A-A+
两台Cisco路由器上配置VPN的方法和实例
对于cisco路由器的管理和维护人员来说，配置VPN是一项非常基本的技能了，下面就通过一个实例来讲解一个简单的两台路由器配置成VPN网络的方法，并且附上完整的配置命令。
网络环境介绍:
用两台路由器分别代表公司总部(R1)和公司分部(R2).公司总部内部地址为192.168.1.0/24网段.分部内部地址为192.168.2.0/24网段.
实验配置:
- R1
- r1#show run
- Building configuration...
- Current configuration : 1505 bytes
- !
- version 12.3
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- !
- hostname r1
- !
- boot-start-marker
- boot-end-marker
- !
- !
- no aaa new-model
- ip subnet-zero
- !
- !
- ip cef
- no ip domain lookup
- !
- ip audit po max-events 100
- no ftp-server write-enable
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- crypto isakmp policy 1 定义策略集,下面是策略集的内容,两边要一致.
- hash md5
- authentication pre-share
- lifetime 64000
- crypto isakmp key cisco address 202.10.1.2 设置共享密钥和对端地址!
- !
- crypto ipsec transform-set benet ah-md5-hmac esp-des 配置IPSec的相关参数,两边也要一致.
- !
- crypto map map1 1 ipsec-isakmp 配置端口应用,就是将IKE与IPSec做个关联,我是这样理解的.
- set peer 202.10.1.2
- set transform-set benet
- match address 101
- !
- !
- !
- !
- interface Loopback0 回环地址模拟公司内部地址
- ip address 192.168.1.1 255.255.255.0
- !
- interface FastEthernet0/0
- no ip address
- shutdown
- duplex auto
- speed auto
- !
- interface FastEthernet0/1
- no ip address
- shutdown
- duplex auto
- speed auto
- !
- interface Serial1/0 配置路由器的地址
- ip address 202.10.1.1 255.255.255.0
- serial restart-delay 0
- crypto map map1
- !
- interface Serial1/1
- no ip address
- shutdown
- serial restart-delay 0
- !
- interface Serial1/2
- no ip address
- shutdown
- serial restart-delay 0
- !
- interface Serial1/3
- no ip address
- shutdown
- serial restart-delay 0
- !
- ip http server
- no ip http secure-server
- ip classless
- ip route 192.168.2.0 255.255.255.0 202.10.1.2 静态路由到公司分部
- !
- !
- access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
- !设置要加密的数据流.这里是指从192.168.1.0到192.168.2.0的数据流
- !
- !
- !
- !
- !
- !
- !
- !
- line con 0
- exec-timeout 0 0
- logging synchronous
- transport preferred all
- transport output all
- line aux 0
- transport preferred all
- transport output all
- line vty 0 4
- !
- end
- R2上的配置差不多,就把IP地址改了.
- r2#show run
- Building configuration...
- Current configuration : 1505 bytes
- !
- version 12.3
- service timestamps debug datetime msec
- service timestamps log datetime msec
- no service password-encryption
- !
- hostname r2
- !
- boot-start-marker
- boot-end-marker
- !
- !
- no aaa new-model
- ip subnet-zero
- !
- !
- ip cef
- no ip domain lookup
- !
- ip audit po max-events 100
- no ftp-server write-enable
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- !
- crypto isakmp policy 1
- hash md5
- authentication pre-share
- lifetime 64000
- crypto isakmp key cisco address 202.10.1.1
- !
- !
- crypto ipsec transform-set cisco ah-md5-hmac esp-des
- !
- crypto map map1 1 ipsec-isakmp
- set peer 202.10.1.1
- set transform-set cisco
- match address 101
- !
- !
- !
- !
- interface Loopback0
- ip address 192.168.2.1 255.255.255.0
- !
- interface FastEthernet0/0
- no ip address
- shutdown
- duplex auto
- speed auto
- !
- interface FastEthernet0/1
- no ip address
- shutdown
- duplex auto
- speed auto
- !
- interface Serial1/0
- ip address 202.10.1.2 255.255.255.0
- serial restart-delay 0
- crypto map map1
- !
- interface Serial1/1
- no ip address
- shutdown
- serial restart-delay 0
- !
- interface Serial1/2
- no ip address
- shutdown
- serial restart-delay 0
- !
- interface Serial1/3
- no ip address
- shutdown
- serial restart-delay 0
- !
- ip http server
- no ip http secure-server
- ip classless
- http://www.19216811.la
- ip route 192.168.1.0 255.255.255.0 202.10.1.1
- !
- !
- access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
- !
- !
- !
- !
- !
- !
- !
- !
- !
- line con 0
- exec-timeout 0 0
- logging synchronous
- transport preferred all
- transport output all
- line aux 0
- transport preferred all
- transport output all
- line vty 0 4
- !
- end
- r2#
这命令还是要常敲啊,学完这个有段时间了,就差不多都忘了.