配置Cisco IOS的站点到站点IPSec VPN.docx

Lab 2 配置Cisco IOS的站点到站点IPSec VPN实验拓扑实验要求两个站点的IP地址的都是固定公网IP，配置两个站点，实现IPSec VPNSite_A的IP地址是动态IP，Site_B无法确定Site_A的IP，配置两个站点实现IPSec VPN连接两个站点要使用动态路由协议互联，配置两个站点，实现GRE over IPSec的VPN连接，并使用ospf通过VPN互相传递路由实验步骤配置路由器的IP地址和默认路由，保证路由器能和Internet互相通信两个站点的IP地址的都是固定公网IP，配置两个站点，实现IPSec VPN开启并配置ISAKMP策略Site_A(config)#crypto isakmp enable Site_A(config)#crypto isakmp policy 10Site_A(config-isakmp)#encryption des Site_A(config-isakmp)#hash md5 Site_A(config-isakmp)#authentication pre-share Site_A(config-isakmp)#group 1Site_A(config-isakmp)#lifetime 3600Site_A(config)#crypto isakmp key 0 cisco address 25.255.2.x?Site_B(config)#crypto isakmp enable Site_B(config)#crypto isakmp policy 10 SSite_B(config-isakmp)#encryption des Site_B(config-isakmp)#authentication pre-share Site_B(config-isakmp)#hash md5 Site_B(config-isakmp)#group 1Site_B(config-isakmp)#exitSite_B(config)#crypto isakmp key 0 cisco address 25.255.1.x?b)配置IPSec变换集Site_A(config)#crypto ipsec transform-set set1 esp-3des esp-md5-hmac Site_A(cfg-crypto-trans)#mode tunnel ?Site_B(config)#crypto ipsec transform-set set1 esp-3des esp-md5-hmac Site_B(cfg-crypto-trans)#mode tunnel?配置SA生命期（可选）Site_A(config)#crypto ipsec security-association lifetime seconds 1800Site_B(config)#crypto ipsec security-association lifetime seconds 1800?定义感兴趣流量Site_A(config)#ip access-list extended VPNSite_A(config-ext-nacl)#permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255?Site_B(config)#ip access-list extended VPNSite_B(config-ext-nacl)#permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255?定义crypto-mapSite_A(config)#crypto map IPSEC_VPN 10 ipsec-isakmpSite_A(config-crypto-map)#match address VPNSite_A(config-crypto-map)#set peer 25.255.2.xSite_A(config-crypto-map)#set transform-set set1?Site_B(config)#crypto map IPSEC_VPN 1 ipsec-isakmpSite_B(config-crypto-map)#match address VPNSite_B(config-crypto-map)#set peer 25.255.1.xSite_B(config-crypto-map)#set transform-set set1?e)在接口上应用crypto-mapSite_A(config)#interface ethernet 0/0Site_A(config-if)#crypto ma