cisco ipsec vpn 实验.doc

实验二：ipsec site-to-siteVPN配置 环境：两台路由器串口相连，接口配置如图 要求：用两个LOOP口模拟VPN感兴趣流来建立IPSEC VPN,IKE1阶段用预共享密钥，IKE2阶段哈希算法用sha,加密算法用DES. 步骤一：接口基本配置，并测试连通性 R1(config)#int s0 R1(config-if)#ip add R1(config-if)#clock rate 64000 R1(config-if)#no sh R1(config)#int loop 0 R1(config-if)#ip add R2(config)#int s1 R2(config-if)#ip add R2(config-if)#no sh R2(config)#int loop 0 R2(config-if)#ip add R1#ping (测试连通性，再做IPSEC !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/32 ms R2#ping !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 32/32/32 ms 配置二：配置IKE1和IKE2两个阶段，并应用到接口 R1(config)#crypto isakmp policy 10 (IKE1阶段策略 R1(config-isakmp)#authen pre-share (将验证修改为预共享 R1(config)#crypto isakmp key cisco address (定义预共享密钥 R1(config)#crypto ipsec transform myset esp-sha-hmac esp-des (定义2阶段的转换集 R1(config)#access-list 100 permit ip 55 55 (定义加密感兴趣流 R1(config)#crypto map mymap 10 ipsec-isakmp (定义2阶段加密图 % NOTE: This new crypto map will remain disabled until a peer and a valid access list have been configured. R1(config-crypto-map)#match address 100 (将列表应用到加密图 R1(config-crypto-map)#set peer (指定对等体 R1(config-crypto-map)#set transform-set myset (将转换集映射到加密图 R1(config)#int s0 R1(config-if)#crypto map mymap (将加密图应用到接口 R1(config)#ip route (指定隧道感兴趣流的路由走向 R2(config)#crypto isakmp policy 10 (R2与R1端策略要匹配 R2(config-isakmp)#authentication pre-share R2(config-isakmp)#exit R2(config)#crypto isakmp key cisco address (密钥一致，地址相互指 R2(config)#crypto ipsec transform-set myset esp-des esp-sha-hmac R2(cfg-crypto-trans)#exit (两端必须匹配，默认即为tunnel模式 R2(config)#access-list 102 permit ip 55 55 (感兴趣流，两端互指 R2(config)#crypto map mymap 10 ipsec-isakmp (加密图 % NOTE: This new crypto map will remain disabled until a peer and a valid access list have been configured. R2(config-crypto-map)#set peer (对端的物理地址 R2(config-crypto-map)#set transform-set myset R2(config-crypto-map)#match address 102 R2(config-crypto-