IPSec*pn配置实验,实现两子公司网络通信
(啧啧啧,*pn 字眼被屏蔽,发不出来)
实验任务:
任务1 网络基础配置
将路由器R4、R5配置成主机使用,关闭路由功能(no ip routing),配置网关(ip default-gateway)。在路由器R2上配置静态默认路由,下一跳指向R1,在R3上配置静态默认路由,下一跳指向R1。此时R4与R5之间网络应该不通。但R2到R3的s1/1(202.2.2.2)ping通,R3到R2的s1/0(202.1.1.1)ping通。
任务2 在R2和R3上配置IPSec *PN,使192.168.1.0与192.168.2.0两个网络的流量走 *PN,实现192.168.1.0与192.168.2.0两个网络的互通互连。
实验拓扑:
任务一:
R4配置:
R5配置:
R3配置:
R2配置:
R1配置:
此时,R4到R5不通:
R2到R3的s1/1(202.2.2.2)通:
R3到R2的s1/0(202.1.1.1)通:
任务二:
R2配置:(主要命令如下:)
R2
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key 密码1 address 202.100.1.2
crypto ipsec transform-set (命名1) esp-3des esp-sha-hmac
mode tunnel
crypto ipsec profile (profile命名2)
set transform-set (命名1)
exit
interface tunnel 0
tunnel source 61.128.1.1
tunnel destination 202.100.1.2
tunnel mode ipsec ipv4
tunnel protection ipsec profile (profile命名2)
router ospf 1
network 172.16.100.0 0.0.0.255 area 0
network 172.16.1.0 0.0.0.255 area 0
R3配置:(主要命令如下:)
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key 密码1 address 61.128.1.1
crypto ipsec transform-set (命名1) esp-3des esp-sha-hmac
mode tunnel
crypto ipsec profile (profile命名2)
set transform-set (命名1)
exit
interface tunnel 0
tunnel source 202.100.1.2
tunnel destination 61.128.1.1
tunnel mode ipsec ipv4
tunnel protection ipsec profile (profile命名2)
router ospf 1
network 172.16.100.0 0.0.0.255 area 0
network 10.1.1.0 0.0.0.255 area 0
实现192.168.1.0与192.168.2.0互通测试:
实验完成,成功实现两子网互通!