFE36 9C8EEE75 4D874C8C
850F22CF 32B27DDC 9160C923 753CCE81 58136B18 8C828944 4C1A7C52 4A2CDB43
E0CC2F3B 3E1D675C D2E9083C 72AF4636 C478BFF7 5F01322F A7D728C6 92438E11
BFF833FB 286AE56E 2BE8C52B B9F996E2 F9FC937A CA493ABE 17C4D688 6760925F
B3070203 010001A3 60305E30 0F060355 1D130101 FF040530 030101FF 300B0603
551D0F04 04030207 80301F06 03551D23 04183016 8014D735 7888DBD7 CEF6A2D8
DE5240EE 6AB59074 C7C4301D 0603551D 0E041604 141B0D25 BA6F781A AD23C3A4
5744E537 6260F493 52300D06 092A8648 86F70D01 01040500 03818100 A7D29161
2CA39C0A 99C71101 7EA27F66 95C225F7 D1DB24BC 47DD20A4 228C61DA 304914D4
38E86C14 240C7CDB 1F900336 48634A16 595A4B18 59BAF40F 4B398816 2EA9C067
B11B0CE7 213635A0 912E39DC 792A180B 57904202 24000827 FA981BB7 9AB3BA40
02C17441 CB2EB938 790BEC3F 1C8840E8 93097949 6D71E964 FD87BE86
quit
certificate ca 01
30820299 30820202 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
60310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311A30 18060355 04031311 526F6F74 43412E79 65736C61 622E6E65
74301E17 0D313130 37313430 38323233 345A170D 31343037 31333038 32323334
5A306031 0B300906 03550406 1302636E 3110300E 06035504 07130771 79677937
3031310F 300D0603 55040A13 06596573 6C616231 12301006 0355040B 13095965
736C6162 53656331 1A301806 03550403 1311526F 6F744341 2E796573 6C61622E
6E657430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
DEC89D24 B861E619 45817408 246EFBD8 8F7431CC 06C2FCC2 FD3AB9BB 1AA87DA3
11572635 2DF5E40F 2B6C84C6 826C845F FE940ECC A9882212 015ECA4F 70F8B08A
69B4F4C6 23581C25 EB164F8B 574FADC3 F8D0577D DACB0E8A 93131299 9C880D48
DFEA8169 E71EDEDE FA549A33 DBB03488 D847CE7F 3F340EE5 CF9EA55F 1D2A0F4D
02030100 01A36330 61300F06 03551D13 0101FF04 05300301 01FF300E 0603551D
0F0101FF 04040302 0186301F 0603551D 23041830 168014D7 357888DB D7CEF6A2
D8DE5240 EE6AB590 74C7C430 1D060355 1D0E0416 0414D735 7888DBD7 CEF6A2D8
DE5240EE 6AB59074 C7C4300D 06092A86 4886F70D 01010405 00038181 00DD866F
55856974 32EF8994 147F93DA B2AF14F4 7894ABB8 D768AC31 1449FF5D B7DCCCC9
0401DC30 F1B8BD84 EA98BCA3 898D96C5 25686629 A72E07B0 9DBC5F7F 8A16C1E2
884D1E04 3A5BAAC1 F84B6887 49E5DA3F DD4F800F 624B03CD 6F6C839F 3A1967AA
97C258EB 8F6218B7 5A17CB18 AFE94913 B627288B 90182932 FF0845EF 92
quit
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.201 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet3/0
no ip address
shutdown
duplex auto
speed auto
!
ip http server
no ip http secure-server
ip forward-protocol nd
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
ntp clock-period 17179922
ntp server 10.1.1.200
!
end
===============================SUB-CA-2配置==============================
hostname SUB-CA-2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
clock timezone GMT 8
!
!
ip cef
ip domain name yeslab.net
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
crypto pki server SUB-CA-2
issuer-name cn=SUB-CA-2.yeslab.net, ou=YeslabVoice, o=Yeslab, l=cytd1005, c=cn
grant auto
mode sub-cs
!
crypto pki trustpoint SUB-CA-2
enrollment url http://10.1.1.200:80
revocation-check crl
rsakeypair SUB-CA-2
!
