Router:sam-i-am(VPN Server)Current configuration:!version 12.2service timestamps debug uptimeservice timestamps log up timeno service passWord-encryption!hostname sam-i-am!ip subnet-zero!--- IKE配置sam-i-am(config)#crypto isakmp policy 1 //定义策略为1sam-i-am(isakmp)#hash md5 //定义MD5散列算法sam-i-am(isakmp)#authentication PRe-share //定义为预共享密钥认证方式sam-i-am(config)#crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0!--- 配置预共享密钥为cisco123,对等端为所有IP!--- IPSec协议配置sam-i-am(config)#crypto ipsec transform-set rtpset esp-des esp-md5-hmac!--- 创建变换集 esp-des esp-md5-hmacsam-i-am(config)#crypto dynamic-map rtpmap 10 //创建动态保密图rtpmap 10san-i-am(crypto-map)#set transform-set rtpset //使用上面的定义的变换集rtpsetsan-i-am(crypto-map)#match address 115 //援引访问列表确定受保护的流量sam-i-am(config)#crypto map rtptrans 10 ipsec-isakmp dynamic rtpmap!--- 将动态保密图集加入到正规的图集中!interface Ethernet0ip address 10.2.2.3 255.255.255.0no ip directed-broadcastip nat insideno mop enabled!interface Serial0ip address 99.99.99.1 255.255.255.0no ip directed-broadcastip nat outsidecrypto map rtptrans //将保密映射应用到S0接口上!ip nat inside source route-map nonat interface Serial0 overload!--- 这个NAT配置启用了路由策略，内容为10.2.2.0到10.1.1.0的访问不进行地址翻译!--- 到其他网络的访问都翻译成SO接口的IP地址ip classlessip route 0.0.0.0 0.0.0.0 Serial0 //配置静态路由协议no ip http server!access-list 115 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255access-list 115 deny ip 10.2.2.0 0.0.0.255 any!access-list 120 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255access-list 120 permit ip 10.2.2.0 0.0.0.255 any!sam-i-am(config)#route-map nonat permit 10 //使用路由策略sam-i-am(router-map)#match ip address 120!line con 0transport input noneline aux 0line vty 0 4password wwlogin!endRouter:dr_whoovie(VPN Client)Current configuration:!version 12.2service timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname dr_whoovie!ip subnet-zero!dr_whoovie(config)#crypto isakmp policy 1 //定义策略为1dr_whoovie(isakmp)#hash md5 //定义MD5散列算法dr_whoovie(isakmp)#authentication pre-share //定义为预共享密钥认证方式dr_whoovie(config)#crypto isakmp key cisco123 address 99.99.99.1!--- 配置预共享密钥为cisco123,对等端为服务器端IP99.99.99.1!--- IPSec协议配置dr_whoovie(config)#crypto ipsec transform-set rtpset esp-des esp-md5-hmac
!--- 创建变换集 esp-des esp-md5-hmacdr_whoovie(config)#crypto map rtp 1 ipsec-isakmp!--- 使用IKE创建保密图rtp 1dr_whoovie(crypto-map)#set peer 99.99.99.1 //确定远程对等端dr_whoovie(crypto-map)#set transform-set rtpset //使用上面的定义的变换集rtpsetdr_whoovie(crypto-map)#match address 115 //援引访问列表确定受保护的流量!interface Ethernet0ip address 10.1.1.1 255.255.255.0no ip directed-broadcastip nat insideno mop enabled!interface Serial0ip address negotiated //IP地址自动获取no ip directed-broadcastip nat outsideencapsulation ppp //S0接口封装ppp协议no ip mroute-cacheno ip route-cachecrypto map rtp //将保密映射应用到S0接口上!ip nat inside source route-map nonat interface Serial0 overload!--- 这个NAT配置启用了路由策略，内容为10.1.1.0到10.2.2.0的访问不进行地址翻译!--- 到其他网络的访问都翻译成SO接口的IP地址ip classlessip route 0.0.0.0 0.0.0.0 Serial0 //配置静态路由协议no ip http server!access-list 115 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255access-list 115 deny ip 10.1.1.0 0.0.0.255 anyaccess-list 120 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255access-list 120 permit ip 10.1.1.0 0.0.0.255 any!dialer-list 1 protocol ip permitdialer-list 1 protocol ipx permitroute-map nonat permit 10 //使用路由策略match ip address 120!line con 0transport input noneline aux 0line vty 0 4password wwlogin!end
