{"id":336,"date":"2025-06-14T15:44:00","date_gmt":"2025-06-14T06:44:00","guid":{"rendered":"https:\/\/ccna-curriculum.tech-village.co.jp\/?p=336"},"modified":"2025-10-22T10:53:21","modified_gmt":"2025-10-22T01:53:21","slug":"ipsec-vpn%e5%ae%9f%e8%a3%85","status":"publish","type":"post","link":"https:\/\/ccna-curriculum.tech-village.co.jp\/?p=336","title":{"rendered":"IPsec-VPN\uff08\u57fa\u672c\u69cb\u7bc9\uff09"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">IPsec\u306e\u8a2d\u5b9a\uff08IKE\u30d5\u30a7\u30fc\u30ba1\u306e\u8a2d\u5b9a\uff09<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IPsec\u306b\u3088\u308b\u901a\u4fe1\u3092\u958b\u59cb\u3059\u308b\u306b\u306f\u3001\u6700\u521d\u306b<strong><span class=\"swl-marker mark_yellow\">ISAKMP SA<\/span><\/strong>\u3092\u751f\u6210\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u305d\u306e\u305f\u3081\u306b\u306fIKE\u30d5\u30a7\u30fc\u30ba1\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5b9a\u7fa9\u3057\u3001\u76f8\u624b\u6a5f\u5668\u3068\u4e00\u81f4\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3092\u884c\u3044\u307e\u3059\u3002\u3053\u3053\u3067\u8a2d\u5b9a\u3057\u305f\u5185\u5bb9\u306b\u57fa\u3065\u304d\u3001ISAKMP SA\u304c\u78ba\u7acb\u3055\u308c\u3001\u5f8c\u306e\u30d5\u30a7\u30fc\u30ba2\u3067IPsec SA\u3092\u4f5c\u6210\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ISAKMP\u30dd\u30ea\u30b7\u30fc\u306e\u4f5c\u6210<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ISAKMP\u30dd\u30ea\u30b7\u30fc\u306f\u3001\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config)# crypto isakmp policy priority<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>priority<\/strong>\u306f\u300c1\uff5e10000\u300d\u3067\u6307\u5b9a\u53ef\u80fd<\/li>\n\n\n\n<li>\u6570\u5b57\u304c\u5c0f\u3055\u3044\u307b\u3069\u512a\u5148\u5ea6\u304c\u9ad8\u304f\u3001\u8907\u6570\u5b9a\u7fa9\u304c\u3042\u308b\u5834\u5408\u306f\u6700\u3082\u4f4e\u3044\u756a\u53f7\u304b\u3089\u9806\u306b\u30de\u30c3\u30c1\u30f3\u30b0\u3055\u308c\u308b<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u4f8b\u3048\u3070\u300ccrypto isakmp policy 1\u300d\u3068\u8a2d\u5b9a\u3059\u308b\u3068\u3001\u6700\u512a\u5148\u306e\u30dd\u30ea\u30b7\u30fc\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u6697\u53f7\u5316\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306e\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ISAKMP SA\u3067\u5229\u7528\u3059\u308b\u6697\u53f7\u5316\u65b9\u5f0f\u3092\u6307\u5b9a\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u306f\u300cdes\u300d\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config-isakmp)# encryption &#91; des | 3des | aes 128 | aes 192 | aes 256 ]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u30cf\u30c3\u30b7\u30e5\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306e\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u8a8d\u8a3c\u3084\u9375\u8a08\u7b97\u306b\u4f7f\u7528\u3059\u308b\u30cf\u30c3\u30b7\u30e5\u65b9\u5f0f\u3092\u6307\u5b9a\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u306f\u300csha\u300d\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config-isakmp)# hash &#91; md5 | sha | sha256 | sha384 | sha512 ]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u8a8d\u8a3c\u65b9\u5f0f\u306e\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">IKE\u30d5\u30a7\u30fc\u30ba1\u3067\u76f8\u624b\u3092\u8a8d\u8a3c\u3059\u308b\u65b9\u6cd5\u3092\u6307\u5b9a\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u306f\u300crsa-sig\u300d\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config-isakmp)# authentication &#91; rsa-sig | rsa-encr | pre-share ]<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>rsa-sig<\/strong>\uff1aRSA\u7f72\u540d\u3092\u5229\u7528\u3057\u305f\u65b9\u5f0f<\/li>\n\n\n\n<li><strong>rsa-encr<\/strong>\uff1aRSA\u6697\u53f7\u5316\u30ca\u30f3\u30b9\u3092\u5229\u7528\u3057\u305f\u65b9\u5f0f<\/li>\n\n\n\n<li><strong>pre-share<\/strong>\uff1a\u4e8b\u524d\u5171\u6709\u9375\uff08Pre-shared Key\uff09\u3092\u5229\u7528\u3059\u308b\u65b9\u5f0f<\/li>\n<\/ul>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">\u8a66\u9a13\u3067\u306f\u300cpre-shared key\u65b9\u5f0f\u304c\u6700\u3082\u30b7\u30f3\u30d7\u30eb\u3067\u5e83\u304f\u5229\u7528\u3055\u308c\u3066\u3044\u308b\u300d\u3068\u3044\u3046\u70b9\u304c\u72d9\u308f\u308c\u3084\u3059\u3044\u3067\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pre-shared Key\u306e\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u8a8d\u8a3c\u65b9\u5f0f\u306b\u300cpre-share\u300d\u3092\u9078\u3093\u3060\u5834\u5408\u306f\u3001\u4e8b\u524d\u306b\u5171\u6709\u3059\u308b\u9375\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config)# crypto isakmp key password address address<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>password<\/strong>\uff1a\u5171\u6709\u3059\u308b\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba<\/li>\n\n\n\n<li><strong>address<\/strong>\uff1a\u76f8\u624b\u6a5f\u5668\u306eIP\u30a2\u30c9\u30ec\u30b9<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Diffie-Hellman\u30b0\u30eb\u30fc\u30d7\u306e\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u9375\u4ea4\u63db\u306b\u5229\u7528\u3059\u308bDH\u30b0\u30eb\u30fc\u30d7\u3092\u6307\u5b9a\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u306f\u300c1\u300d\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config-isakmp)# group &#91; 1 | 2 | 5 ]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">ISAKMP SA\u306e\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ISAKMP SA\u304c\u6709\u52b9\u3067\u3044\u3089\u308c\u308b\u6642\u9593\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u306f86400\u79d2\uff0824\u6642\u9593\uff09\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config-isakmp)# lifetime seconds<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u77ed\u304f\u3059\u308b\u3068\u9375\u306e\u518d\u751f\u6210\u304c\u983b\u7e41\u306b\u884c\u308f\u308c\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u9ad8\u307e\u308a\u307e\u3059\u304c\u51e6\u7406\u8ca0\u8377\u304c\u5897\u3048\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">DPD\uff08Dead Peer