!
crypto pki certificate chain SUB-CA-2
certificate 02
3082029B 30820204 A0030201 02020102 300D0609 2A864886 F70D0101 04050030
60310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311A30 18060355 04031311 526F6F74 43412E79 65736C61 622E6E65
74301E17 0D313130 37313430 38323430 385A170D 31323037 31333038 32343038
5A306531 0B300906 03550406 1302636E 3111300F 06035504 07130863 79746431
30303531 0F300D06 0355040A 13065965 736C6162 31143012 06035504 0B130B59
65736C61 62566F69 6365311C 301A0603 55040313 13535542 2D43412D 322E7965
736C6162 2E6E6574 30819F30 0D06092A 864886F7 0D010101 05000381 8D003081
89028181 00CD650B A6F48154 BA27CA7E A32603D5 000474AA CC58E5A1 E23EDDDA
8D8468E8 8116A471 00DB9FD0 D020BE76 C890904D FD322B1D CAD9F788 B9E858B0
C033FFFC 40BF99FC C208C0B9 636D447A F09B9DFC 70DC96DC 185E468B 6EFF8EFA
330C8E8B CEA14708 07D4AF9B EA41CEFD 517C749F 637C3524 96B51DAA 9C8619EB
0ADE60BB 11020301 0001A360 305E300F 0603551D 130101FF 04053003 0101FF30
0B060355 1D0F0404 03020780 301F0603 551D2304 18301680 14D73578 88DBD7CE
F6A2D8DE 5240EE6A B59074C7 C4301D06 03551D0E 04160414 2D3ADEE9 054A842A
1546E4B6 C5543848 D031ADBC 300D0609 2A864886 F70D0101 04050003 818100C7
5E3E288A FB05AB8B 89F1343A C83732BF 946F8D44 2FA6B755 15171BBA AE6CDB75
12737140 E524C8BF 0480907B 19F0720B FD6B69FA 41B17BE8 177F13E2 6D37165C
AF4641D4 215CE4DF CF2F00EF 1281E25E 4C05331B AF026D3D 51283073 AA6DC5C8
209406EF 7FDD06DD 4AEB9D06 90B9ECD1 48BD7BF0 37A0241E 77EA857B 8F0B31
quit
certificate ca 01
30820299 30820202 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
60310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311A30 18060355 04031311 526F6F74 43412E79 65736C61 622E6E65
74301E17 0D313130 37313430 38323233 345A170D 31343037 31333038 32323334
5A306031 0B300906 03550406 1302636E 3110300E 06035504 07130771 79677937
3031310F 300D0603 55040A13 06596573 6C616231 12301006 0355040B 13095965
736C6162 53656331 1A301806 03550403 1311526F 6F744341 2E796573 6C61622E
6E657430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
DEC89D24 B861E619 45817408 246EFBD8 8F7431CC 06C2FCC2 FD3AB9BB 1AA87DA3
11572635 2DF5E40F 2B6C84C6 826C845F FE940ECC A9882212 015ECA4F 70F8B08A
69B4F4C6 23581C25 EB164F8B 574FADC3 F8D0577D DACB0E8A 93131299 9C880D48
DFEA8169 E71EDEDE FA549A33 DBB03488 D847CE7F 3F340EE5 CF9EA55F 1D2A0F4D
02030100 01A36330 61300F06 03551D13 0101FF04 05300301 01FF300E 0603551D
0F0101FF 04040302 0186301F 0603551D 23041830 168014D7 357888DB D7CEF6A2
D8DE5240 EE6AB590 74C7C430 1D060355 1D0E0416 0414D735 7888DBD7 CEF6A2D8
DE5240EE 6AB59074 C7C4300D 06092A86 4886F70D 01010405 00038181 00DD866F
55856974 32EF8994 147F93DA B2AF14F4 7894ABB8 D768AC31 1449FF5D B7DCCCC9
0401DC30 F1B8BD84 EA98BCA3 898D96C5 25686629 A72E07B0 9DBC5F7F 8A16C1E2
884D1E04 3A5BAAC1 F84B6887 49E5DA3F DD4F800F 624B03CD 6F6C839F 3A1967AA
97C258EB 8F6218B7 5A17CB18 AFE94913 B627288B 90182932 FF0845EF 92
quit
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.202 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet3/0
no ip address
shutdown
duplex auto
speed auto
!
ip http server
no ip http secure-server
ip forward-protocol nd
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
ntp clock-period 17179912
ntp server 10.1.1.200
!
end
=============================ASA 8.0(2)虚拟机实现============================
ASA Version 8.0(2)
!
