---------------------EASY ×××----------------------------------
aaa new-model //开启AAA服务//
aaa authentication login benet1 local //AAA本地身份验证//
aaa authorization network benet2 local //AAA授权//
username zhangsan password 123123 //创建本地用户//
---------------------------------------------------------------------
crypto isakmp policy 1 //定义控制连接IKE协议//
en 3des
hash sha
authentication pre-share
group 2
ip local pool vip 192.168.10.100 192.168.10.200 //定义分配给客户端地址池//
access-list 110 permit ip 192.168.10.0 0.0.0.255 any //分离隧道acl//
--------------------------------------------------------------------------------------
crypto isakmp client configuration group ez*** //创建组策略//
key 123456 //预共享密钥//
dns 8.8.8.8 //分离dns//
pool vip //调用分配地址池//
split-dns benet.com //分离dns//
acl 110 //调用隧道分离//
save-password //允许客户端可以保存密码//
netmask 255.255.255.0 //指定客户端的子网掩码//
crypto ipsec transform-set best esp-3des esp-sha-hmac //定义传输集//
--------------------------------------------------------------------------
crypto dynamic-map dymap 1 //建立动态MAP//
reverse-route //反转路由为连接成功的客户端产生32位路由//
set transform-set best //调用传输集//
crypto map mymap client configuration address respond //建立静态MAP 接受地址响应//
crypto map mymap client authentication list benet1 //认证列表为之前AAA服务中定义的benet1//
crypto map mymap isakmp authorization list benet2 //授权列表为之前AAA服务中定义的benet2//
crypto map mymap 1 ipsec-isakmp dynamic dymap //静态MAP包含动态MAP //
int fa0/0
crypto map mymap //静态MAP应用在端口//
转载于:https://blog.51cto.com/9827583/1643602