IPSec （ikev1）

 底层

R1

int g0/0
ip add 10.1.13.1 255.255.255.0
int g0/1
ip add 202.100.1.1 255.255.255.0

ip route 0.0.0.0 0.0.0.0 202.100.1.100
ip route 172.16.3.0 255.255.255.0 10.1.13.3

R3

int g0/0
ip add 10.1.13.3 255.255.255.0
int lo 0
ip add 172.16.3.3 255.255.255.0

ip route 0.0.0.0 0.0.0.0 10.1.13.1

R2
int lo 0
ip add 172.16.2.1 255.255.255.0
int g0/0
ip add 61.128.1.2 255.255.255.0

ip route 0.0.0.0 0.0.0.0 61.128.1.100

建立一阶段策略：ISAMKP SA

R1
crypto isakmp policy 10
encr 3des
auth pre-share
group 2
hash sha

crypto isakmp key cisco123 add 61.128.1.2

R2
crypto isakmp policy 10
encr 3des
auth pre-share
group 2
hash sha

crypto isakmp key cisco123 add 202.100.1.1

建立二阶段策略：IPSEC SA

R1

crypto ipsec tran TS esp-3des esp-sha-hmac
mode tunnel

R2

crypto ipsec tran TS esp-3des esp-sha-hmac
mode tunnel

mode  默认tunnel  可选transport

设置感兴趣流

R1

ip access-list extand ACL
per ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255

R2

ip access-list extand ACL
per ip 172.16.2.0 0.0.0.255 172.16.3.0 0.0.0.255

打包，接口引用

R1

crypto map CMAP 10 ipsec-isakmp
mat add ACL
set tran TS
set peer 61.128.1.2

int g0/1
crypto map CMAP

R2

crypto map CMAP 10 ipsec-isakmp
mat add ACL
set tran TS
set peer 202.100.1.1

int g0/0
crypto map CMAP

流量激活

 检查命令

show crypto isakmp sa
show crypto ipsec sa