DMVPN实验手册.doc

DMVPN实验：VPN-DMVPNHUBHUB(config)#int tunnel 0HUB(config-if)#ip address 172.16.1.100 255.255.255.0HUB(config-if)#tunnel source f0/0HUB(config-if)#tunnel mode gre multipoint /隧道模式为gre多点HUB(config-if)#tunnel key 123-mGRE配置-HUB(config-if)#ip nhrp network-id 10 /激活NHRP，HUB(config-if)#ip nhrp authentication cisco /激活NHRP认证HUB(config-if)#ip nhrp map multicast dynamic /动态接收NHRP的组播映射（动态接收多重广播）-HNRP配置-HUB(config)#router eigrp 90HUB(config-router)#no auHUB(config-router)#net 172.16.1.0 0.0.0.255HUB(config-router)#net 192.168.100.0 0.0.0.255-动态路由配置-HUB(config)#int tunnel 0HUB(config-if)#no ip split-horizon eigrp 90 /关闭EIGRP水平分割，让其能够学习到其他分支站点之间的路由-关闭水平分割配置-HUB(config)#int tunnel 0HUB(config-if)#no ip next-hop-self eig 90 /由于是Hub-and-Spoke拓扑结构，在spoke之间通信时，默认是通过Hub来转发的，配置此命令，sopke之间的路由下一跳直接指向相应的spoke的tunnel接口的IP地址-关闭下一跳配置-HUB(config)#crypto isakmp policy 10HUB(config-isakmp)#authentication pre-shareHUB(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0 /由于sopke端的IP地址未知，有可能通过ISP动态获得，所以采用动态方式，sopke端IP为0.0.0.0HUB(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacHUB(cfg-crypto-trans)#mode transportHUB(config)#crypto ipsec profile dmvpnHUB(ipsec-profile)#set transform-set ciscoHUB(config)#int tunnel 0HUB(config-if)#ip mtu 1400HUB(config-if)#tunnel protection ipsec profile dmvpn-IPSEC VPN配置-HUB END-spoke1spoke1(config)#int tunnel 0spoke1(config-if)#ip address 172.16.1.1 255.255.255.0spoke1(config-if)#tunnel source f0/0spoke1(config-if)#tunnel mode gre multipointspoke1(config-if)#tunnel key 123spoke1(config-if)#ip nhrp network-id 10spoke1(config-if)#ip nhrp authentication ciscospoke1(config-if)#ip nhrp map 172.16.1.100 202.100.1.100 /手动nhrp映射，映射中心站点的隧道虚拟IP到中心站点的公网IP，有了这个映射，分支站点才能访问中心站点spoke1(config-if)#ip nhrp map multicast 202.100.1.100 /mGRE是NBMA网咯，分支站点要和中心站点建立动态路由协议的邻居关系，必须在每一个分支站点，映射组播到中心站点的公网IP，这样才能够把分支站点的组播送到中心站点，并且可以看到分支站点间没有组播映射，所以分支站点间没有动态路由协议的邻居关系spoke1(config-if)#ip nhrp nhs 172.16.1.100 /nhs是nhrp的服务器，这个配置定义了nhrp服务器地址为中心站点的隧道接口虚拟地址172.16.1.100-HNRP配置-spoke1(config)#router eig 90spoke1(config-router)#no auspoke1(config-router)#net 172.16.1.0 0.0.0.255spoke1(config-router)#net 192.168.1.0 0.0.0.255-动态路由配置-spoke1(config)#crypto isakmp policy 10spoke1(config-isakmp)#authentication pre-sharespoke1(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0spoke1(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacspoke1(cfg-crypto-trans)#mode transportspoke1(config)#crypto ipsec profile dmvpn spoke1(ipsec-profile)#set transform-set ciscospoke1(config)#int tunnel 0spoke1(config-if)#ip mtu 1400spoke1(config-if)#tunnel protection ipsec profile dmvpn-IPSEC VPN配置-SPOKE1 END-Spoke2spoke2(config)#int tunnel 0spoke2(config-if)#ip address 172.16.1.2 255.255.255.0spoke2(config-if)#tunnel mode gre multipointspoke2(config-if)#tunnel source f0/0spoke2(config-if)#tunnel key 123spoke2(config-if)#ip nhrp network-id 10spoke2(config-if)#ip nhrp authentication ciscospoke2(config-if)#ip nhrp map 172.16.1.100 202.100.1.100spoke2(config-if)#ip nhrp map multicast 202.100.1.100spoke2(config-if)#ip nhrp nhs 172.16.1.100-HNRP配置-spoke2(config)#router eigrp 90spoke2(config-router)#no auspoke2(config-router)#net 172.16.1.0 0.0.0.255spoke2(config-router)#net 192.168.2.0 0.0.0.255-动态路由配置-spoke2(config)#crypto isakmp policy 10spoke2(config-isakmp)#authentication pre-sharespoke2(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0spoke2(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacspoke2(cfg-crypto-trans)#mode transportspoke2(config)#crypto ipsec profile dmvpnspoke2(ipsec-profile)#set transform-set ciscospoke2(config)#int tunnel 0spoke2(config-if)#ip mtu 1400spoke2(config-if)#tunnel protection ipsec profile dmvpn-IPSEC VPN配置-SPOKE2 END-第三阶段DMVPN实验HUBHUB(config)#int tunnel 0HUB(config-if)#ip address 172.16.1.100 255.255.255.0HUB(config-if)#tunnel source f0/0HUB(config-if)#tunnel mode gre multipointHUB(config-if)#tunnel key 123HUB(config-if)#ip nhrp network-id 10HUB(config-if)#ip nhrp authentication ciscoHUB(config-if)#ip nhrp map multicast dynamicHUB(config-if)#ip