Detection\uff09\u306e\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DPD\u3092\u8a2d\u5b9a\u3059\u308b\u3068\u3001\u76f8\u624b\u3068\u306e\u30c8\u30f3\u30cd\u30eb\u304c\u5207\u65ad\u3055\u308c\u305f\u5834\u5408\u306b\u81ea\u52d5\u3067\u691c\u51fa\u30fb\u524a\u9664\u3067\u304d\u307e\u3059\u3002\u901a\u5e38\u306f\u7121\u52b9\u3067\u3059\u304c\u3001VPN\u3067\u30c0\u30a4\u30ca\u30df\u30c3\u30af\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3092\u4f7f\u308f\u306a\u3044\u74b0\u5883\u3067\u306f\u300cperiodic\u300d\u3092\u6307\u5b9a\u3059\u308b\u306e\u304c\u63a8\u5968\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config)# crypto isakmp keepalive seconds &#91; retries ] &#91; periodic | on-demand ]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">ISAKMP SA\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u4e00\u89a7<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u9805\u76ee<\/th><th>\u9078\u629e\u80a2<\/th><th>\u30c7\u30d5\u30a9\u30eb\u30c8\u5024<\/th><\/tr><\/thead><tbody><tr><td>encryption\uff08\u6697\u53f7\u5316\u65b9\u5f0f\uff09<\/td><td>des, 3des, aes 128\/192\/256<\/td><td>des<\/td><\/tr><tr><td>hash\uff08\u30cf\u30c3\u30b7\u30e5\u65b9\u5f0f\uff09<\/td><td>sha, md5<\/td><td>sha<\/td><\/tr><tr><td>lifetime\uff08\u6709\u52b9\u6642\u9593\uff09<\/td><td>60\uff5e86400\u79d2<\/td><td>86400\u79d2<\/td><\/tr><tr><td>authentication\uff08\u8a8d\u8a3c\u65b9\u5f0f\uff09<\/td><td>rsa-sig, rsa-encr, pre-share<\/td><td>rsa-sig<\/td><\/tr><tr><td>group\uff08DH\u30b0\u30eb\u30fc\u30d7\uff09<\/td><td>1, 2, 5<\/td><td>1<\/td><\/tr><tr><td>crypto isakmp key<\/td><td>Pre-shared key \u3068\u76f8\u624b\u30a2\u30c9\u30ec\u30b9<\/td><td>\u2015<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">\u8a2d\u5b9a\u4f8b<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0b\u306e\u4f8b\u3067\u306f\u3001\u6697\u53f7\u5316\u306b3DES\u3001\u30cf\u30c3\u30b7\u30e5\u306bSHA\u3001\u8a8d\u8a3c\u65b9\u5f0f\u306bPre-shared key\u3092\u4f7f\u7528\u3057\u3001DH\u30b0\u30eb\u30fc\u30d7\u30922\u3001\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0\u309212\u6642\u9593\uff0843200\u79d2\uff09\u306b\u8a2d\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002\u3055\u3089\u306bPre-shared key\u3092\u300ccisco\u300d\u3068\u3057\u3001\u76f8\u624b\u30a2\u30c9\u30ec\u30b9\u3092\u300c100.1.1.1\u300d\u3001DPD\u309230\u79d2\u3054\u3068\u306b\u9001\u4fe1\u3059\u308b\u3088\u3046\u306b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Cisco(config)# crypto isakmp policy 1\nCisco(config-isakmp)# encryption 3des\nCisco(config-isakmp)# hash sha\nCisco(config-isakmp)# authentication pre-share\nCisco(config-isakmp)# group 2\nCisco(config-isakmp)# lifetime 43200\n\nCisco(config)# crypto isakmp key cisco address 100.1.1.1\nCisco(config)# crypto isakmp keepalive 30 periodic<\/code><\/pre>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">\u8a66\u9a13\u3067\u306f\u300cISAKMP\u30dd\u30ea\u30b7\u30fc\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\u300d\u3084\u300ccrypto isakmp key \u30b3\u30de\u30f3\u30c9\u3067\u8a2d\u5b9a\u3059\u308b\u5185\u5bb9\u300d\u304c\u554f\u308f\u308c\u308b\u3053\u3068\u304c\u591a\u3044\u306e\u3067\u3001\u4e00\u89a7\u8868\u3092\u899a\u3048\u3066\u304a\u304f\u3068\u6709\u5229\u3067\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">IPsec\u306e\u8a2d\u5b9a\uff08IKE\u30d5\u30a7\u30fc\u30ba2\u306e\u8a2d\u5b9a\uff09<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IKE\u30d5\u30a7\u30fc\u30ba1\u3067ISAKMP SA\u304c\u78ba\u7acb\u3055\u308c\u305f\u5f8c\u3001IKE\u30d5\u30a7\u30fc\u30ba2\u3067\u306f<strong><span class=\"swl-marker mark_yellow\">IPsec SA<\/span><\/strong>\u3092\u751f\u6210\u3059\u308b\u305f\u3081\u306e\u8a2d\u5b9a\u3092\u884c\u3044\u307e\u3059\u3002\u3053\u3053\u3067\u306f\u300c\u3069\u306e\u901a\u4fe1\u3092\u6697\u53f7\u5316\u3059\u308b\u304b\u300d\u300c\u3069\u306e\u6697\u53f7\u65b9\u5f0f\u3092\u4f7f\u3046\u304b\u300d\u3092\u5177\u4f53\u7684\u306b\u5b9a\u7fa9\u3057\u3001\u6700\u7d42\u7684\u306b\u6697\u53f7\u30de\u30c3\u30d7\u3092\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3078\u9069\u7528\u3059\u308b\u3053\u3068\u3067VPN\u30c8\u30f3\u30cd\u30eb\u304c\u78ba\u7acb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8\u306e\u5b9a\u7fa9<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">IPsec SA\u3092\u78ba\u7acb\u3059\u308b\u305f\u3081\u306b\u3001\u307e\u305a<strong><span class=\"swl-marker mark_yellow\">\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8<\/span><\/strong>\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u300c\u6697\u53f7\u5316\u65b9\u5f0f\u300d\u300c\u8a8d\u8a3c\u65b9\u5f0f\u300d\u300c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30ed\u30c8\u30b3\u30eb\u300d\u3092\u7d44\u307f\u5408\u308f\u305b\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config)# crypto ipsec transform-set name transform1 transform2<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee3\u8868\u7684\u306a\u9078\u629e\u80a2\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>\u7a2e\u985e<\/th><th>\u9078\u629e\u80a2<\/th><\/tr><\/thead><tbody><tr><td>ESP\u6697\u53f7\u5316<\/td><td>esp-aes \/ esp-aes-192 \/ esp-aes-256 \/ esp-des \/ esp-3des \/ esp-null \/ esp-seal<\/td><\/tr><tr><td>ESP\u8a8d\u8a3c<\/td><td>esp-md5-hmac \/ esp-sha-hmac<\/td><\/tr><tr><td>AH\u8a8d\u8a3c<\/td><td>ah-md5-hmac \/ ah-sha-hmac<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">\u8a2d\u5b9a\u4f8b<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Cisco(config)# crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u306e\u4f8b\u3067\u306fESP\u3092\u4f7f\u3044\u3001\u6697\u53f7\u5316\u306b3DES\u3001\u8a8d\u8a3c\u306bMD5\u3092\u5229\u7528\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u901a\u4fe1\u30e2\u30fc\u30c9\u306e\u6307\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30c8\u30f3\u30cd\u30eb\u30e2\u30fc\u30c9\u304c\u5229\u7528\u3055\u308c\u308b\u305f\u3081\u3001\u7279\u5225\u306a\u6307\u5b9a\u3092\u3057\u306a\u3044\u9650\u308a\u30c8\u30f3\u30cd\u30eb\u30e2\u30fc\u30c9\u306b\u306a\u308a\u307e\u3059\u3002\u5fc5\u8981\u306b\u5fdc\u3058\u3066\u660e\u793a\u7684\u306b\u6307\u5b9a\u53ef\u80fd\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(cfg-crypto-trans)# mode &#91; tunnel | transport ]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">IPsec SA\u306e\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0\u8a2d\u5b9a\uff08\u30aa\u30d7\u30b7\u30e7\u30f3\uff09<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u4ee5\u4e0b\u304c\u9069\u7528\u3055\u308c\u307e\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u6642\u9593\uff1a3600\u79d2\uff081\u6642\u9593\uff09<\/li>\n\n\n\n<li>\u30c7\u30fc\u30bf\u91cf\uff1a4608000KB<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u5909\u66f4\u3057\u305f\u3044\u5834\u5408\u306f\u6b21\u306e\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config)# crypto ipsec security-association lifetime &#91; seconds \u79d2 | kilobytes \u30d0\u30a4\u30c8\u6570 ]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">IPsec\u5bfe\u8c61\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u5b9a\u7fa9\uff08ACL\uff09<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u3069\u306e\u901a\u4fe1\u3092\u6697\u53f7\u5316\u3059\u308b\u304b\u306fACL\u3067\u5b9a\u7fa9\u3057\u307e\u3059\u3002permit\u3067\u4e00\u81f4\u3057\u305f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u6697\u53f7\u5316\u3055\u308c\u3001deny\u306b\u4e00\u81f4\u3057\u305f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u6697\u53f7\u5316\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">\u8a2d\u5b9a\u4f8b<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Cisco(config)# access-list 101 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u306e\u4f8b\u3067\u306f\u3001172.16.1.0\/24 \u304b\u3089 172.16.2.0\/24 \u3078\u306e\u901a\u4fe1\u3092IPsec\u5bfe\u8c61\u306b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u6697\u53f7\u30de\u30c3\u30d7\u306e\u8a2d\u5b9a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8\u30fbACL\u30fb\u30d4\u30a2\u306e\u60c5\u5831\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u306e\u304c<strong><span class=\"swl-marker mark_yellow\">\u6697\u53f7\u30de\u30c3\u30d7<\/span><\/strong>\u3067\u3059\u3002\u512a\u5148\u5ea6\u306f\u30b7\u30fc\u30b1\u30f3\u30b9\u756a\u53f7\u3067\u6c7a\u307e\u308a\u3001\u6570\u5b57\u304c\u5c0f\u3055\u3044\u307b\u3069\u512a\u5148\u5ea6\u304c\u9ad8\u304f\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config)# crypto map map-name seq-number ipsec-isakmp\n(config-crypto-map)# match address acl-number\n(config-crypto-map)# set transform-set name\n(config-crypto-map)# set peer address<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u30aa\u30d7\u30b7\u30e7\u30f3\u3068\u3057\u3066\u4ee5\u4e0b\u3092\u8a2d\u5b9a\u53ef\u80fd\u3067\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SA\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0\u306e\u500b\u5225\u6307\u5b9a<\/li>\n\n\n\n<li>PFS\uff08Perfect Forward Secrecy\uff09\u306e\u6709\u52b9\u5316<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>(config-crypto-map)# set security-association lifetime &#91; seconds \u79d2 | kilobytes \u30d0\u30a4\u30c8\u6570 ]\n(config-crypto-map)# set pfs &#91; group1 | group2 | group5 ]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3078\u306e\u9069\u7528<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u6700\u5f8c\u306b\u3001\u4f5c\u6210\u3057\u305f\u6697\u53f7\u30de\u30c3\u30d7\u3092VPN\u30c8\u30f3\u30cd\u30eb\u3092\u5f35\u308b\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3078\u9069\u7528\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(config)# interface interface-id\n(config-if)# crypto map map-name<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">\u8a2d\u5b9a\u4f8b<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0b\u306f\u3001IKE\u30d5\u30a7\u30fc\u30ba1\u3068\u30d5\u30a7\u30fc\u30ba2\u3092\u901a\u3057\u3066\u5b9f\u969b\u306bIPsec VPN\u3092\u8a2d\u5b9a\u3057\u305f\u4f8b\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>! IKE Phase 1 \u306e\u8a2d\u5b9a\nCisco(config)# crypto isakmp policy 1\nCisco(config-isakmp)# encryption 3des\nCisco(config-isakmp)# hash sha\nCisco(config-isakmp)# authentication pre-share\nCisco(config-isakmp)# group 2\nCisco(config-isakmp)# lifetime 43200\n\nCisco(config)# crypto isakmp key cisco address 100.1.1.1\nCisco(config)# crypto isakmp keepalive 30 periodic\n\n! IKE Phase 2 \u306e\u8a2d\u5b9a\nCisco(config)# crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac\n\n! IPsec\u5bfe\u8c61\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u5b9a\u7fa9\nCisco(config)# access-list 101 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255\n\n! \u6697\u53f7\u30de\u30c3\u30d7\u306e\u8a2d\u5b9a\nCisco(config)# crypto map M-ipsec 1 ipsec-isakmp\nCisco(config-crypto-map)# set peer 100.1.1.1\nCisco(config-crypto-map)# set transform-set IPSEC\nCisco(config-crypto-map)# match address 101\n\n! \u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3078\u306e\u9069\u7528\nCisco(config)# interface GigabitEthernet0\/0\nCisco(config-if)# crypto map M-ipsec<\/code><\/pre>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">\u8a66\u9a13\u3067\u306f\u300ccrypto map\u306b\u95a2\u9023\u4ed8\u3051\u308b3\u3064\u306e\u8981\u7d20\uff08\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8\u3001ACL\u3001\u30d4\u30a2\uff09\u300d\u3084\u300c\u30d5\u30a7\u30fc\u30ba1\u3068\u30d5\u30a7\u30fc\u30ba2\u3067\u6c7a\u5b9a\u3055\u308c\u308b\u30d1\u30e9\u30e1\u30fc\u30bf\u306e\u9055\u3044\u300d\u304c\u3088\u304f\u554f\u308f\u308c\u307e\u3059\u3002\u7279\u306bACL\u306epermit\u6587\u304c\u300cIPsec\u5bfe\u8c61\u901a\u4fe1\u306e\u5b9a\u7fa9\u300d\u306b\u4f7f\u308f\u308c\u308b\u70b9\u3092\u3057\u3063\u304b\u308a\u899a\u3048\u3066\u304a\u304f\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u7570\u6a5f\u7a2e\u9593\u3067\u8ff7\u308f\u306a\u3044\u305f\u3081\u306e\u4e8b\u524d\u6e96\u5099<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IPsec-VPN\u3092\u8907\u6570\u30e1\u30fc\u30ab\u30fc\u3067\u7d44\u3080\u3068\u304d\u306f\u3001\u5404\u793e\u72ec\u81ea\u306e\u547c\u3073\u65b9\u3084\u521d\u671f\u5024\u306b\u632f\u308a\u56de\u3055\u308c\u304c\u3061\u3067\u3059\u3002\u305d\u3053\u3067\u3001\u69cb\u7bc9\u524d\u306b<strong>\u5171\u901a\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u8868<\/strong>\u3092\u7528\u610f\u3057\u3066\u304a\u304f\u3068\u3001\u8a2d\u5b9a\u306e\u7a81\u304d\u5408\u308f\u305b\u304c\u4e00\u6c17\u306b\u697d\u306b\u306a\u308a\u307e\u3059\u3002\u30d5\u30a7\u30fc\u30ba1\uff08ISAKMP