VPN實驗配置小結

　　 

地點：公司
內容：configuring IPSec Router-to-Router with NAT and Cisco Secure VPN Client
    VPN Client因沒有客戶端故未能進行實驗。
網絡拓撲：
[img]http://www.cisco.com/warp/public/707/ios_D-a.gif[/img]

配置及說明：

[b]A、light Router的配置及說明[/b]
!
version 12.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Light
!
boot-start-marker
boot-end-marker
!
enable password cisco
!
no aaa new-model
ip su.net-zero
!
!
!
ip cef
ip audit po max-events 100
no ftp-server write-enable
!
!
[u]crypto isakmp policy 5[/u]    ****創建IKE策略
 [u]hash md5[/u]     *****定義散列算法
[u] authentication pre-share[/u]    ****定義預認證方法為預共享密鈅
[u]crypto isakmp key cisco123 address 192.168.18.252 255.255.255.0 no-xauth[/u]    ****配置預共享密鈅
[u]crypto isakmp key 123cisco address 0.0.0.0 0.0.0.0[/u]     ****為動態VPN　Client配置預共享密鈅
[u]crypto isakmp client configuration address-pool local test-pool[/u]      ****為VPN Client定義IP
!
!
[u]crypto ipsec transform-set testset esp-des esp-md5-hmac [/u]   ****配置IPSec變換集
!
[u]crypto dynamic-map test-dynamic 10[/u]    ****創建動態加密圖
[u] set transform-set testset [/u]     ****指定使用的變換集
!
!
[u]crypto map test client configuration address initiate[/u]   ****使用IKE模式的客戶機配置，可以為客戶機設定IP
[u]crypto map test client configuration address respond[/u]    ****可以為請求IP的客戶機提供IP
[u]crypto map test 5 ipsec-isakmp [/u]   ****創建加密圖
[u] set peer 192.168.18.252[/u]    ****指定對等體
[u] set transform-set testset [/u]   ****指定變換集
[u] match address 115[/u]   ****引用加密訪問列表確定受保護的流量
[u]crypto map test 10 ipsec-isakmp dynamic test-dynamic [/u]   ****把動態加密圖集加入到正規圖集中
!
!
!
!
interface FastEthernet0/0
 ip address 192.168.18.251 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
 [u]crypto map test[/u]   ****指定要使用的加密圖
!
interface FastEthernet0/1
 ip address 192.168.100.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
ip local pool test-pool 192.168.1.1 192.168.1.254
ip nat inside source route-map nonat interface FastEthernet0/0 overload
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.18.1
!
!
aclearcase/" target="_blank" >ccess-list 110 deny   ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
access-list 110 deny   ip 192.168.100.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 permit ip 192.168.100.0 0.0.0.255 any
[color=Red]access-list 115 permit ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255[/color]
!
route-map nonat permit 10
 match ip address 110
!       
!
!
!
!
line con 0
line aux 0
line vty 0 4
 password cisco
 login
!
end

[b]B、house Router的配置及說明[/b]
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname house
!
enable password cisco
!
ip subnet-zero
!
!
!
ip audit notify log
ip audit po max-events 100
!
[u]crypto isakmp policy 5[/u]　****[color=Blue]創建IKE策略[/color]
 [u]hash md5[/u]               ****定義散列算法
 [u]authentication pre-share[/u]   ****定義認證方法為預共享密鈅
[u]crypto isakmp key cisco123 address 10.64.10.44 no-xauth[/u]    ****配置預共享密鈅
!
!
[u]crypto ipsec transform-set testset esp-des esp-md5-hmac [/u]    ****配置IPSec變換集
!
[u]crypto map test 5 ipsec-isakmp [/u]    ****創建加密圖
[u] set peer 10.64.10.44[/u]   ****指定對等體
[u] set transform-set testset [/u]    ****指定使用的變換集
[u] match address 115[/u]    ****引用加密訪問列表確定受保護的流量
!
!
!
voice call carrier capacity active
!!
!
mta receive maximum-recipients 0
!
!
!
interface FastEthernet0/0
 ip address 10.64.10.45 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
 [u]crypto map test[/u]   ****指定要使用的加密圖
!
interface FastEthernet0/1
 ip address 192.168.200.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
ip nat inside source route-map nonat interface FastEthernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 10.64.10.33
ip http server
!
!
access-list 110 deny   ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 110 permit ip 192.168.200.0 0.0.0.255 any
access-list 115 permit ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
!
route-map nonat permit 10
 match ip address 110
!
call rsvp-sync
!
!
mgcp profile default
!
dial-peer cor custom
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 password cisco
 login
!
!
end

所有配置完事?。?！

開始的時候沒有成功，始終沒有觸發通道的建立，后來仔細檢查配置發現沒有設定感興趣流量，沒有做一條加密圖引用的ACL來定義數據流量，加上之后立即成功，通道建立成功！

 

原文轉自：http://www.kjueaiud.com