vpn配置

2007-07-01 10:54:21

　标签：网络路由　　　[推送到技术圈]

L0 1.1.1.1

S0/0 2.1.1.1

S0/0 2.1.1.2

L0 3.1.1.1

Route A

Route B

L0 1.1.1.1

S0/0 2.1.1.1

S0/0 2.1.1.2

L0 3.1.1.1

Route A

Route B

L0 1.1.1.1

S0/0 2.1.1.1

S0/0 2.1.1.2

L0 3.1.1.1

Route A

Route B

L0 1.1.1.1

S0/0 2.1.1.1

S0/0 2.1.1.2

L0 3.1.1.1

Route A

Route B

2007-07-01

配置文档：

Ip地址

RouteA(config)#interface loopback 0

RouteA(config-if)#ip address 1.1.1.1 255.255.255.0

RouteA(config-if)#no shutdown

RouteA(config)#interface serial 0/0

RouteA(config-if)#ip address 2.1.1.1 255.255.255.0

RouteA(config-if)#no shutdown

Ike协商

RouteA(config)#crypto isakmp enable

RouteA(config)#ip route 0.0.0.0 0.0.0.0 2.1.1.2

RouteA(config)#crypto isakmp policy 1

RouteA(config-isakmap) #hash md5

RouteA(config-isakmap)#authentication pre-share

RouteA(config)#crypto isakmap key 123 address 2.1.1.2

Ipsec协商

RouteA(config)#crypto ipsec transform-set 1234 ah-md5-hmac esp-des

RouteA(config)#access-list 101 permit 1.1.1.0 0.0.0.255 3.1.1.0 0.0.0.255

RouteA(config)#crypto map 123map 1 ipsec-isakmp

RouteA(config-crypto-map)#set peer 2.1.1.2

RouteA(config-crypto-map)#set transform-set 1234

RouteA(config-crypto-map)#match address 101

应用到端口

RouteA(config)#interface serial 0/0

RouteA(config-if)#crypto map 123map

Ip地址

RouteB(config)#interface loopback 0

RouteB(config-if)#ip address 3.1.1.1 255.255.255.0

RouteB(config-if)#no shutdown

RouteB(config)#interface serial 0/0

RouteB(config-if)#ip address 2.1.1.2 255.255.255.0

RouteB(config-if)#no shutdown

Ike协商

RouteB(config)#crypto isakmp enable

RouteB(config)#ip route 0.0.0.0 0.0.0.0 2.1.1.1

RouteB(config)#crypto isakmp policy 1

RouteB(config-isakmap) #hash md5

RouteB(config-isakmap)#authentication pre-share

RouteB(config)#crypto isakmap key 123 address 2.1.1.1

Ipsec协商

RouteB(config)#crypto ipsec transform-set 1234 ah-md5-hmac esp-des

RouteB(config)#access-list 101 permit 3.1.1.0 0.0.0.255 1.1.1.0 0.0.0.255

RouteB(config)#crypto map 123map 1 ipsec-isakmp

RouteB(config-crypto-map)#set peer 2.1.1.1

RouteB(config-crypto-map)#set transform-set 1234

RouteB(config-crypto-map)#match address 101

应用到端口

RouteB(config)#interface serial 0/0

RouteB(config-if)#crypto map 123map

查看验证

Show crypto isakmp policy

Show crypto ipsec transform-set

Show crypto ipsec sa

Show crypto map

RouteB#show crypto isakmp policy

Global IKE policy

Protection suite of priority 1

encryption algorithm: DES - Data Encryption Standard (56 bit keys).

hash algorithm: Message Digest 5

authentication method: Pre-Shared Key

Diffie-Hellman group: #1 (768 bit)

lifetime: 86400 seconds, no volume limit

Default protection suite

encryption algorithm: DES - Data Encryption Standard (56 bit keys).

hash algorithm: Secure Hash Standard

authentication method: Rivest-Shamir-Adleman Signature

Diffie-Hellman group: #1 (768 bit)

lifetime: 86400 seconds, no volume limit

RouteB#show crypto ipsec transform-set

Transform set 1234: { ah-md5-hmac }

will negotiate = { Tunnel, },

{ esp-des }

will negotiate = { Tunnel, },

RouteB#show crypto ipsec sa

interface: Serial0/0

Crypto map tag: 123map, local addr. 2.1.1.2

protected vrf:

local ident (addr/mask/prot/port): (3.1.1.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)

current_peer: 2.1.1.1:500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 0, #recv errors 0

local crypto endpt.: 2.1.1.2, remote crypto endpt.: 2.1.1.1

path mtu 1500, media mtu 1500

current outbound spi: 0

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:

RouteB#show crypto map

Crypto Map "123map" 1 ipsec-isakmp

Peer = 2.1.1.1

Extended IP access list 101

access-list 101 permit ip 3.1.1.0 0.0.0.255 1.1.1.0 0.0.0.255

Current peer: 2.1.1.1

Security association lifetime: 4608000 kilobytes/3600 seconds

PFS (Y/N): N

Transform sets={

1234,

}

Interfaces using crypto map 123map:

Serial0/0

RouteB#ping 2.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 200/224/284 ms

RouteB#ping 1.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 140/200/284 ms

本文出自 “无极” 博客，请务必保留此出处http://fujiammin.blog.51cto.com/137864/32564

昵称：
验证码：		点击图片可刷新验证码　　博客过2级，无需填写验证码
内容：