SA\uff09\u3068\u30d5\u30a7\u30fc\u30ba2\uff08IPsec SA\uff09\u3067\u6c7a\u3081\u308b\u5185\u5bb9\u3092\u5de6\u53f3\u306b\u5206\u3051\u3001\u76f8\u624b\u3068\u5408\u610f\u3057\u3066\u304b\u3089\u4f5c\u696d\u306b\u5165\u308b\u306e\u304c\u9244\u5247\u3067\u3059\u3002CCNA\u3067\u306f\u300c\u3069\u306e\u6bb5\u968e\u3067\u4f55\u3092\u6c7a\u3081\u308b\u304b\u300d\u304c\u3088\u304f\u554f\u308f\u308c\u307e\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>IKE Phase1\uff08ISAKMP SA\uff09<\/th><th>IKE Phase2\uff08IPsec SA\uff09<\/th><\/tr><\/thead><tbody><tr><td>\u6697\u53f7\u5316\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\uff08DES\/3DES\/AES\uff09<\/td><td>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30ed\u30c8\u30b3\u30eb\uff08AH\/ESP\uff09<\/td><\/tr><tr><td>\u30cf\u30c3\u30b7\u30e5\uff08MD5\/SHA-1\uff09<\/td><td>\u6697\u53f7\u5316\uff08DES\/3DES\/AES\/Null\uff09<\/td><\/tr><tr><td>\u8a8d\u8a3c\u65b9\u5f0f\uff08Pre-shared Key \/ \u7f72\u540d \/ \u516c\u958b\u9375 \u306a\u3069\uff09<\/td><td>\u8a8d\u8a3c\uff08HMAC-MD5 \/ HMAC-SHA1\uff09<\/td><\/tr><tr><td>DH\u30b0\u30eb\u30fc\u30d7\uff081\/2\/5\uff09<\/td><td>PFS\u30b0\u30eb\u30fc\u30d7\uff08\u4efb\u610f\uff1a1\/2\/5\uff09<\/td><\/tr><tr><td>ISAKMP SA\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0<\/td><td>IPsec SA\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0<\/td><\/tr><tr><td>Pre-shared Key<\/td><td>IPsec\u901a\u4fe1\u30e2\u30fc\u30c9\uff08\u30c8\u30f3\u30cd\u30eb\/\u30c8\u30e9\u30f3\u30b9\u30dd\u30fc\u30c8\uff09<\/td><\/tr><tr><td>ISAKMP\u30d4\u30a2\u30a2\u30c9\u30ec\u30b9<\/td><td>IPsec\u30d4\u30a2\u30a2\u30c9\u30ec\u30b9<\/td><\/tr><tr><td>DPD\u306e\u6709\u7121<\/td><td>IPsec\u5bfe\u8c61\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\uff08ACL\uff09<\/td><\/tr><tr><td>\u30d5\u30a7\u30fc\u30ba1\u30e2\u30fc\u30c9\uff08Main\/Aggressive\uff09<\/td><td>\u30d5\u30a7\u30fc\u30ba2\u30e2\u30fc\u30c9\uff08Quick\u306e\u307f\uff09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e00\u822c\u7684\u306a\u65b9\u91dd\u3068\u3057\u3066\u3001\u4e8b\u524d\u5171\u6709\u9375\u65b9\u5f0f\uff08Pre-shared Key\uff09\u3068DH\u30b0\u30eb\u30fc\u30d72\u306e\u7d44\u307f\u5408\u308f\u305b\u304c\u63a1\u7528\u3055\u308c\u308b\u5834\u9762\u304c\u591a\u304f\u3001\u62e0\u70b9\u9593VPN\u306fMain\u30e2\u30fc\u30c9\u3001\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u306fAggressive\u30e2\u30fc\u30c9\u304c\u3088\u304f\u4f7f\u308f\u308c\u307e\u3059\u3002PFS\u306f\u8981\u4ef6\u304c\u306a\u3051\u308c\u3070\u7121\u52b9\u306e\u307e\u307e\u306b\u3059\u308b\u30b1\u30fc\u30b9\u304c\u76ee\u7acb\u3061\u307e\u3059\u3002ISAKMP\u3068IPsec\u306e\u30d4\u30a2\u306f\u540c\u4e00\u30a2\u30c9\u30ec\u30b9\u3067\u305d\u308d\u3048\u308b\u3068\u30c8\u30e9\u30d6\u30eb\u304c\u6e1b\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PPPoE\u56de\u7dda\u3067\u62e0\u70b9\u9593IPsec-VPN\u3092\u5f35\u308b\u3068\u304d\u306e\u5168\u4f53\u50cf<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u56fd\u5185\u306e\u30a2\u30af\u30bb\u30b9\u56de\u7dda\u3068\u3057\u3066PPPoE\u304c\u4f7f\u308f\u308c\u308b\u3053\u3068\u304c\u591a\u3044\u305f\u3081\u3001\u5916\u5074\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u306fDialer\u3067\u78ba\u7acb\u3057\u3001\u305d\u306e\u4e0a\u306b\u6697\u53f7\u30de\u30c3\u30d7\u3092\u9069\u7528\u3059\u308b\u5f62\u306b\u306a\u308a\u307e\u3059\u3002\u30eb\u30fc\u30bf\u306f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u5074\u306b\u30c7\u30d5\u30a9\u30eb\u30c8\u30eb\u30fc\u30c8\u3092\u5411\u3051\u305f\u3046\u3048\u3067\u3001\u6697\u53f7\u30de\u30c3\u30d7\uff08crypto map\uff09\u306b\u300c\u30d4\u30a2\u300d\u300c\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8\u300d\u300c\u5bfe\u8c61ACL\u300d\u3092\u3072\u3068\u307e\u3068\u3081\u306b\u3057\u3001Dialer\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3078\u8cbc\u308a\u4ed8\u3051\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u6307\u5b9a\u30b5\u30d6\u30cd\u30c3\u30c8\u9593\u306e\u307f\u304c\u6697\u53f7\u5316\u3055\u308c\u3001\u4ed6\u306e\u901a\u4fe1\u306f\u5e73\u6587\u306e\u307e\u307e\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u3078\u6d41\u305b\u307e\u3059\uff08\u5fc5\u8981\u306b\u5fdc\u3058\u3066ACL\u3092\u8abf\u6574\uff09\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u30b5\u30f3\u30d7\u30eb\u69cb\u6210\u3068\u30b3\u30f3\u30d5\u30a3\u30b0\uff08\u62e0\u70b9A\uff1a192.168.1.0\/24 \u21d4 \u62e0\u70b9B\uff1a192.168.2.0\/24\uff09<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0b\u306f\u62e0\u70b9A\u5074\u306e\u4f8b\u3067\u3059\u3002ISAKMP\u306f3DES\/SHA\u3001\u4e8b\u524d\u5171\u6709\u9375\u3001DH2\u3001\u30e9\u30a4\u30d5\u30bf\u30a4\u30e012\u6642\u9593\u3002\u30d5\u30a7\u30fc\u30ba2\u306fESP-3DES + MD5\u3002DPD\u306f30\u79d2\u5468\u671f\u3067\u9001\u4fe1\u3057\u307e\u3059\u3002\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u5074\u306fPPPoE\u306eDialer1\u3001\u6697\u53f7\u30de\u30c3\u30d7\u306fDialer1\u3078\u9069\u7528\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>! === \u62e0\u70b9A\uff08R1\uff09 ===\ncrypto isakmp policy 1\n encr 3des\n hash sha\n authentication pre-share\n group 2\n lifetime 43200\n!\ncrypto isakmp key cisco address 200.1.1.1\ncrypto isakmp keepalive 30 periodic\n!\ncrypto ipsec transform-set IPSEC esp-3des esp-md5-hmac\n!\naccess-list 101 permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255\n!\ncrypto map M-ipsec 1 ipsec-isakmp\n set peer 200.1.1.1\n set transform-set IPSEC\n match address 101\n!\ninterface Loopback1\n ip address 100.1.1.1 255.255.255.255\n!\ninterface GigabitEthernet0\/0\n pppoe enable group global\n pppoe-client dial-pool-number 1\n no cdp enable\n!\ninterface GigabitEthernet0\/1\n ip address 192.168.1.254 255.255.255.0\n ip tcp adjust-mss 1356\n!\ninterface Dialer1\n ip unnumbered Loopback1\n ip access-group A-security in\n ip mtu 1454\n encapsulation ppp\n dialer pool 1\n dialer-group 1\n no cdp enable\n ppp authentication chap callin\n ppp chap hostname cisco@cisco.com\n ppp chap password cisco\n crypto map M-ipsec\n!