一，Site1路由器IPsec tunnel配置：
ip address 1.1.1.1 255.255.255.0 ! interface Tunnel0 ip address 172.16.1.1 255.255.255.0 tunnel source 202.100.1.1 tunnel destination 61.128.1.1 tunnel protection ipsec profile To_site2_ipsec //安全策略应用到TUNNEL接口。TUNNEL定义了感兴趣流。 ! interface FastEthernet0/0 ip address 202.100.1.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet1/0 no ip address shutdown duplex auto speed auto ! interface FastEthernet2/0 no ip address shutdown duplex auto speed auto ! interface FastEthernet3/0 no ip address shutdown duplex auto speed auto ! router ospf 1 log-adjacency-changes network 1.1.1.0 0.0.0.255 area 0 network 172.16.1.0 0.0.0.255 area 0 ! no ip http server no ip http secure-server ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 202.100.1.10 ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! end Site1#
二，Site2 IPSEC 配置： ! shutdown duplex auto speed auto ! interface FastEthernet3/0 no ip address shutdown duplex auto speed auto ! router ospf 1 log-adjacency-changes network 2.2.2.0 0.0.0.255 area 0 network 172.16.1.0 0.0.0.255 area 0 ! no ip http server no ip http secure-server ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 61.128.1.10 ! ! ! ip access-list extended vpn permit gre host 61.128.1.1 host 202.100.1.1 //定义感兴趣流 ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! end Site2#
三，VPN 测试： Site1#ping 2.2.2.2 so 1.1.1.1 Type escape sequence to abort. Site1#
四，VPN状态查看：
1，Site1： Site1#show crypto engi connec ac ID Interface IP-Address State Algorithm Encrypt Decrypt 2001 Tunnel0 202.100.1.1 set DES 234 0 2002 Tunnel0 202.100.1.1 set DES 0 233 Site1#show crypto isakmp sa 61.128.1.1 202.100.1.1 QM_IDLE 1 0 ACTIVE Site1#show crypto ipsec sa interface: Tunnel0 protected vrf: (none) current_peer 61.128.1.1 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 236, #pkts encrypt: 236, #pkts digest: 236 #pkts decaps: 235, #pkts decrypt: 235, #pkts verify: 235 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 202.100.1.1, remote crypto endpt.: 61.128.1.1 inbound esp sas: conn id: 2002, flow_id: SW:2, crypto map: Tunnel0-head-0 sa timing: remaining key lifetime (k/sec): (4428651/1493) IV size: 8 bytes replay detection support: N Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas:
2，Site2：
ID Interface IP-Address State Algorithm Encrypt Decrypt 2001 FastEthernet1/0 61.128.1.1 set DES 242 0 2002 FastEthernet1/0 61.128.1.1 set DES 0 243 Site2#show crypto isakmp sa Site2#show crypto ipsec sa interface: FastEthernet1/0 protected vrf: (none) PERMIT, flags={origin_is_acl,} #pkts encaps: 414, #pkts encrypt: 414, #pkts digest: 414 #pkts decaps: 415, #pkts decrypt: 415, #pkts verify: 415 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 16, #recv errors 0 local crypto endpt.: 61.128.1.1, remote crypto endpt.: 202.100.1.1 inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: conn id: 2001, flow_id: SW:1, crypto map: cisco sa timing: remaining key lifetime (k/sec): (4472960/1404) IV size: 8 bytes replay detection support: N Status: ACTIVE outbound ah sas: outbound pcp sas: |
不良信息举报Q:2000617|Archiver|ROS软路由论坛 ROSABC.com 网络方案网络工程交流
GMT+8, 2024-5-15 18:57 , Processed in 0.322108 second(s), 15 queries .
Powered by Discuz! X3.4
Copyright © 2001-2021, Tencent Cloud.