hostname ASA
domain-name yeslab.net
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.1.1.100 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 20.1.1.100 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/5
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone GMT 8
dns server-group DefaultDNS
domain-name yeslab.net
pager lines 24
mtu outside 1500
mtu inside 1500
ip local pool ippool 123.1.1.100-123.1.1.200
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
route outside 0.0.0.0 0.0.0.0 10.1.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set yeslab-trans esp-3des esp-sha-hmac
crypto dynamic-map yeslab-dymap 10 set transform-set yeslab-trans
crypto map yeslab-cry-map 10 ipsec-isakmp dynamic yeslab-dymap
crypto map yeslab-cry-map interface outside
crypto ca trustpoint RootCA
enrollment url http://10.1.1.200:80
crl configure
crypto ca trustpoint SUB-CA-1
enrollment url http://10.1.1.201:80
fqdn ASA.yeslab.net
subject-name cn=ASA.yeslab.net, ou=YeslabSec, o=Yeslab, l=qygy701, c=cn
crl configure
crypto ca certificate map yeslab-ca-map 10
issuer-name co sub-ca-2.yeslab.net
crypto ca certificate chain RootCA
certificate ca 01
30820299 30820202 a0030201 02020101 300d0609 2a864886 f70d0101 04050030
60310b30 09060355 04061302 636e3110 300e0603 55040713 07717967 79373031
310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309 5965736c
61625365 63311a30 18060355 04031311 526f6f74 43412e79 65736c61 622e6e65
74301e17 0d313130 37313430 38323233 345a170d 31343037 31333038 32323334
5a306031 0b300906 03550406 1302636e 3110300e 06035504 07130771 79677937
3031310f 300d0603 55040a13 06596573 6c616231 12301006 0355040b 13095965
736c6162 53656331 1a301806 03550403 1311526f 6f744341 2e796573 6c61622e
6e657430 819f300d 06092a86 4886f70d 01010105 0003818d 00308189 02818100
dec89d24 b861e619 45817408 246efbd8 8f7431cc 06c2fcc2 fd3ab9bb 1aa87da3
11572635 2df5e40f 2b6c84c6 826c845f fe940ecc a9882212 015eca4f 70f8b08a
69b4f4c6 23581c25 eb164f8b 574fadc3 f8d0577d dacb0e8a 93131299 9c880d48
dfea8169 e71edede fa549a33 dbb03488 d847ce7f 3f340ee5 cf9ea55f 1d2a0f4d
02030100 01a36330 61300f06 03551d13 0101ff04 05300301 01ff300e 0603551d
0f0101ff 04040302 0186301f 0603551d 23041830 168014d7 357888db d7cef6a2
d8de5240 ee6ab590 74c7c430 1d060355 1d0e0416 0414d735 7888dbd7 cef6a2d8
de5240ee 6ab59074 c7c4300d 06092a86 4886f70d 01010405 00038181 00dd866f
55856974 32ef8994 147f93da b2af14f4 7894abb8 d768ac31 1449ff5d b7dcccc9
0401dc30 f1b8bd84 ea98bca3 898d96c5 25686629 a72e07b0 9dbc5f7f 8a16c1e2
884d1e04 3a5baac1 f84b6887 49e5da3f dd4f800f 624b03cd 6f6c839f 3a1967aa
97c258eb 8f6218b7 5a17cb18 afe94913 b627288b 90182932 ff0845ef 92
quit
crypto ca certificate chain SUB-CA-1
certificate 04
308202be 30820227 a0030201 02020104 300d0609 2a864886 f70d0101 04050030
62310b30 09060355 04061302 636e3110 300e0603 55040713 07717967 79373031
310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309 5965736c
61625365 63311c30 1a060355 04031313 5355422d 43412d31 2e796573 6c61622e
6e657430 1e170d31 31303731 34303931 3630305a 170d3132 30373133 30383234
30385a30 7c310b30 09060355 04061302 636e3110 300e0603 55040713 07717967
79373031 310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309
5965736c 61625365 63311730 15060355 0403130e 4153412e 7965736c 61622e6e