\nip route 0.0.0.0 0.0.0.0 Dialer1\n!\nip access-list extended A-security\n permit esp host 200.1.1.1 host 100.1.1.1\n permit udp host 200.1.1.1 host 100.1.1.1 eq isakmp\n!\ndialer-list 1 protocol ip permit<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u62e0\u70b9B\u5074\u306f\u30a2\u30c9\u30ec\u30b9\u3068\u65b9\u5411\u3092\u5165\u308c\u66ff\u3048\u308b\u3060\u3051\u3067\u3059\u3002\u8a2d\u5b9a\u5024\u3092\u5de6\u53f3\u3067\u93e1\u5199\u3057\u306b\u3059\u308b\u3068\u899a\u3048\u3084\u3059\u304f\u3001\u7a81\u304d\u5408\u308f\u305b\u3082\u5bb9\u6613\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>! === \u62e0\u70b9B\uff08R2\uff09 ===\ncrypto isakmp policy 1\n encr 3des\n hash md5\n authentication pre-share\n group 2\n!\ncrypto isakmp key cisco address 100.1.1.1\ncrypto isakmp keepalive 30 periodic\n!\ncrypto ipsec transform-set IPSEC esp-3des esp-md5-hmac\n!\naccess-list 101 permit ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255\n!\ncrypto map M-ipsec 1 ipsec-isakmp\n set peer 100.1.1.1\n set transform-set IPSEC\n match address 101\n!\ninterface Loopback1\n ip address 200.1.1.1 255.255.255.255\n!\ninterface GigabitEthernet0\/0\n pppoe enable group global\n pppoe-client dial-pool-number 1\n no cdp enable\n!\ninterface GigabitEthernet0\/1\n ip address 192.168.2.254 255.255.255.0\n ip tcp adjust-mss 1356\n!\ninterface Dialer1\n ip unnumbered Loopback1\n ip access-group A-security in\n ip mtu 1454\n encapsulation ppp\n dialer pool 1\n dialer-group 1\n no cdp enable\n ppp authentication chap callin\n ppp chap hostname cisco@cisco.com\n ppp chap password cisco\n crypto map M-ipsec\n!\nip route 0.0.0.0 0.0.0.0 Dialer1\n!\nip access-list extended A-security\n permit esp host 100.1.1.1 host 200.1.1.1\n permit udp host 100.1.1.1 host 200.1.1.1 eq isakmp\n!\ndialer-list 1 protocol ip permit<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">PPPoE\u3067\u56fa\u5b9a\u30b0\u30ed\u30fc\u30d0\u30ebIP\u3092\u5951\u7d04\u3057\u3066\u3044\u308b\u306a\u3089\u3001Loopback\u3092\u4f7f\u308f\u305a<strong>ip address negotiated<\/strong>\u3067Dialer\u306b\u76f4\u63a5\u30a2\u30c9\u30ec\u30b9\u53d6\u5f97\u3055\u305b\u308b\u8a2d\u8a08\u3082\u53ef\u80fd\u3067\u3059\u3002\u5951\u7d04\u304c\u56fa\u5b9a\u578b\u3067\u3042\u308c\u3070\u4ed8\u4e0eIP\u306f\u6bce\u56de\u540c\u4e00\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u7aef\u672b\u3054\u3068\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u8868\u3067\u6574\u7406\u3059\u308b\uff08\u899a\u3048\u65b9\u306e\u30b3\u30c4\uff09<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>R1\uff08\u62e0\u70b9A\uff09 IKE Phase1<\/th><th>R1 IKE Phase2<\/th><\/tr><\/thead><tbody><tr><td>\u6697\u53f7: 3DES \/ \u30cf\u30c3\u30b7\u30e5: MD5 \/ \u8a8d\u8a3c: Pre-shared Key \/ DH: 2<\/td><td>\u30d7\u30ed\u30c8\u30b3\u30eb: ESP \/ \u6697\u53f7: 3DES \/ \u8a8d\u8a3c: MD5-HMAC<\/td><\/tr><tr><td>ISAKMP SA LT: 86400\u79d2 \/ DPD: 30<\/td><td>IPsec SA LT: 3600\u79d2 \/ \u30e2\u30fc\u30c9: \u30c8\u30f3\u30cd\u30eb<\/td><\/tr><tr><td>ISAKMP\u30d4\u30a2: 200.1.1.1 \/ PSK: cisco<\/td><td>IPsec\u30d4\u30a2: 200.1.1.1 \/ \u5bfe\u8c61: 192.168.1.0\/24 \u2192 192.168.2.0\/24<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>R2\uff08\u62e0\u70b9B\uff09 IKE Phase1<\/th><th>R2 IKE Phase2<\/th><\/tr><\/thead><tbody><tr><td>\u6697\u53f7: 3DES \/ \u30cf\u30c3\u30b7\u30e5: MD5 \/ \u8a8d\u8a3c: Pre-shared Key \/ DH: 2<\/td><td>\u30d7\u30ed\u30c8\u30b3\u30eb: ESP \/ \u6697\u53f7: 3DES \/ \u8a8d\u8a3c: MD5-HMAC<\/td><\/tr><tr><td>ISAKMP SA LT: 86400\u79d2 \/ DPD: 30<\/td><td>IPsec SA LT: 3600\u79d2 \/ \u30e2\u30fc\u30c9: \u30c8\u30f3\u30cd\u30eb<\/td><\/tr><tr><td>ISAKMP\u30d4\u30a2: 100.1.1.1 \/ PSK: cisco<\/td><td>IPsec\u30d4\u30a2: 100.1.1.1 \/ \u5bfe\u8c61: 192.168.2.0\/24 \u2192 192.168.1.0\/24<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">\u3053\u3053\u306f\u5fc5\u305a\u899a\u3048\u308b\uff1a<strong>\u30d5\u30a7\u30fc\u30ba1\u306e\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0\u3068\u30d5\u30a7\u30fc\u30ba2\u306e\u30e9\u30a4\u30d5\u30bf\u30a4\u30e0\u306f\u5225\u7269<\/strong>\u3067\u3059\u3002\u8a2d\u5b9a\u306e\u98df\u3044\u9055\u3044\u304c\u3042\u308b\u3068\u518d\u4ea4\u6e09\u304c\u30eb\u30fc\u30d7\u3057\u305f\u308a\u3001\u30c8\u30f3\u30cd\u30eb\u304c\u5b89\u5b9a\u3057\u306a\u304f\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u3064\u306a\u304c\u3089\u306a\u3044\u3068\u304d\u306e\u5207\u308a\u5206\u3051\u624b\u9806<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u307e\u305a\u306f\u300c\u30d5\u30a7\u30fc\u30ba1\u304c\u6210\u7acb\u3057\u3066\u3044\u308b\u304b\u300d\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002IKE\u304c\u4e0a\u304c\u3089\u306a\u3044\u9650\u308a\u3001\u30d5\u30a7\u30fc\u30ba2\u306f\u59cb\u307e\u308a\u307e\u305b\u3093\u3002CCNA\u3067\u306f\u51fa\u529b\u306e\u8aad\u307f\u53d6\u308a\u304c\u3088\u304f\u51fa\u308b\u305f\u3081\u3001\u8868\u793a\u8a9e\u53e5\u3068\u610f\u5473\u3092\u7d50\u3073\u3064\u3051\u3066\u899a\u3048\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>\u30d1\u30bf\u30fc\u30f3<\/th><th>\u753b\u9762\u306e\u898b\u3048\u65b9<\/th><th>\u4f55\u3092\u793a\u3059\u304b\uff0f\u5bfe\u51e6\u306e\u65b9\u5411\u6027<\/th><\/tr><\/thead><tbody><tr><td>\u2460 \u4f55\u3082\u8868\u793a\u3055\u308c\u306a\u3044<\/td><td><code>show crypto isakmp sa<\/code> \u306b\u4f55\u3082\u51fa\u306a\u3044<\/td><td>\u307e\u3060\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u672a\u767a\u751f\u304b\u30de\u30c3\u30c1\u3057\u3066\u3044\u306a\u3044\u53ef\u80fd\u6027\u3002\u5bfe\u8c61\u30b5\u30d6\u30cd\u30c3\u30c8\u9593\u3067Ping\u3092\u6253\u3061\u3001ACL\u3068\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3092\u518d\u78ba\u8a8d\u3002<\/td><\/tr><tr><td>\u2461 MM_NO_STATE<\/td><td>\u4ea4\u6e09\u958b\u59cb\u306b\u5931\u6557<\/td><td>PSK\u4e0d\u4e00\u81f4\u3084ISAKMP\u5230\u9054\u4e0d\u53ef\u304c\u5178\u578b\u3002\u4e21\u7aef\u306e<code>crypto isakmp key<\/code>\u3001\u5230\u9054\u7528ACL\u3001\u5fc5\u8981\u306a\u3089\u4e00\u6642\u7684\u306b\u30d5\u30a3\u30eb\u30bf\u89e3\u9664\u3082\u691c\u8a0e\u3002\u307e\u308c\u306b\u518d\u8d77\u52d5\u3067\u5fa9\u5e30\u3059\u308b\u4e8b\u4f8b\u3042\u308a\u3002<\/td><\/tr><tr><td>\u2462 