您好,登錄后才能下訂單哦!
1、實(shí)驗(yàn)拓?fù)?/p>
2、基礎(chǔ)網(wǎng)絡(luò)配置
R1配置:
interface FastEthernet0/0
ip address 12.1.1.1 255.255.255.0
interface FastEthernet1/0
ip address 13.1.1.1 255.255.255.0
R2配置:
interface FastEthernet0/0
ip address 12.1.1.2 255.255.255.0
interface FastEthernet1/0
ip address 172.16.1.254 255.255.255.0
ip route 0.0.0.0 0.0.0.0 12.1.1.1
R3配置:
interface FastEthernet0/0
ip address 13.1.1.3 255.255.255.0
interface FastEthernet1/0
ip address 192.168.1.254 255.255.255.0
ip route 0.0.0.0 0.0.0.0 13.1.1.1
R4配置:
interface FastEthernet0/0
ip address 172.16.1.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 172.16.1.254
R5配置:
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 192.168.1.254
3、配置Static p2p GRE over IPsec
3.1、配置GRE
R2配置:
interface Tunnel2
ip address 1.1.1.1 255.255.255.0
tunnel source 12.1.1.2
tunnel destination 13.1.1.3
R3配置:
interface Tunnel3
ip address 1.1.1.2 255.255.255.0
tunnel source 13.1.1.3
tunnel destination 12.1.1.2
3.2、配置LAN-TO-LAN ×××(此時(shí)的ACL與普通的LAN-TO-LAN ×××有差異)
R2配置:
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco123 address 13.1.1.3
crypto ipsec transform-set ccie esp-3des esp-sha-hmac
access-list 100 permit gre host 12.1.1.2 host 13.1.1.3
crypto map mymap 1 ipsec-isakmp
set peer 13.1.1.3
set transform-set ccie
match address 100
interface FastEthernet0/0
crypto map mymap
R3配置:
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco123 address 12.1.1.2
crypto ipsec transform-set ccie esp-3des esp-sha-hmac
access-list 100 permit gre host 13.1.1.3 host 12.1.1.2
crypto map mymap 1 ipsec-isakmp
set peer 12.1.1.2
set transform-set ccie
match address 100
interface FastEthernet0/0
crypto map mymap
3.3、配置動(dòng)態(tài)路由協(xié)議(此時(shí)私網(wǎng)流量走的都是隧道。)
R2配置:
router ospf 1
network 1.1.1.0 0.0.0.255 area 0
network 172.16.1.0 0.0.0.255 area 0
R3配置:
router ospf 1
network 1.1.1.0 0.0.0.255 area 0
network 192.168.1.0 0.0.0.255 area 0
4、NAT對(duì)Static p2p GRE over IPsec的影響
通過(guò)上面得知,內(nèi)網(wǎng)流量走的都是GRE隧道,所以,當(dāng)NAT應(yīng)用在物理口時(shí)對(duì)Static p2p GRE over IPsec是沒(méi)有影響的。但當(dāng)NAT應(yīng)用在Tunnel口時(shí),必須將內(nèi)網(wǎng)網(wǎng)段排除。
免責(zé)聲明:本站發(fā)布的內(nèi)容(圖片、視頻和文字)以原創(chuàng)、轉(zhuǎn)載和分享為主,文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng),如果涉及侵權(quán)請(qǐng)聯(lián)系站長(zhǎng)郵箱:is@yisu.com進(jìn)行舉報(bào),并提供相關(guān)證據(jù),一經(jīng)查實(shí),將立刻刪除涉嫌侵權(quán)內(nèi)容。