6574311d 301b0609 2a864886 f70d0109 02160e41 53412e79 65736c61 622e6e65
7430819f 300d0609 2a864886 f70d0101 01050003 818d0030 81890281 8100a8cc
759207f6 32aa3a7f da32e8a5 2b8eb72f 5cd43048 25971c99 87239b9b e9c35cc9
0f049332 4e4e8aec 59bc5338 5a21072c 88b822b0 909cdff3 6a70ecb0 96c2936b
af78ad24 2af7a807 4e779733 c56e2c4a 4a50aa9c f20b09a2 353cf89a 1fda87dc
ef483a6f 12475ff2 482961b5 4df145e6 249cae29 c4a35900 1bb6ca4e 2f770203
010001a3 6a306830 19060355 1d110412 3010820e 4153412e 7965736c 61622e6e
6574300b 0603551d 0f040403 0205a030 1f060355 1d230418 30168014 1b0d25ba
6f781aad 23c3a457 44e53762 60f49352 301d0603 551d0e04 16041413 e714e149
7065f2cc ef52f8d7 cc5277a0 50b65730 0d06092a 864886f7 0d010104 05000381
8100902d 7bbfcfc8 8b3e9498 ecdef437 7407200a d6c16624 071991cc 6bf8165f
8d5c9b14 d69a431f 9350115a 54e778a4 c2064ca3 88125e11 2b38f94d d948550c
e2511fcd 0a75c731 271104a8 e4a69d7b ed5fce53 1a23c3d5 624393c1 e4948cdd
a329f8c1 ffaea14e 9c7cc577 34d6733e 931bcf3f 507732cf 3a09ed1a 90fbc654 ae22
quit
certificate ca 03
30820298 30820201 a0030201 02020103 300d0609 2a864886 f70d0101 04050030
60310b30 09060355 04061302 636e3110 300e0603 55040713 07717967 79373031
310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309 5965736c
61625365 63311a30 18060355 04031311 526f6f74 43412e79 65736c61 622e6e65
74301e17 0d313130 37313430 38323430 385a170d 31323037 31333038 32343038
5a306231 0b300906 03550406 1302636e 3110300e 06035504 07130771 79677937
3031310f 300d0603 55040a13 06596573 6c616231 12301006 0355040b 13095965
736c6162 53656331 1c301a06 03550403 13135355 422d4341 2d312e79 65736c61
622e6e65 7430819f 300d0609 2a864886 f70d0101 01050003 818d0030 81890281
8100d9c6 55200bbb d4e3d339 626c7d9c fcec05c4 fe8efe36 9c8eee75 4d874c8c
850f22cf 32b27ddc 9160c923 753cce81 58136b18 8c828944 4c1a7c52 4a2cdb43
e0cc2f3b 3e1d675c d2e9083c 72af4636 c478bff7 5f01322f a7d728c6 92438e11
bff833fb 286ae56e 2be8c52b b9f996e2 f9fc937a ca493abe 17c4d688 6760925f
b3070203 010001a3 60305e30 0f060355 1d130101 ff040530 030101ff 300b0603
551d0f04 04030207 80301f06 03551d23 04183016 8014d735 7888dbd7 cef6a2d8
de5240ee 6ab59074 c7c4301d 0603551d 0e041604 141b0d25 ba6f781a ad23c3a4
5744e537 6260f493 52300d06 092a8648 86f70d01 01040500 03818100 a7d29161
2ca39c0a 99c71101 7ea27f66 95c225f7 d1db24bc 47dd20a4 228c61da 304914d4
38e86c14 240c7cdb 1f900336 48634a16 595a4b18 59baf40f 4b398816 2ea9c067
b11b0ce7 213635a0 912e39dc 792a180b 57904202 24000827 fa981bb7 9ab3ba40
02c17441 cb2eb938 790bec3f 1c8840e8 93097949 6d71e964 fd87be86
quit
crypto isakmp enable outside
crypto isakmp policy 10
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no crypto isakmp nat-traversal
crypto isakmp disconnect-notify
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
ntp server 10.1.1.200
username ipsecuser password K.NuA/2Ops0KjBQL encrypted
tunnel-group yeslabgroup type remote-access
tunnel-group yeslabgroup general-attributes
address-pool ippool
tunnel-group yeslabgroup ipsec-attributes
chain
trust-point SUB-CA-1
tunnel-group-map enable rules
tunnel-group-map yeslab-ca-map 10 yeslabgroup
prompt hostname context
Cryptochecksum:691e3574ba18a5fdf2cf8ff2071c585d
: end
============================ASA 8.4(1)真实设备实现===========================
ASA Version 8.4(1)
!
