A端路由器部分配置:
crypto isakmp policy 1        ;配置IKE 策略1
 authentication pre-share     ;IKE 策略1验证方法设为pre-share
 group 2                      ;1024-bit Diffie-Hellman,加密算法未设置则取缺省值:DES
crypto isakmp key test123 address 202.96.1.2  ;设置Pre-share密钥为test123,此值两端需一致
crypto ipsec transform-set ×××tag ah-md5-hmac esp-des ;设置AH散列算法为md5 ,
!                                                      ESP加密算法为DES。
 crypto map ×××demo 10 ipsec-isakmp     ;定义crypto map
 set peer 202.96.1.2                  ;设置隧道对端IP地址
 set transform-set ×××tag    ;设置隧道AH及ESP,
 match address 101           ;
interface Tunnel0          ;定义隧道接口
 ip address 192.168.1.1 255.255.255.0 ;隧道端口IP地址
 no ip directed-broadcast
 tunnel source 202.96.1.1         ;隧道源端地址
 tunnel destination 202.96.1.2    ;隧道目的端地址
 crypto map ×××demo              ;应用×××demo 于此接口
 
interface Serial0/0
 ip address 202.96.1.1 255.255.255.252  ;串口的Internet IP地址
 no ip directed-broadcast
 crypto map ×××demo             ;应用×××demo 于串口
 
!
interface Ethernet0/1
 ip address 168.1.1.1 255.255.255.0   ;外部端口IP地址
 no ip directed-broadcast
interface Ethernet0/0  
 ip address 172.22.1.100 255.255.255.0   ; 内部端口IP地址
 no ip directed-broadcast
!
ip classless
ip route 0.0.0.0 0.0.0.0 202.96.1.2    ;缺省路由
ip route 172.22.2.0 255.255.0.0 192.168.1.2  ;到中山端内网静态路由(经过隧道)
access-list 101 permit gre host 202.96.1.1 host 202.96.1.2  ;定义存取列表
 
B端路由器部分配置:
crypto isakmp policy 1
 authentication pre-share
 group 2
crypto isakmp key test123 address 202.96.1.1
crypto ipsec transform-set ×××tag ah-md5-hmac esp-des
!
crypto map ×××demo 10 ipsec-isakmp
 set peer 202.96.1.1
 set transform-set ×××tag
 match address 101
interface Tunnel0
 ip address 192.168.1.2 255.255.255.0
 no ip directed-broadcast
 tunnel source Serial0/0
 tunnel destination 202.96.1.1
 crypto map ×××demo
 
interface Serial0/0
 ip address 202.96.1.2 255.255.255.252
 no ip directed-broadcast
 crypto map ×××demo
!
interface Ethernet0/1
 ip address 167.1.1.1 255.255.255.0
 no ip directed-broadcast
interface Ethernet0/0
 ip address 172.22.2.100 255.255.255.0
 no ip directed-broadcast
!
ip classless
ip route 0.0.0.0 0.0.0.0 202.96.1.1
ip route 172.22.1.0 255.255.0.0 192.168.1.1
access-list 101 permit gre host 202.96.1.2 host 202.96.1.1