建立如上图所示拓扑图,下面是相关的操作
hostname r1
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
!
crypto isakmp key cisco address 10.1.1.2
!
!
crypto ipsec transform-set mytrans esp-3des
!
crypto map mymap 1 ipsec-isakmp
set peer 10.1.1.2
set transform-set mytrans
match address 111
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.0
ip nat outside
duplex auto
speed auto
crypto map mymap
!
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
router rip
network 10.0.0.0
network 192.168.1.0
!
ip nat pool mynat 10.1.1.1 10.1.1.1 netmask 255.255.255.255
ip nat inside source list 112 pool mynat overload
ip classless
ip route 192.168.2.0 255.255.255.0 10.1.1.2
!
!
access-list 111 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 112 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 112 permit ip 192.168.1.0 0.0.0.255 any
由于在此路由器中配置了NAT转换,故 在此要进行隧道分离,不然无法正常进行***连接,在NAT转换中拒绝crypto map 中match address 匹配的数据流。
hostname r2
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
!
crypto isakmp key cisco address 10.1.1.1
!
!
crypto ipsec transform-set mytrans esp-3des
!
crypto map mymap 1 ipsec-isakmp
set peer 10.1.1.1
set transform-set mytrans
match address 111
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.2 255.255.255.0
ip nat outside
duplex auto
speed auto
crypto map mymap
!
interface FastEthernet0/1
ip address 192.168.2.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
router rip
network 10.0.0.0
network 192.168.2.0
!
ip classless
ip route 192.168.1.0 255.255.255.0 10.1.1.1
!
!
access-list 111 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 112 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 112 permit ip 192.168.2.0 0.0.0.255 any
由于在此路由器中配置了NAT转换,故 在此要进行隧道分离,不然无法正常进行***连接,在NAT转换中拒绝crypto map 中match address 匹配的数据流。
交流探讨MSN:tianyahaijiao8888@hotmail.com
转载于:https://blog.51cto.com/5381880/940662