CiscoL2LVPN.docx
- 文档编号:9162249
- 上传时间:2023-02-03
- 格式:DOCX
- 页数:8
- 大小:46.59KB
CiscoL2LVPN.docx
《CiscoL2LVPN.docx》由会员分享,可在线阅读,更多相关《CiscoL2LVPN.docx(8页珍藏版)》请在冰豆网上搜索。
CiscoL2LVPN
1.RouterL2LVPN
实验介绍:
R1R5模拟PC,R2R4为出口路由器,R3为InternetRouter,R2ANDR4建立IpsecVPN
注意事项:
在IOS12.4之后VPN的ACL需要在Cryptomap下实现。
具体顺序为加密包先过接口的ACL,解密后再过cryptomap下的CryptomapACL。
L2LVPN边界路由器做NAT时一定要Deny掉感兴趣流。
不然将不能撞击接口下的CryptoMap,无法触发加密。
PC发出包格式为:
ip|tcp|telnetsourceip1.1.1.1destinationip5.5.5.5
一旦撞击上接口的Cryptomap则加密。
加密后的格式为:
ip|ESP|PC发出的包sourceip192.168.1.1destinationip192.168.2.4
Router1配置
Router1#shrunning-config
!
hostnameRouter1
!
noaaanew-model
ipcef
!
noipdomainlookup
!
interfaceLoopback1
ipaddress1.1.1.1255.255.255.0
!
interfaceSerial1/0
ipaddress12.1.1.1255.255.255.0
serialrestart-delay0
!
iproute0.0.0.00.0.0.012.1.1.2
Router1#
Router2配置
Router2#shrun
Buildingconfiguration...
Currentconfiguration:
1738bytes
!
hostnameRouter2
!
noaaanew-model
ipcef
!
noipdomainlookup
!
cryptoisakmppolicy10//定义isakmppolicy10,Router按照从小到大规则匹配
hashmd5
authenticationpre-share//认证方式为pre-share
group2
cryptoisakmpkeyciscoaddress192.168.2.4//peer地址和Key
!
cryptoipsectransform-setL2L.tranesp-desesp-md5-hmac//第二阶段的转换集
!
cryptomapL2L.map10ipsec-isakmp//建立Cryptomap方式为ipsec-isakmp
setpeer192.168.2.4
settransform-setL2L.tran//关联转换集
matchaddressL2L.vpn//匹配感兴趣流
!
interfaceFastEthernet0/0
ipaddress192.168.1.2255.255.255.0
ipnatoutside
ipvirtual-reassembly
duplexfull
cryptomapL2L.map//接口上调用
!
interfaceSerial1/1
ipaddress12.1.1.2255.255.255.0
ipnatinside
ipvirtual-reassembly
serialrestart-delay0
!
iproute0.0.0.00.0.0.0192.168.1.3
iproute1.1.1.1255.255.255.25512.1.1.1
noiphttpserver
noiphttpsecure-server
!
!
ipnatinsidesourcelist101interfaceFastEthernet0/0overload
!
ipaccess-listextendedL2L.vpn//定义感兴趣流
permitiphost1.1.1.1host5.5.5.5
!
loggingalarminformational
access-list101denyiphost1.1.1.1host5.5.5.5//Nat时Deny掉感兴趣流
access-list101permitiphost1.1.1.1any
access-list101permitiphost12.1.1.1any
Router3配置
Router3#shrunning-config
Buildingconfiguration...
Currentconfiguration:
1057bytes
!
hostnameRouter3
!
noaaanew-model
ipcef
!
noipdomainlookup
!
interfaceLoopback3
ipaddress3.3.3.3255.255.255.0
!
interfaceFastEthernet0/0
ipaddress192.168.1.3255.255.255.0
duplexfull
!
interfaceSerial1/1
ipaddress192.168.2.3255.255.255.0
serialrestart-delay0
!
noiphttpserver
noiphttpsecure-server
!
Router3#
Router4配置
Router4#shrun
Buildingconfiguration...
hostnameRouter4
!
noaaanew-model
ipcef
!
noipdomainlookup
!
cryptoisakmppolicy10
hashmd5
authenticationpre-share
group2
cryptoisakmpkeyciscoaddress192.168.1.2
!
cryptoipsectransform-setL2L.tranesp-desesp-md5-hmac
!
cryptomapL2L.map10ipsec-isakmp
setpeer192.168.1.2
settransform-setL2L.tran
setipaccess-groupcryvpnin
matchaddressL2L.vpn
!
interfaceSerial1/0
ipaddress192.168.2.4255.255.255.0
ipnatoutside
ipvirtual-reassembly
serialrestart-delay0
cryptomapL2L.map
!
interfaceSerial1/1
ipaddress45.1.1.4255.255.255.0
ipnatinside
ipvirtual-reassembly
serialrestart-delay0
!
iproute0.0.0.00.0.0.0192.168.2.3
iproute5.5.5.5255.255.255.25545.1.1.5
noiphttpserver
noiphttpsecure-server
!
ipnatinsidesourcelist101interfaceSerial1/0overload
!
ipaccess-listextendedL2L.vpn
permitiphost5.5.5.5host1.1.1.1
!
ipaccess-listextendedcryvpn//设置CryptoMap下的ACL
permittcphost1.1.1.1host5.5.5.5eqtelnet
!
loggingalarminformational
access-list101denyiphost5.5.5.5host1.1.1.1
access-list101permitiphost5.5.5.5any
access-list101permitiphost45.1.1.5any
!
Router4#
Router5配置
Router5#shrun
Buildingconfiguration...
Currentconfiguration:
1075bytes
!
version12.4
servicetimestampsdebugdatetimemsec
servicetimestampslogdatetimemsec
noservicepassword-encryption
!
hostnameRouter5
!
noaaanew-model
ipcef
!
noipdomainlookup
!
interfaceLoopback5
ipaddress5.5.5.5255.255.255.0
!
interfaceSerial1/0
ipaddress45.1.1.5255.255.255.0
serialrestart-delay0
!
iproute0.0.0.00.0.0.045.1.1.4
Router5#
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- CiscoL2LVPN
![提示](https://static.bdocx.com/images/bang_tan.gif)