QM_IDLE<\/td><td>\u30d5\u30a7\u30fc\u30ba1\u6210\u529f<\/td><td>\u6b21\u306f\u30d5\u30a7\u30fc\u30ba2\u306e\u78ba\u8a8d\u3078\u9032\u3080\u3002<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u30d5\u30a7\u30fc\u30ba2\u306f<code>show crypto ipsec sa<\/code>\u3067\u78ba\u8a8d\u3057\u307e\u3059\u3002ESP\u5229\u7528\u6642\u306f<strong>inbound\/outbound\u306eSAs<\/strong>\u306b\u81ea\u5206\u306e\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8\u304c\u53cd\u6620\u3055\u308c\u3001\u30d1\u30b1\u30c3\u30c8\u7d71\u8a08\u304c\u5897\u3048\u3066\u3044\u304f\u306e\u304c\u6b63\u5e38\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># pkts encaps: X, #pkts encrypt: X, #pkts digest: X\n# pkts decaps: X, #pkts decrypt: X, #pkts verify: X<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u52d5\u4f5c\u4e2d\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u6709\u7121\u306f<code>show crypto engine connections active<\/code>\u3067\u898b\u3089\u308c\u307e\u3059\u3002\u3053\u3053\u304c\u7a7a\u306a\u3089\u3001\u6697\u53f7\u51e6\u7406\u307e\u3067\u5230\u9054\u3057\u3066\u3044\u307e\u305b\u3093\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u73fe\u5834\u3067\u4f7f\u3046\u78ba\u8a8d\u30b3\u30de\u30f3\u30c9\u306e\u8981\u70b9<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>\u30b3\u30de\u30f3\u30c9<\/th><th>\u76ee\u7684<\/th><\/tr><\/thead><tbody><tr><td>show crypto isakmp policy<\/td><td>\u30d5\u30a7\u30fc\u30ba1\u30dd\u30ea\u30b7\u30fc\uff08\u6697\u53f7\u30fb\u30cf\u30c3\u30b7\u30e5\u30fb\u8a8d\u8a3c\u30fbDH\u306a\u3069\uff09<\/td><\/tr><tr><td>show crypto isakmp sa<\/td><td>\u30d5\u30a7\u30fc\u30ba1\u306e\u72b6\u614b\uff08MM_NO_STATE \/ QM_IDLE\u306a\u3069\uff09<\/td><\/tr><tr><td>show crypto ipsec transform-set<\/td><td>\u30d5\u30a7\u30fc\u30ba2\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u306e\u5b9a\u7fa9\u78ba\u8a8d<\/td><\/tr><tr><td>show crypto ipsec sa<\/td><td>\u30d5\u30a7\u30fc\u30ba2\u306eSA\u3068\u7d71\u8a08\u5024\uff08\u6697\u53f7\u5316\u30fb\u5fa9\u53f7\u306e\u5897\u5206\uff09<\/td><\/tr><tr><td>show crypto session detail<\/td><td>\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u8a73\u7d30\u72b6\u614b\u3068\u539f\u56e0\u5207\u308a\u5206\u3051\u6750\u6599<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">\u8a66\u9a13\u3067\u306f\u3001<strong>Aggressive\/Main\/Quick\u306e\u5bfe\u5fdc\u95a2\u4fc2<\/strong>\u3001<strong>DPD\u306e\u5f79\u5272<\/strong>\u3001\u6697\u53f7\u30de\u30c3\u30d7\u306b\u675f\u306d\u308b\u4e09\u8981\u7d20\uff08\u30d4\u30a2\u30fb\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30fbACL\uff09\u304c\u983b\u51fa\u3067\u3059\u3002\u8a2d\u5b9a\u5024\u306f\u7247\u5074\u3060\u3051\u898b\u3066\u6e80\u8db3\u305b\u305a\u3001<strong>\u5de6\u53f3\u5bfe\u79f0<\/strong>\u306b\u7a81\u304d\u5408\u308f\u305b\u308b\u7656\u3092\u3064\u3051\u308b\u3068\u30df\u30b9\u3092\u5927\u5e45\u306b\u6e1b\u3089\u305b\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">IPsec-VPN\u3068\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u63a5\u7d9a\u3092\u4e21\u7acb\u3055\u305b\u308b\u8003\u3048\u65b9<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u62e0\u70b9\u9593VPN\u3060\u3051\u3092\u69cb\u6210\u3057\u305f\u5834\u5408\u3001\u793e\u5185\u30b5\u30d6\u30cd\u30c3\u30c8\u540c\u58eb\u306e\u901a\u4fe1\u306f\u901a\u305b\u3066\u3082\u3001\u62e0\u70b9\u304b\u3089\u5916\u90e8\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u3078\u306f\u51fa\u3066\u3044\u3051\u307e\u305b\u3093\u3002\u3053\u308c\u3092\u540c\u6642\u306b\u5b9f\u73fe\u3059\u308b\u306b\u306f\u3001PPPoE\u3067\u5916\u90e8\u3078\u51fa\u308b\u7d4c\u8def\u3092\u7528\u610f\u3057\u3064\u3064\u3001LAN\u5074\u306e\u9001\u4fe1\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092NAT\u3067\u30b0\u30ed\u30fc\u30d0\u30eb\u5316\u3057\u3001VPN\u5411\u3051\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3060\u3051\u306fNAT\u304b\u3089\u9664\u5916\u3059\u308b\u3001\u3068\u3044\u3046\u9806\u5e8f\u3067\u5236\u5fa1\u3057\u307e\u3059\u3002\u3053\u3053\u3067\u91cd\u8981\u306a\u306e\u306f\u300cVPN\u5411\u3051\u306fNAT\u5bfe\u8c61\u5916\u300d\u300c\u305d\u308c\u4ee5\u5916\u306fNAT\u300d\u306e\u7dda\u5f15\u304d\u3067\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">NAT\u8a2d\u8a08\u306e\u8981\u70b9\uff08NAT\u9664\u5916\u2192\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u5b9b\u3066\u3092\u5909\u63db\uff09<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NAT\u306e\u30a2\u30af\u30bb\u30b9\u30ea\u30b9\u30c8\u3067\u306f\u3001\u307e\u305a\u6700\u521d\u306bVPN\u3067\u6697\u53f7\u5316\u3057\u305f\u3044\u901a\u4fe1\u3092deny\u3067\u9664\u5916\u3057\u3001\u305d\u306e\u5f8c\u308d\u3067permit any\u3092\u5b9a\u7fa9\u3057\u3066\u901a\u5e38\u306e\u5916\u5411\u304d\u901a\u4fe1\u3092\u5909\u63db\u3057\u307e\u3059\u3002ACL\u306f\u4e0a\u304b\u3089\u8a55\u4fa1\u3055\u308c\u308b\u305f\u3081\u3001\u3053\u306e\u4e26\u3073\u9806\u304c\u809d\u306b\u306a\u308a\u307e\u3059\u3002IPsec\u306e\u5bfe\u8c61ACL\u3068\u6df7\u540c\u3057\u3084\u3059\u3044\u306e\u3067\u540d\u79f0\u3068\u5f79\u5272\u3092\u306f\u3063\u304d\u308a\u5206\u3051\u3066\u304a\u304d\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>ACL\u540d\u306e\u4f8b<\/th><th>\u5f79\u5272<\/th><th>\u5178\u578b\u7684\u306a\u66f8\u304d\u65b9<\/th><\/tr><\/thead><tbody><tr><td>A-ipsec<\/td><td>IPsec\u3067\u6697\u53f7\u5316\u3059\u3079\u304d\u901a\u4fe1\u306e\u5b9a\u7fa9<\/td><td><code>permit ip 192.168.1.0\/24 192.168.2.0\/24<\/code><\/td><\/tr><tr><td>A-nat<\/td><td>NAT\u5909\u63db\u5bfe\u8c61\u306e\u5b9a\u7fa9\uff08\u5148\u982d\u3067VPN\u901a\u4fe1\u3092\u9664\u5916\uff09<\/td><td><code>deny ip 192.168.1.0\/24 192.168.2.0\/24<\/code> \u306e\u6b21\u306b <code>permit ip 192.168.1.0\/24 any<\/code><\/td><\/tr><tr><td>A-security<\/td><td>\u56de\u7dda\u5074\u306e\u4fdd\u8b77\u7528\uff08ISAKMP\u30fbESP\u3092\u901a\u3059\uff09<\/td><td><code>permit udp &lt;peer&gt; eq isakmp<\/code> \u3068 <code>permit