【直接使用ipsecvpn互通】在預(yù)配公網(wǎng)互通前提下
R2
conf t
crypto isakmp policy 10 //策略優(yōu)先級 越小越先匹配
encryption aes //非對稱式加密算法 不同設(shè)備支持不同
hash md5 //哈希加密算法 默認是sha 在show run中不顯示
authentication pre-share //認證模式選擇預(yù)共享秘鑰
group 5 //DH值 長度 一般ios都支持1 2 5
lifetime 3600 //密鑰有效期
exit
crypto isakmp key 6 CCIE address 13.1.1.3
//配置本地秘鑰安全級別為6 --預(yù)共享秘鑰所以需要配一個密碼
//如果開啟了GRE ，并且傳輸模式選擇了transport奇唤，address要寫對端tunnel地址
//第一階段的1-6個報文已經(jīng)配置完畢
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
//匹配感興趣流
crypto ipsec transform-set MYSET esp-aes esp-md5-hmac //封裝協(xié)議
mode tunnel //封裝tunnel 直接在互聯(lián)網(wǎng)上傳輸
//如果開啟了GRE 模式可以選擇transport
exit
crypto map MYMAP 10 ipsec-isakmp //創(chuàng)建一個map關(guān)聯(lián)上面的配置
set peer 13.1.1.3
set transform-set MYSET
match address 101
exit
int e0/1 //接口下調(diào)用
crypto map MYMAP
end
wr
R3
conf t
crypto isakmp policy 10
encryption aes
hash md5
authentication pre-share
group 5
lifetime 3600
exit
crypto isakmp key 6 CCIE address 12.1.1.2
access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
crypto ipsec transform-set MYSET esp-aes esp-md5-hmac
mode tunnel
exit
crypto map MYMAP 10 ipsec-isakmp
set peer 12.1.1.2
set transform-set MYSET
match address 101
exit
int e0/2
crypto map MYMAP
end
wr
//show crypto isakmp sa 第一階段主要是交換秘鑰 （sa安全關(guān)聯(lián)）
state：QM_IDLE QM快速模式 意思是第二段已經(jīng)開始了 第一階段成功了
conn-id status：1002 active (1002代表區(qū)分不同隧道 active代表正常狀態(tài))
//show cry ipsec sa 查看第二階段的信息
【GREvpn + IPsec 加密】在預(yù)配公網(wǎng)互通前提下
R2
conf t
int tunnel 0
tunnel source e0/1
tunnel destination 13.1.1.3
ip add 10.1.1.2 255.255.255.0
exit
//在GRE上加一個動態(tài)路由保證兩個私網(wǎng)互通甘改，直接用靜態(tài)路由指向tunnel也可以摄杂，都行佛南。
router eigrp 23
network 192.168.1.0
network 10.0.0.0
exit
crypto isakmp policy 10
encryption aes
hash md5
authentication pre-share
group 5
lifetime 3600
exit
crypto isakmp key 6 CCIE address 13.1.1.3 //應(yīng)該是tunnel ip但是通宣脉，就用對端公網(wǎng)ip就通了
crypto ipsec transform-set MYSET esp-aes esp-md5-hmac
mode transport
exit
crypto ipsec profile MYPROFILE
set transform-set MYSET
int tun0
tunnel protection ipsec profile MYPROFILE
end
wr
R3
conf t
int tunnel 0
tunnel source e0/2
tunnel destination 12.1.1.2
ip add 10.1.1.3 255.255.255.0
exit
//在GRE上加一個動態(tài)路由保證兩個私網(wǎng)互通鳞青，直接用靜態(tài)路由指向tunnel也可以骤菠，都行瞄沙。
router eigrp 23
network 192.168.1.0
network 10.0.0.0
exit
crypto isakmp policy 10
encryption aes
hash md5
authentication pre-share
group 5
lifetime 3600
exit
crypto isakmp key 6 CCIE address 12.1.1.2 //應(yīng)該是tunnel ip但是通己沛，就用對端公網(wǎng)ip就通了
crypto ipsec transform-set MYSET esp-aes esp-md5-hmac
mode transport
exit
crypto ipsec profile MYPROFILE
set transform-set MYSET
int tun0
tunnel protection ipsec profile MYPROFILE
end
wr
(預(yù)配)
R2
conf t
int e0/0
ip add 192.168.1.254 255.255.255.0
no shut
int e0/1
ip add 12.1.1.2 255.255.255.0
no shut
exit
ip route 0.0.0.0 0.0.0.0 12.1.1.1
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 permit ip any any
ip nat inside source list 100 interface Ethernet0/1 overload
int e0/0
ip nat inside
int e0/1
ip nat outside
end
wr
R3
conf t
int e0/0
ip add 192.168.2.254 255.255.255.0
no shut
int e0/2
ip add 13.1.1.3 255.255.255.0
no shut
exit
ip route 0.0.0.0 0.0.0.0 13.1.1.1
access-list 100 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 100 permit ip any any
ip nat inside source list 100 interface Ethernet0/2 overload
int e0/0
ip nat inside
int e0/2
ip nat outside
end
wr
R1
conf t
int e0/1
ip add 12.1.1.1 255.255.255.0
no shut
int e0/2
ip add 13.1.1.1 255.255.255.0
no shut
end
wr
? R4
conf t
no ip routing
ip default-gateway 192.168.1.254
int e0/0
ip add 192.168.1.4 255.255.255.0
no shut
end
wr
R5
conf t
no ip routing
ip default-gateway 192.168.2.254
int e0/0
ip add 192.168.2.5 255.255.255.0
no shut
end
wr