hostname ASA
domain-name yeslab.net
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.1.1.100 255.255.255.0
!
interface Ethernet0/1
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
management-only
!
ftp mode passive
clock timezone GMT 8
dns server-group DefaultDNS
domain-name yeslab.net
pager lines 24
mtu outside 1500
ip local pool ippool 123.1.1.100-123.1.1.200
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
route outside 0.0.0.0 0.0.0.0 10.1.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set yeslab-trans esp-3des esp-sha-hmac
crypto dynamic-map yeslab-dymap 10 set ikev1 transform-set yeslab-trans
crypto map yeslab-cry-map 10 ipsec-isakmp dynamic yeslab-dymap
crypto map yeslab-cry-map interface outside
crypto ca trustpoint RootCA
enrollment url http://10.1.1.200:80
crl configure
crypto ca trustpoint SUB-CA-1
enrollment url http://10.1.1.201:80
fqdn ASA.yeslab.net
subject-name cn=ASA.yeslab.net, ou=YeslabSec, o=Yeslab, l=qygy701, c=cn
crl configure
crypto ca certificate map yeslab-ca-map 10 （证书到tunnel-group映射）
issuer-name co sub-ca-2.yeslab.net
crypto ca certificate chain RootCA
certificate ca 01
30820299 30820202 a0030201 02020101 300d0609 2a864886 f70d0101 04050030
60310b30 09060355 04061302 636e3110 300e0603 55040713 07717967 79373031
310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309 5965736c
61625365 63311a30 18060355 04031311 526f6f74 43412e79 65736c61 622e6e65
74301e17 0d313130 37313530 37313933 375a170d 31343037 31343037 31393337
5a306031 0b300906 03550406 1302636e 3110300e 06035504 07130771 79677937
3031310f 300d0603 55040a13 06596573 6c616231 12301006 0355040b 13095965
736c6162 53656331 1a301806 03550403 1311526f 6f744341 2e796573 6c61622e
6e657430 819f300d 06092a86 4886f70d 01010105 0003818d 00308189 02818100
89feced6 ebfd3f5a 874eae73 9d644958 f24e4cdc d844e615 b2abdf5d 266a5898
bf8ca6b9 ab996497 645dbb47 22a0b1d0 25dcfec9 1db54c14 ee1b7c2f 0a1bf2e3
5f37f86b 72ac5bc2 0e6f27c4 44f792c2 1f88b43a c157a947 6e39e6cf 41676b75
803d9401 40a12295 f666b867 058f1e01 3a6c065c 83e99d58 2f9f9e6b 223498c9
02030100 01a36330 61300f06 03551d13 0101ff04 05300301 01ff300e 0603551d
0f0101ff 04040302 0186301f 0603551d 23041830 1680147c 2e54a18a 4b2e3980
9df369f4 f3a36cc7 430b1130 1d060355 1d0e0416 04147c2e 54a18a4b 2e39809d
f369f4f3 a36cc743 0b11300d 06092a86 4886f70d 01010405 00038181 00082ae7
fd1c0325 76c91b92 ea9e3e6c 0a552558 774ec57b 7277c485 fe08d4f7 3d059ebb
5d74cd9c a2a7b6d5 cc7bd7c3 cbcfa11e 791e76e1 12f8be12 5880ecaf c7427008
0d11612a 36d4999c 203e0c8c 7ffbc715 5a2a0295 b7b7dc15 ccc2119c 65efa10d
f4b91fc5 ca4df6f3 5127b102 5c400f83 09e4e0a9 ccc04b22 aa54b0d7 a3
quit
crypto ca certificate chain SUB-CA-1
certificate 03
308202c1 3082022a a0030201 02020103 300d0609 2a864886 f70d0101 04050030
62310b30 09060355 04061302 636e3110 300e0603 55040713 07717967 79373031
310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309 5965736c
61625365 63311c30 1a060355 04031313 5355422d 43412d31 2e796573 6c61622e
6e657430 1e170d31 31303731 35303733 3632345a 170d3132 30373134 30373333
31345a30 7c310b30 09060355 04061302 636e3110 300e0603 55040713 07717967
79373031 310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309
5965736c 61625365 63311730 15060355 0403130e 4153412e 7965736c 61622e6e
