資源描述：
《配置cisco ios的站點(diǎn)到站點(diǎn)ipsec vpn》由會(huì)員上傳分享，免費(fèi)在線閱讀，更多相關(guān)內(nèi)容在行業(yè)資料-天天文庫(kù)。
1、央邦I(lǐng)T實(shí)驗(yàn)室Lab2配置CiscoIOS的站點(diǎn)到站點(diǎn)IPSecVPN實(shí)驗(yàn)拓?fù)鋵?shí)驗(yàn)要求1.兩個(gè)站點(diǎn)的IP地址的都是固定公網(wǎng)IP，配置兩個(gè)站點(diǎn)，實(shí)現(xiàn)IPSecVPN2.Site_A的IP地址是動(dòng)態(tài)IP，Site_B無法確定Site_A的IP，配置兩個(gè)站點(diǎn)實(shí)現(xiàn)IPSecVPN連接3.兩個(gè)站點(diǎn)要使用動(dòng)態(tài)路由協(xié)議互聯(lián)，配置兩個(gè)站點(diǎn)，實(shí)現(xiàn)GREoverIPSec的VPN連接，并使用ospf通過VPN互相傳遞路由實(shí)驗(yàn)步驟配置路由器的IP地址和默認(rèn)路由，保證路由器能和Internet互相通信1.兩個(gè)站點(diǎn)的IP地址的都是固定公網(wǎng)IP，配置兩個(gè)站點(diǎn)，實(shí)現(xiàn)IPSecVPNa)開啟并配置ISAKMP策
2、略Site_A(config)#cryptoisakmpenableSite_A(config)#cryptoisakmppolicy10Site_A(config-isakmp)#encryptiondesSite_A(config-isakmp)#hashmd5Site_A(config-isakmp)#authenticationpre-shareSite_A(config-isakmp)#group1Site_A(config-isakmp)#lifetime36006央邦I(lǐng)T實(shí)驗(yàn)室Site_A(config)#cryptoisakmpkey0ciscoaddress25
3、.255.2.x?Site_B(config)#cryptoisakmpenableSite_B(config)#cryptoisakmppolicy10SSite_B(config-isakmp)#encryptiondesSite_B(config-isakmp)#authenticationpre-shareSite_B(config-isakmp)#hashmd5Site_B(config-isakmp)#group1Site_B(config-isakmp)#exitSite_B(config)#cryptoisakmpkey0ciscoaddress25.255.1.
4、x?b)配置IPSec變換集Site_A(config)#cryptoipsectransform-setset1esp-3desesp-md5-hmacSite_A(cfg-crypto-trans)#modetunnel?Site_B(config)#cryptoipsectransform-setset1esp-3desesp-md5-hmacSite_B(cfg-crypto-trans)#modetunnel?配置SA生命期（可選）Site_A(config)#cryptoipsecsecurity-associationlifetimeseconds1800Site_
5、B(config)#cryptoipsecsecurity-associationlifetimeseconds1800?c)定義感興趣流量Site_A(config)#ipaccess-listextendedVPNSite_A(config-ext-nacl)#permitip192.168.1.00.0.0.255192.168.2.00.0.0.255?Site_B(config)#ipaccess-listextendedVPNSite_B(config-ext-nacl)#permitip192.168.2.00.0.0.255192.168.1.00.0.0.255
6、?d)定義crypto-mapSite_A(config)#cryptomapIPSEC_VPN10ipsec-isakmpSite_A(config-crypto-map)#matchaddressVPNSite_A(config-crypto-map)#setpeer25.255.2.xSite_A(config-crypto-map)#settransform-setset1?Site_B(config)#cryptomapIPSEC_VPN1ipsec-isakmpSite_B(config-crypto-map)#matchaddressVPNSite_B(config
7、-crypto-map)#setpeer25.255.1.x6央邦I(lǐng)T實(shí)驗(yàn)室Site_B(config-crypto-map)#settransform-setset1?e)在接口上應(yīng)用crypto-mapSite_A(config)#interfaceethernet0/0Site_A(config-if)#cryptomapIPSEC_VPN?Site_B(config)#interfaceethernet0/0Site_B(config-if)#cryptomapIPSEC