esp<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">\u3053\u3053\u306f\u5fc5\u305a\u899a\u3048\u308b\uff1aNAT\u9664\u5916ACL\u306f<strong>deny\u3067VPN\u5411\u3051\u3092\u9664\u5916\u2192permit\u3067\u5916\u5411\u304d\u3092\u8a31\u53ef<\/strong>\u306e\u9806\u756a\u3002\u9806\u5e8f\u304c\u9006\u3060\u3068VPN\u304cNAT\u3055\u308c\u3066\u5931\u6557\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u306e\u5f79\u5272\u3068PPPoE\u7279\u6709\u306e\u6ce8\u610f\u70b9<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">LAN\u5074\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u306f<code>ip nat inside<\/code>\u3001\u56de\u7dda\u5074\uff08PPPoE\u306eDialer\uff09\u306f<code>ip nat outside<\/code>\u3067\u5f79\u5272\u3092\u660e\u78ba\u306b\u3057\u307e\u3059\u3002PPPoE\u306f\u30d8\u30c3\u30c0\u5206\u306e\u30aa\u30fc\u30d0\u30fc\u30d8\u30c3\u30c9\u304c\u3042\u308b\u305f\u3081\u3001\u56de\u7dda\u5074MTU\u306f\u5c0f\u3055\u304f\u306a\u308a\u3001LAN\u5074\u3067\u306f<code>ip tcp adjust-mss 1356<\/code>\u306e\u3088\u3046\u306bMSS\u3092\u8abf\u6574\u3057\u3066\u65ad\u7247\u5316\u3084\u901f\u5ea6\u4f4e\u4e0b\u3092\u907f\u3051\u307e\u3059\u3002\u30b0\u30ed\u30fc\u30d0\u30ebIP\u306e\u4ed8\u4e0e\u65b9\u6cd5\u304c2\u901a\u308a\u3042\u308a\u3001NAT\u306eoverload\u5148\u304c\u5909\u308f\u308b\u70b9\u3082\u8981\u78ba\u8a8d\u3067\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>\u30b0\u30ed\u30fc\u30d0\u30ebIP\u306e\u6301\u3061\u65b9<\/th><th>\u4ee3\u8868\u7684\u306a\u8a2d\u5b9a<\/th><th>NAT\u306eoverload\u6307\u5b9a\u5148<\/th><\/tr><\/thead><tbody><tr><td>Dialer\u3067\u52d5\u7684\u53d6\u5f97\uff08ip address negotiated\uff09<\/td><td><code>interface Dialer1<\/code> \u306b\u30a2\u30c9\u30ec\u30b9\u304c\u4ed8\u4e0e<\/td><td><code>ip nat inside source list A-nat interface Dialer1 overload<\/code><\/td><\/tr><tr><td>\u30eb\u30fc\u30d7\u30d0\u30c3\u30af\u3067\u56fa\u5b9aIP\u3092\u6301\u3064\uff08unnumbered\u3067Dialer\u306b\u8cb8\u4e0e\uff09<\/td><td><code>Loopback1<\/code>\u306b\u56fa\u5b9aIP\u3001<code>Dialer1 ip unnumbered Loopback1<\/code><\/td><td><code>ip nat inside source list A-nat interface Loopback1 overload<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">\u8a66\u9a13\u3067\u306f\u300cunnumbered\u6642\u306fLoopback\u3092overload\u5148\u306b\u3059\u308b\u300d\u70b9\u304c\u554f\u308f\u308c\u3084\u3059\u3044\u3067\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u5177\u4f53\u7684\u306a\u6d41\u308c\uff08\u8a2d\u5b9a\u306e\u8aad\u307f\u89e3\u304d\uff09<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u6700\u521d\u306bIKE\u30d5\u30a7\u30fc\u30ba1\u30fb2\uff08ISAKMP SA\u3068IPsec SA\uff09\u3092\u6574\u3048\u3001\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8\u30fb\u6697\u53f7\u30de\u30c3\u30d7\u30fb\u5bfe\u8c61ACL\u3092\u7528\u610f\u3057\u3066Dialer\u306b<code>crypto map<\/code>\u3092\u9069\u7528\u3057\u307e\u3059\u3002\u7d9a\u3044\u3066NAT\u306eACL\u3092\u4f5c\u308a\u3001<code>ip nat inside source<\/code>\u3067overload\u3092\u5b9a\u7fa9\u3002\u6700\u5f8c\u306b\u56de\u7dda\u5074\u3078\u30c7\u30d5\u30a9\u30eb\u30c8\u30eb\u30fc\u30c8\u3092\u5411\u3051\u308c\u3070\u3001VPN\u3068\u4e00\u822c\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306e\u4e21\u65b9\u304c\u6a5f\u80fd\u3057\u307e\u3059\u3002\u3053\u3053\u307e\u3067\u3067\u300cVPN\u306fNAT\u9664\u5916\u300d\u300c\u5916\u5411\u304d\u306fNAT\u300d\u3068\u3044\u3046\u5206\u5c90\u304c\u5b8c\u6210\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u4ee3\u8868\u30b9\u30cb\u30da\u30c3\u30c8\uff08\u8003\u3048\u65b9\u304c\u63b4\u3081\u308b\u6700\u5c0f\u69cb\u6210\uff09<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>! VPN\u3067\u7528\u3044\u308bISAKMP\/IKE\ncrypto isakmp policy 1\n encr 3des\n hash md5\n authentication pre-share\n group 2\n!\ncrypto isakmp key cisco address 200.1.1.1\ncrypto isakmp keepalive 30 periodic\n\n! \u30d5\u30a7\u30fc\u30ba2\uff08ESP 3DES+MD5 \u4f8b\uff09\ncrypto ipsec transform-set IPSEC esp-3des esp-md5-hmac\n\n! VPN\u5bfe\u8c61\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\uff08\u62e0\u70b9\u9593\uff09\nip access-list extended A-ipsec\n permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255\n\n! NAT\u9664\u5916\u2192\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u5b9b\u3066\u3060\u3051\u5909\u63db\nip access-list extended A-nat\n deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255\n permit ip 192.168.1.0 0.0.0.255 any\n\n! \u56de\u7dda\u5074\u4fdd\u8b77\uff08ISAKMP\/ESP\u306e\u307f\u7a74\u3042\u3051\uff09\nip access-list extended A-security\n permit esp host 200.1.1.1 host 100.1.1.1\n permit udp host 200.1.1.1 host 100.1.1.1 eq isakmp\n\n! \u6697\u53f7\u30de\u30c3\u30d7\u306b\u30d4\u30a2\u30fb\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30fb\u5bfe\u8c61ACL\u3092\u675f\u306d\u308b\ncrypto map M-ipsec 1 ipsec-isakmp\n set peer 200.1.1.1\n set transform-set IPSEC\n match address A-ipsec\n\n! \u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\ninterface GigabitEthernet0\/1\n ip address 192.168.1.254 255.255.255.0\n ip nat inside\n ip tcp adjust-mss 1356\n\ninterface Dialer1\n ip unnumbered Loopback1\n ip access-group A-security in\n ip mtu 1454\n ip nat outside\n encapsulation ppp\n dialer pool 1\n ppp authentication chap callin\n ppp chap hostname cisco@cisco.com\n ppp chap password cisco\n crypto map M-ipsec\n\n! \u7d4c\u8def\u3068NAT\u306e\u3072\u3082\u4ed8\u3051\nip route 0.0.0.0 0.0.0.0 Dialer1\nip nat inside source list A-nat interface Loopback1 overload<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u306e\u4f8b\u3067\u306fLoopback\u306b\u56fa\u5b9a\u30b0\u30ed\u30fc\u30d0\u30eb\u3092\u6301\u3064\u60f3\u5b9a\u3067\u3059\u3002Dialer\u3067\u52d5\u7684\u53d6\u5f97\u306b\u5207\u308a\u66ff\u3048\u308b\u5834\u5408\u306f\u3001NAT\u306eoverload\u5148\u3060\u3051<code>interface Dialer1<\/code>\u3078\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u30b9\u30c6\u30fc\u30c8\u30d5\u30eb\u691c\u67fb\uff08CBAC\uff09\u3067\u56de\u7dda\u5074ACL\u306e\u7a74\u3042\u3051\u3092\u7c21\u7d20\u5316<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u56de\u7dda\u5074\u306b\u7d30\u304b\u306a\u7a74\u3042\u3051ACL\u3092\u624b\u4f5c\u696d\u3067\u4f5c\u308b\u306e\u306f\u73fe\u5b9f\u7684\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<strong><span