6574311d 301b0609 2a864886 f70d0109 02160e41 53412e79 65736c61 622e6e65
7430819f 300d0609 2a864886 f70d0101 01050003 818d0030 81890281 8100d5b5
adcefc59 e5d1e1fe 6e56ab07 2ac2745e 355889e5 c28a7a22 7f69f4a9 cc2f9001
8b4a65ce b1e5c033 bcd9ee47 49724618 2b91c5a4 32a43b9c e66fbeda 240f405d
f07fd9ee f34dbf76 c276c174 645ee92a d9c201d0 379429ca 01151f26 32c30eed
deb404e0 719bd5bd 2f770880 18f8bbba 21c18c6e 276e7eb6 4e7d1518 52c90203
010001a3 6d306b30 19060355 1d110412 3010820e 4153412e 7965736c 61622e6e
6574300e 0603551d 0f0101ff 04040302 05a0301f 0603551d 23041830 168014bc
65821899 19fe683e 8b84d1ec 607581a4 d7608530 1d060355 1d0e0416 04148674
efff619d e5fdfc1d 5f01c911 4a05bc76 910e300d 06092a86 4886f70d 01010405
00038181 006b116b e3ef199f 5b89e16f 5ea8ab1d 3a80cf05 7d5e3d17 8cdf5617
391398e6 873bf40b 0b4500ed 0cf559a2 423abeb0 26ccddb9 0c049b47 a7cecded
a0a1701b 9d5287a9 dcec66f6 2a726cb3 e474f325 bb1f16f2 0c16da67 60cb7c5e
79061f4d f7fc4f3d fd304181 feb783aa 397c6f9a e725f740 4d0e5991 99fb3e41
363255f7 e1
quit
certificate ca 03
30820298 30820201 a0030201 02020103 300d0609 2a864886 f70d0101 04050030
60310b30 09060355 04061302 636e3110 300e0603 55040713 07717967 79373031
310f300d 06035504 0a130659 65736c61 62311230 10060355 040b1309 5965736c
61625365 63311a30 18060355 04031311 526f6f74 43412e79 65736c61 622e6e65
74301e17 0d313130 37313530 37333331 345a170d 31323037 31343037 33333134
5a306231 0b300906 03550406 1302636e 3110300e 06035504 07130771 79677937
3031310f 300d0603 55040a13 06596573 6c616231 12301006 0355040b 13095965
736c6162 53656331 1c301a06 03550403 13135355 422d4341 2d312e79 65736c61
622e6e65 7430819f 300d0609 2a864886 f70d0101 01050003 818d0030 81890281
8100dc54 f9650bf8 7602cf59 57e46aac 9de07d3c 6671e259 bc680c04 405482db
7bf7a2ee 5851c1c1 05549bea 9ca3a074 bf44ddf9 eaaeeb58 19a0c127 761826fd
a9d0c925 286c7d71 585def1b c2a5a584 bd826dc9 10189125 7048cea9 a35f0297
30a3f97b 93d44501 b88dd3d2 695029cc 5a871e13 36c40244 5d679f38 3fee7b12
94710203 010001a3 60305e30 0f060355 1d130101 ff040530 030101ff 300b0603
551d0f04 04030207 80301f06 03551d23 04183016 80147c2e 54a18a4b 2e39809d
f369f4f3 a36cc743 0b11301d 0603551d 0e041604 14bc6582 189919fe 683e8b84
d1ec6075 81a4d760 85300d06 092a8648 86f70d01 01040500 03818100 0a4fa423
e0496920 7efde42d 3d5ba161 0cb4972a fa999044 9fc654ff cf38ff8f 162f78fd
07a9ba66 11ea488b 1cce4569 6dfc1d78 77d22705 3e78edd9 ba3bcf41 7c1710ff
7e8e7ebd e00e93b0 0363e550 9c931623 7c3fe7d6 d2c7947c 1fd07afa 80a33f8f
9ce53547 86ba4ee8 74823068 ee0cab49 d1853d78 b580b659 6cf58e52
quit
crypto isakmp disconnect-notify
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.1.1.200
web***
anyconnect-essentials
username ipsecuser password K.NuA/2Ops0KjBQL encrypted
tunnel-group yeslabgroup type remote-access
tunnel-group yeslabgroup general-attributes
address-pool ippool
tunnel-group yeslabgroup ipsec-attributes
chain（测试感觉没有效果）
ikev1 trust-point SUB-CA-1

tunnel-group-map enable rules（证书到tunnel-group映射）
tunnel-group-map yeslab-ca-map 10 yeslabgroup
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:9c1b5f052116fd843a15f6c8f4f37912
: end

============================IOSEz×××配置===========================

hostname IOSEz×××
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication login remote local
aaa authorization network remote local
!
