全系列VPN技术集锦第二卷(Site-to-Site IPsec VPN)【DOC精选】.doc

全系列VPN技术集锦第二卷第3章(Site-to-Site IPsec VPN) 作者： 论坛整理 zdnet网络安全CNETN2008-01-19 13:29:21关键词： 安全防护 防火墙 VPN 例子: 配置TED-Initiator路由器: TED-Initiator#show running-config Building configuration... Current configuration: version 12.0 service timestamps debug uptime service timestamps log uptime hostname TED-Initiator enable secret 5 removed enable password removed ip subnet-zero crypto isakmp policy 10 authentication pre-share One of the issues with using a preshared key with TED is the need to use a wildcard preshared key because the peers address is not known beforehand. A resolution to this is to use digital certificate-based digital signatures as the authentication method. crypto isakmp key abc123 address crypto ipsec transform-set ted-transforms esp-des esp-md5-hmac Note that no peer address has been configured in the crypto map below. crypto dynamic-map ted-map 10 set transform-set ted-transforms match address 101 The keyword discover in the crypto map below triggers the use of TED crypto map tedtag 10 ipsec-isakmp dynamic ted-map discover interface Ethernet0/0 ip address 3 no ip directed-broadcast no mop enabled interface Ethernet0/1 ip address crypto map tedtag ip classless ip route no ip http server access-list 101 permit ip 55 55 access-list 101 permit icmp 55 55 line con 0 transport input none line aux 0 line vty 0 4 password ww login end 配置TED-Responder路由器: TED-Responder#show running-config Building configuration... Current configuration: version 12.0 service timestamps debug uptime service timestamps log uptime hostname TED-Responder enable secret 5 removed enable password removed crypto isakmp policy 10 authentication pre-share crypto isakmp key abc123 address crypto ipsec transform-set ted-transforms esp-des esp-md5-hmac crypto dynamic-map ted-map 10 set transform-set ted-transforms match address 101 crypto map tedtag 10 ipsec-isakmp dynamic ted-map discover interface Ethernet0/0 ip address 2 no ip directed-broadcast no mop