原理图
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/aa99b5af0aaf12d8405d5c52f09b517c.png)
以 r1为例 r3的配置和r1一样
第一阶段
配置ike sa的安全协议
[r1]ike proposal 1
[r1-ike-proposal-1]encryption-algorithm aes-cbc-128
[r1-ike-proposal-1]authentication-method pre-share
[r1-ike-proposal-1]authentication-algorithm md5
[r1-ike-proposal-1]dh group2
[r1-ike-proposal-1]sa duration 3600
[r1-ike-proposal-1]q
配置ike sa的认证信息
[r1]ike peer aaa v1
[r1-ike-peer-aaa]exchange-mode main
[r1-ike-peer-aaa]pre-shared-key cipher 1234
[r1-ike-peer-aaa]ike-proposal 1
[r1-ike-peer-aaa]remote-address 200.1.1.1
[r1-ike-peer-aaa]q
配置感兴趣流
[r1]acl 3000
[r1-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 de
[r1-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
第二阶段
配置ipsec的提议安全参数
[r1]ipsec proposal aaa
[r1-ipsec-proposal-aaa]esp authentication-algorithm sha1
[r1-ipsec-proposal-aaa]esp encryption-algorithm 3des
[r1-ipsec-proposal-aaa]encapsulation-mode tunnel
[r1-ipsec-proposal-aaa]q
配置安全策略
[r1]ipsec policy aaa 1 isakmp
[r1-ipsec-policy-isakmp-aaa-1]security acl 3000
[r1-ipsec-policy-isakmp-aaa-1]ike-peer aaa
[r1-ipsec-policy-isakmp-aaa-1]proposal aaa
[r1-ipsec-policy-isakmp-aaa-1]q
在接口释放安全策略
[r1]int g0/0/1
[r1-GigabitEthernet0/0/1]ipsec policy aaa
[r1-GigabitEthernet0/0/1]
测试
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/62c7e58b6ae449b5282a64082db96bde.png)