!
aaa session-id common
clock timezone GMT 8
ip cef
!
!
!
!
ip domain name yeslab.net
!
multilink bundle-name authenticated
!
!
crypto pki trustpoint RootCA
enrollment url http://10.1.1.200:80
chain-validation continue SUB-CA-1
revocation-check none
!
crypto pki trustpoint SUB-CA-1
enrollment url http://10.1.1.201:80
serial-number
ip-address 10.1.1.101
subject-name cn=IOSEz×××.yeslab.net, ou=YeslabSec, o=Yeslab, l=qygy701, c=cn
revocation-check crl
!
!
crypto pki certificate chain RootCA
certificate ca 01
30820299 30820202 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
60310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311A30 18060355 04031311 526F6F74 43412E79 65736C61 622E6E65
74301E17 0D313130 37313530 37313933 375A170D 31343037 31343037 31393337
5A306031 0B300906 03550406 1302636E 3110300E 06035504 07130771 79677937
3031310F 300D0603 55040A13 06596573 6C616231 12301006 0355040B 13095965
736C6162 53656331 1A301806 03550403 1311526F 6F744341 2E796573 6C61622E
6E657430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
89FECED6 EBFD3F5A 874EAE73 9D644958 F24E4CDC D844E615 B2ABDF5D 266A5898
BF8CA6B9 AB996497 645DBB47 22A0B1D0 25DCFEC9 1DB54C14 EE1B7C2F 0A1BF2E3
5F37F86B 72AC5BC2 0E6F27C4 44F792C2 1F88B43A C157A947 6E39E6CF 41676B75
803D9401 40A12295 F666B867 058F1E01 3A6C065C 83E99D58 2F9F9E6B 223498C9
02030100 01A36330 61300F06 03551D13 0101FF04 05300301 01FF300E 0603551D
0F0101FF 04040302 0186301F 0603551D 23041830 1680147C 2E54A18A 4B2E3980
9DF369F4 F3A36CC7 430B1130 1D060355 1D0E0416 04147C2E 54A18A4B 2E39809D
F369F4F3 A36CC743 0B11300D 06092A86 4886F70D 01010405 00038181 00082AE7
FD1C0325 76C91B92 EA9E3E6C 0A552558 774EC57B 7277C485 FE08D4F7 3D059EBB
5D74CD9C A2A7B6D5 CC7BD7C3 CBCFA11E 791E76E1 12F8BE12 5880ECAF C7427008
0D11612A 36D4999C 203E0C8C 7FFBC715 5A2A0295 B7B7DC15 CCC2119C 65EFA10D
F4B91FC5 CA4DF6F3 5127B102 5C400F83 09E4E0A9 CCC04B22 AA54B0D7 A3
quit
crypto pki certificate chain SUB-CA-1
certificate 08
308202A4 3082020D A0030201 02020108 300D0609 2A864886 F70D0101 04050030
62310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311C30 1A060355 04031313 5355422D 43412D31 2E796573 6C61622E
6E657430 1E170D31 31303731 35303834 3132335A 170D3132 30373134 30373333
31345A30 81C0310B 30090603 55040613 02636E31 10300E06 03550407 13077179
67793730 31310F30 0D060355 040A1306 5965736C 61623112 30100603 55040B13
09596573 6C616253 6563311C 301A0603 55040313 13494F53 457A5650 4E2E7965
736C6162 2E6E6574 315C3017 06092A86 4886F70D 01090813 0A31302E 312E312E
31303130 1F060355 04051318 464F4330 39323031 43365120 28323039 38333939
33383529 30200609 2A864886 F70D0109 02161349 4F53457A 56504E2E 7965736C
61622E6E 6574305C 300D0609 2A864886 F70D0101 01050003 4B003048 024100E8
22B6FFC2 67C674EB 128780A5 B8272A75 871D89F9 0AD1526A 19450D15 67A0943D
41514CA1 B102B2A3 6533B79B D5E52A96 7C77A754 D48DA8D2 B7FCF5C3 A555E702
03010001 A34F304D 300B0603 551D0F04 04030205 A0301F06 03551D23 04183016
