cisco路由器IPSEC VPN配置(隧道模式)

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

拓扑如下：

R1配置hostname R1
enable password cisco
crypto isakmp policy 1        #创建IKE协商策略，编号为1
encr 3des                       #加密算法伟3des
authentication pre-share   #使用预共享秘钥
group 2                          #使用D-H组2
crypto isakmp key cisco address 61.67.1.1      #设置共享秘钥和peer地址
crypto ipsec security-association lifetime seconds 86400 #设置sa生存时间
crypto ipsec transform-set vpn-set ah-sha-hmac esp-des #设置加密映射
crypto map mymap 1 ipsec-isakmp
crypto map tobeijing 1 ipsec-isakmp
set peer 61.67.1.1
set transform-set vpn-set
match address 100
interface Loopback10
ip address 192.168.1.1 255.255.255.255
interface Ethernet0/0
ip address 202.112.1.1 255.255.255.0
crypto map tobeijing                          #将映射应用到接口
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 202.112.1.2
access-list 100 permit ip host 192.168.1.1 host 172.16.1.1   #定义感兴趣的数据流
line con 0
logging synchronous
line aux 0
line vty 0 4
password cisco
login
transport input all

R2配置：hostname R2
enable password cisco
interface Ethernet0/0
ip address 202.112.1.2 255.255.255.0
interface Ethernet0/1
ip address 61.67.1.2 255.255.255.0
line con 0
logging synchronous
line aux 0
line vty 0 4
password cisco
login
transport input all
R3配置：hostname R3
enable password cisco
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco address 202.112.1.1
crypto ipsec security-association lifetime seconds 86400
crypto ipsec transform-set vpn-set ah-sha-hmac esp-des
crypto map mymap 1 ipsec-isakmp
set peer 202.112.1.1
set transform-set vpn-set
match address 100
interface Loopback10
ip address 172.16.1.1 255.255.255.255
interface Ethernet0/0
ip address 61.67.1.1 255.255.255.0
crypto map mymap
ip route 0.0.0.0 0.0.0.0 202.112.1.1
ip route 0.0.0.0 0.0.0.0 61.67.1.2
access-list 100 permit ip host 172.16.1.1 host 192.168.1.1
logging synchronous
line aux 0
line vty 0 4
password cisco
login
transport input all
测试结果如下：