底层
R1
int g0/0
ip add 10.1.13.1 255.255.255.0
int g0/1
ip add 202.100.1.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 202.100.1.100
ip route 172.16.3.0 255.255.255.0 10.1.13.3
R3
int g0/0
ip add 10.1.13.3 255.255.255.0
int lo 0
ip add 172.16.3.3 255.255.255.0
ip route 0.0.0.0 0.0.0.0 10.1.13.1
R2
int lo 0
ip add 172.16.2.1 255.255.255.0
int g0/0
ip add 61.128.1.2 255.255.255.0
ip route 0.0.0.0 0.0.0.0 61.128.1.100
建立一阶段策略:ISAMKP SA
R1
crypto isakmp policy 10
encr 3des
auth pre-share
group 2
hash sha
crypto isakmp key cisco123 add 61.128.1.2
R2
crypto isakmp policy 10
encr 3des
auth pre-share
group 2
hash sha
crypto isakmp key cisco123 add 202.100.1.1
建立二阶段策略:IPSEC SA
R1
crypto ipsec tran TS esp-3des esp-sha-hmac
mode tunnel
R2
crypto ipsec tran TS esp-3des esp-sha-hmac
mode tunnel
mode 默认tunnel 可选transport
设置感兴趣流
R1
ip access-list extand ACL
per ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255
R2
ip access-list extand ACL
per ip 172.16.2.0 0.0.0.255 172.16.3.0 0.0.0.255
打包,接口引用
R1
crypto map CMAP 10 ipsec-isakmp
mat add ACL
set tran TS
set peer 61.128.1.2
int g0/1
crypto map CMAP
R2
crypto map CMAP 10 ipsec-isakmp
mat add ACL
set tran TS
set peer 202.100.1.1
int g0/0
crypto map CMAP
流量激活
检查命令
show crypto isakmp sa
show crypto ipsec sa