8014BC65 82189919 FE683E8B 84D1EC60 7581A4D7 6085301D 0603551D 0E041604
140BA0B9 813D3A62 1BD5B194 F8BF12B7 0CFA5E12 E6300D06 092A8648 86F70D01
01040500 03818100 8109DCAD 84604654 9D055B37 1A885DB1 2AEC9F49 24361EA3
7F6E8DA7 90891B8E 1D540796 CEA2B01F 87D60B0B 9F8995F7 E5AA910D B34BB70C
567DC9F7 470AED69 7EC3C013 4F6B2752 31F2C2C5 81729EE6 3AF2E375 4B6685C9
0FC38C20 938FD2DC 63C3B1B3 9BDB36E7 1310B774 30DCC56B EA9D4E55 266849FC
09D22A49 775F92EB
quit
certificate ca 03
30820298 30820201 A0030201 02020103 300D0609 2A864886 F70D0101 04050030
60310B30 09060355 04061302 636E3110 300E0603 55040713 07717967 79373031
310F300D 06035504 0A130659 65736C61 62311230 10060355 040B1309 5965736C
61625365 63311A30 18060355 04031311 526F6F74 43412E79 65736C61 622E6E65
74301E17 0D313130 37313530 37333331 345A170D 31323037 31343037 33333134
5A306231 0B300906 03550406 1302636E 3110300E 06035504 07130771 79677937
3031310F 300D0603 55040A13 06596573 6C616231 12301006 0355040B 13095965
736C6162 53656331 1C301A06 03550403 13135355 422D4341 2D312E79 65736C61
622E6E65 7430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100DC54 F9650BF8 7602CF59 57E46AAC 9DE07D3C 6671E259 BC680C04 405482DB
7BF7A2EE 5851C1C1 05549BEA 9CA3A074 BF44DDF9 EAAEEB58 19A0C127 761826FD
A9D0C925 286C7D71 585DEF1B C2A5A584 BD826DC9 10189125 7048CEA9 A35F0297
30A3F97B 93D44501 B88DD3D2 695029CC 5A871E13 36C40244 5D679F38 3FEE7B12
94710203 010001A3 60305E30 0F060355 1D130101 FF040530 030101FF 300B0603
551D0F04 04030207 80301F06 03551D23 04183016 80147C2E 54A18A4B 2E39809D
F369F4F3 A36CC743 0B11301D 0603551D 0E041604 14BC6582 189919FE 683E8B84
D1EC6075 81A4D760 85300D06 092A8648 86F70D01 01040500 03818100 0A4FA423
E0496920 7EFDE42D 3D5BA161 0CB4972A FA999044 9FC654FF CF38FF8F 162F78FD
07A9BA66 11EA488B 1CCE4569 6DFC1D78 77D22705 3E78EDD9 BA3BCF41 7C1710FF
7E8E7EBD E00E93B0 0363E550 9C931623 7C3FE7D6 D2C7947C 1FD07AFA 80A33F8F
9CE53547 86BA4EE8 74823068 EE0CAB49 D1853D78 B580B659 6CF58E52
quit
!
!
username ipsecuser password 0 cisco
archive
log config
hidekeys
!
!
crypto isakmp policy 10
encr 3des
group 2
crypto isakmp identity dn
!
crypto isakmp client configuration group YeslabVoice（映射OU到group）
pool ippool
!
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
!
crypto dynamic-map dymap 10
set transform-set cisco
reverse-route
!
!
crypto map cisco client authentication list remote
crypto map cisco isakmp authorization list remote
crypto map cisco client configuration address respond
crypto map cisco 10 ipsec-isakmp dynamic dymap
!
!
!
ip ssh version 1
!
!
!
interface Ethernet0
no ip address
shutdown
half-duplex
!
interface FastEthernet0
ip address 10.1.1.101 255.255.255.0
speed auto
crypto map cisco
!
ip local pool ippool 123.1.1.100 123.1.1.200
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
!
ntp clock-period 17179817
ntp server 10.1.1.200
end

============================Ez×××软件客户端===========================

1.软件客户端安装的证书（测试结果需要安装SUB-CA-1，无奈！）

2.软件客户端连接设置

3.软件客户端SCEP在线申请