class=\"swl-marker mark_yellow\">CBAC\uff08Context-Based Access Control\uff09<\/span><\/strong>\u3092\u6709\u52b9\u5316\u3059\u308c\u3070\u3001\u5185\u90e8\u304b\u3089\u958b\u59cb\u3057\u305f\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u5bfe\u3057\u3066\u623b\u308a\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u81ea\u52d5\u3067\u8a31\u53ef\u3067\u304d\u3001\u8a2d\u5b9a\u304c\u5927\u5e45\u306b\u697d\u306b\u306a\u308a\u307e\u3059\u3002\u3084\u308b\u3053\u3068\u306f\u300c\u691c\u67fb\u3057\u305f\u3044\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u6307\u5b9a\u300d\u3057\u3001\u300cLAN\u5074\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u306b\u30a4\u30f3\u30b9\u30da\u30af\u30b7\u30e7\u30f3\u3092\u9069\u7528\u300d\u3059\u308b\u3060\u3051\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip inspect name CBAC tcp\nip inspect name CBAC udp\nip inspect name CBAC ftp\n\ninterface GigabitEthernet0\/1\n ip inspect CBAC in<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">CBAC\u3092LAN\u5074in\u3067\u639b\u3051\u3066\u3082\u3001\u56de\u7dda\u5074out\u3067\u639b\u3051\u3066\u3082\u52b9\u679c\u306f\u540c\u3058\u3067\u3059\u3002\u69cb\u6210\u8cc7\u6599\u3067\u306fout\u9069\u7528\u306e\u4f8b\u3082\u591a\u304f\u898b\u304b\u3051\u307e\u3059\u3002\u73fe\u5834\u3067\u306f\u3001\u3088\u308a\u65b0\u3057\u3044\u6a5f\u80fd\u3068\u3057\u3066\u30be\u30fc\u30f3\u30d9\u30fc\u30b9\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\uff08ZBFW\uff09\u304c\u4f7f\u308f\u308c\u308b\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u304c\u3001CCNA\u5bfe\u7b56\u3067\u306fCBAC\u306e\u57fa\u672c\u52d5\u4f5c\u3092\u62bc\u3055\u3048\u3066\u304a\u3051\u3070\u5341\u5206\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">\u3064\u307e\u305a\u304d\u3084\u3059\u3044\u30dd\u30a4\u30f3\u30c8\u3068\u78ba\u8a8d\u89b3\u70b9<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">VPN\u304c\u4e0a\u304c\u3063\u3066\u3082\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u3078\u51fa\u3089\u308c\u306a\u3044\u5834\u5408\u3001NAT\u9664\u5916ACL\u306e\u9806\u756a\u30df\u30b9\u3084<code>ip nat inside\/outside<\/code>\u306e\u4ed8\u3051\u5fd8\u308c\u304c\u5178\u578b\u3067\u3059\u3002<code>show crypto isakmp sa<\/code>\u3067\u30d5\u30a7\u30fc\u30ba1\uff08MM_NO_STATE\u3084QM_IDLE\uff09\u3001<code>show crypto ipsec sa<\/code>\u3067\u30d5\u30a7\u30fc\u30ba2\uff08\u30c8\u30f3\u30cd\u30eb\u306e\u5165\u51fa\u529b\u7d71\u8a08\uff09\u3092\u78ba\u8a8d\u3057\u3001NAT\u5468\u308a\u306f<code>show ip nat translations<\/code>\u3084<code>show run | sec nat<\/code>\u3067\u5b9f\u4f53\u3092\u7167\u5408\u3057\u307e\u3059\u3002PPPoE\u3067\u306fMTU\/MSS\u8abf\u6574\u304c\u4e0d\u8db3\u3059\u308b\u3068\u3001\u7279\u5b9a\u30b5\u30a4\u30c8\u3060\u3051\u7e4b\u304c\u3089\u306a\u3044\u3068\u3044\u3063\u305f\u4e8b\u8c61\u304c\u51fa\u3084\u3059\u3044\u305f\u3081\u3001<code>ip mtu<\/code>\u3068<code>ip tcp adjust-mss<\/code>\u306e\u5024\u306b\u3082\u76ee\u3092\u5411\u3051\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">\u8a66\u9a13\u3067\u72d9\u308f\u308c\u3084\u3059\u3044\u8981\u70b9<\/h4>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\">VPN\u5411\u3051\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f<strong>\u6697\u53f7\u5316ACL\uff08A-ipsec\uff09\u3067\u5b9a\u7fa9\u3057\u3001NAT\u306fNAT ACL\uff08A-nat\uff09\u3067\u5236\u5fa1\u3059\u308b\u306a\u3069\u3001\u5f79\u5272\u304c\u9055\u3046ACL\u3092\u6df7\u540c\u3057\u306a\u3044\u3053\u3068\u3002<code>crypto map<\/code>\u306f\u30d4\u30a2\u30fb\u30c8\u30e9\u30f3\u30b9\u30d5\u30a9\u30fc\u30e0\u30bb\u30c3\u30c8\u30fb\u5bfe\u8c61ACL<\/strong>\u306e\u4e09\u70b9\u30bb\u30c3\u30c8\u3067\u3042\u308b\u3053\u3068\u3002PPPoE\u74b0\u5883\u3067\u306f<strong>MTU\/MSS\u8abf\u6574<\/strong>\u304c\u5fc5\u8981\u306a\u3053\u3068\u3002CBAC\u3092\u4f7f\u3048\u3070<strong>\u623b\u308a\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30b9\u30c6\u30fc\u30c8\u30d5\u30eb\u306b\u8a31\u53ef<\/strong>\u3067\u304d\u3001\u56de\u7dda\u5074ACL\u3092\u6700\u5c0f\u9650\u306b\u3067\u304d\u308b\u3053\u3068\u3002\u3053\u308c\u3089\u306f\u5b9f\u52d9\u3067\u3082CCNA\u3067\u3082\u983b\u51fa\u3067\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u25c6\u307e\u3068\u3081\u30b9\u30e9\u30a4\u30c9<\/h2>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/ccna-curriculum.tech-village.co.jp\/wp-content\/uploads\/2025\/06\/IPsec-VPN\uff08\u57fa\u672c\u69cb\u7bc9\uff09.pdf\" type=\"application\/pdf\" style=\"width:100%;height:600px\" aria-label=\"IPsec-VPN\uff08\u57fa\u672c\u69cb\u7bc9\uff09\u306e\u57cb\u3081\u8fbc\u307f\u3002\"><\/object><a id=\"wp-block-file--media-d84f0820-5403-4e14-8b09-21e84b027fb2\" href=\"https:\/\/ccna-curriculum.tech-village.co.jp\/wp-content\/uploads\/2025\/06\/IPsec-VPN\uff08\u57fa\u672c\u69cb\u7bc9\uff09.pdf\">IPsec-VPN\uff08\u57fa\u672c\u69cb\u7bc9\uff09<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>IPsec\u306e\u8a2d\u5b9a\uff08IKE\u30d5\u30a7\u30fc\u30ba1\u306e\u8a2d\u5b9a\uff09 IPsec\u306b\u3088\u308b\u901a\u4fe1\u3092\u958b\u59cb\u3059\u308b\u306b\u306f\u3001\u6700\u521d\u306bISAKMP SA\u3092\u751f\u6210\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u305d\u306e\u305f\u3081\u306b\u306fIKE\u30d5\u30a7\u30fc\u30ba1\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5b9a\u7fa9\u3057\u3001\u76f8\u624b\u6a5f\u5668\u3068\u4e00\u81f4\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3092\u884c\u3044\u307e\u3059\u3002 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"swell_btn_cv_data":"","footnotes":""},"categories":[15],"tags":[],"class_list":["post-336","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=\/wp\/v2\/posts\/336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=336"}],"version-history":[{"count":4,"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=\/wp\/v2\/posts\/336\/revisions"}],"predecessor-version":[{"id":831,"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=\/wp\/v2\/posts\/336\/revisions\/831"}],"wp:attachment":[{"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ccna-curriculum.tech-village.co.jp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}