本帖最后由 songjiaqi 于 2013-4-9 22:26 编辑
配置GRE Over IPsec
实验目的：为了解决在IPsecVPN中无法传递组播的问题 实验拓扑：
实验步骤： R1： 首先配置crypto policy：
定义预共享密钥：
定义转换集：定义封装方式。加密方式，和散列函数的算法。 因为此时数据加密点等于通信点，所以使用传输模式而不使用隧道模式，减小报文的大小。 在ipsecprofile中配置转换集：
配置Tunnel0：并调用ipsec profile
启用OSPF：注意，此时宣告的不是路由器的主接口s1/0，而是Tunnel0口的IP地址
R2： R2#show run Building configuration... Current configuration : 1938 bytes ! ! Last configuration change at 20:38:37 UTC Tue Apr 92013 ! version 15.2 service timestamps debug datetime msec service timestamps log datetime msec ! hostname R2 ! boot-start-marker boot-end-marker ! ! ! no aaa new-model no ip icmp rate-limit unreachable ! ! ! ! ! ! no ip domain lookup ip cef ipv6 multicast rpf use-bgp no ipv6 cef ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ip tcp synwait-time 5 ! ! crypto isakmp policy 10 encr 3des hash md5 authenticationpre-share group 2 crypto isakmp key cisco address 12.1.1.1 ! ! crypto ipsec transform-set cisco esp-des esp-md5-hmac mode transport ! ! crypto ipsec profile ipsec settransform-set cisco ! ! ! ! ! ! interface Loopback0 ip address2.2.2.2 255.255.255.0 ! interface Tunnel0 ip address100.1.1.2 255.255.255.0 tunnel source12.1.1.2 tunneldestination 12.1.1.1 tunnelprotection ipsec profile ipsec ! interface FastEthernet0/0 no ip address shutdown duplex full ! interface Serial1/0 ip address12.1.1.2 255.255.255.0 serialrestart-delay 0 ! interface Serial1/1 no ip address shutdown serialrestart-delay 0 ! interface Serial1/2 no ip address shutdown serialrestart-delay 0 ! interface Serial1/3 no ip address shutdown serialrestart-delay 0 ! interface Serial1/4 no ip address shutdown serialrestart-delay 0 ! interface Serial1/5 no ip address shutdown serialrestart-delay 0 ! interface Serial1/6 no ip address shutdown serialrestart-delay 0 ! interface Serial1/7 no ip address shutdown serialrestart-delay 0 ! router ospf 1 router-id2.2.2.2 network 2.2.2.20.0.0.0 area 0 network100.1.1.2 0.0.0.0 area 0 ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ! ! ! ! control-plane ! ! line con 0 exec-timeout 00 privilege level15 loggingsynchronous stopbits 1 line aux 0 exec-timeout 00 privilege level15 loggingsynchronous stopbits 1 line vty 0 4 login ! ! end 查看：
测试连通性：
| 
|熊猫同学技术论坛|小黑屋|
网络工程师论坛
( 沪ICP备09076391 )
发表于 2013-4-9 21:18:51
提升卡
置顶卡
变色卡
显身卡
楼主