nhrp redirect /第三阶段DMVPN需要在HUB端启用NHRP重定向，这样中心站点才会给分支站点发送NHRP重定向信息来优化下一跳（第二阶段无这条命令）-MGRE NHRP配置-HUB(config)#router eig 90HUB(config-router)#no auHUB(config-router)#net 172.16.1.0 0.0.0.255 /（第二阶段还要宣告192.168.100.0）HUB(config)#int tunnel 0HUB(config-if)#ip summary-address eig 90 192.168.0.0 255.255.0.0/这里不需要关闭水平分割，也不需要no掉ip next-hop-self eigrp 90 来优化路由，只需要中心给所有的分支发送一条汇总路由-动态路由配置-HUB(config)#crypto isakmp policy 10HUB(config-isakmp)#authentication pre-shareHUB(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0HUB(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacHUB(cfg-crypto-trans)#mode transportHUB(config)#crypto ipsec profile dmvpnHUB(ipsec-profile)#set transform-set ciscoHUB(config)#int tunnel 0HUB(config-if)#ip mtu 1400 HUB(config-if)#tunnel protection ipsec profile dmvpn -IPSEC VPN配置-HUB END-spoke1spoke1(config)#int tunnel 0spoke1(config-if)#ip address 172.16.1.1 255.255.255.0spoke1(config-if)#tunnel source f0/0spoke1(config-if)#tunnel mode gre multipointspoke1(config-if)#tunnel key 123spoke1(config-if)#ip nhrp network-id 10spoke1(config-if)#ip nhrp authentication ciscospoke1(config-if)#ip nhrp map 172.16.1.100 202.100.1.100spoke1(config-if)#ip nhrp map multicast 202.100.1.100spoke1(config-if)#ip nhrp nhs 172.16.1.100spoke1(config-if)#ip nhrp shortcut /第三阶段DMVPN需要在所有分支站点启用NHRP短路，这样才能在分支站点间直接建立隧道（shortcut意为捷径，第二阶段无这条命令）-MGRE NHRP配置-spoke1(config)#router eig 90spoke1(config-router)#no auspoke1(config-router)#net 172.16.1.0 0.0.0.255spoke1(config-router)#net 192.168.1.0 0.0.0.255-动态路由配置-spoke1(config)#crypto isakmp policy 10spoke1(config-isakmp)#authentication pre-sharespoke1(config)#crypto isakmp key 0 ciscso address 0.0.0.0 0.0.0.0spoke1(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacspoke1(cfg-crypto-trans)#mode transportspoke1(config)#crypto ipsec profile dmvpnspoke1(ipsec-profile)#set transform-set ciscospoke1(config)#int tunnel 0spoke1(config-if)#ip mtu 1400spoke1(config-if)#tunnel protection ipsec profile dmvpn-IPSEC VPN配置-SPOKE1 END-sopke2sopke2(config)#int tunnel 0sopke2(config-if)#ip address 172.16.1.2 255.255.255.0sopke2(config-if)#tunnel source f0/0sopke2(config-if)#tunnel mode gre multipointsopke2(config-if)#tunnel key 123sopke2(config-if)#ip nhrp network-id 10sopke2(config-if)#ip nhrp authentication ciscosopke2(config-if)#ip nhrp map 172.16.1.100 202.100.1.100 sopke2(config-if)#ip nhrp map multicast 202.100.1.100sopke2(config-if)#ip nhrp nhs 172.16.1.100sopke2(config-if)#ip nhrp shortcut-MGRE NHRP配置-sopke2(config)#router eig 90sopke2(config-router)#no ausopke2(config-router)#net 172.16.1.0 0.0.0.255sopke2(config-router)#net 192.168.2.0 0.0.0.255-动态路由配置-sopke2(config)#crypto isakmp policy 10sopke2(config-isakmp)#authentication pre-sharesopke2(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0sopke2(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacsopke2(cfg-crypto-trans)#mode transportsopke2(config)#crypto ipsec profile dmvpnsopke2(ipsec-profile)#set transform-set ciscosopke2(config)#int tunnel 0sopke2(config-if)#ip mtu 1400sopke2(config-if)#tunnel protection ipsec profile dmvpn-IPSEC VPN配置-SPOKE2 END-单云双中心HUB1HUB1(config)#crypto isakmp policy 10HUB1(config-isakmp)#authentication pre-shareHUB1(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0/由于spoke端的IP地址未知，有可能通过ISP动态获得，所以采用动态方式，sopke端IP为 0.0.0.0HUB1(config)#crypto isakmp keepalive 10 periodicHUB1(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacHUB1(cfg-crypto-trans)#mode transportHUB1(config)#crypto ipsec profile dmvpn HUB1(ipsec-profile)#set transform-set cisco-IPSEC VPN配置-HUB1(config)#int tunnel 0HUB1(config-if)#ip address 172.16.1.100 255.255.255.0HUB1(config-if)#no ip redirects /默认HUB1(config-if)#ip nhrp network-id 10/配置NHRP网路标识号，标识DMVPN所连接的NBMA网络，在接口上激活NHRP，范围为 1-4294967295，同一个mGRE中所有点的标识号必须相同HUB1(config-if)#ip nhrp map multicast dynamic /在hub路由器上启用自动添加spoke路由器到NHRP映射中的功能，实现动态VPN连接HUB1(config-if)#ip nhrp map 172.16.1.101 202.100.1.101/配置hub的GRE接口地址和公网IP地址静态映射HUB1(config-if)#ip nhrp map multicast 202.100.1.101 /开启能向Hub发送组播的功能，从而可以在sopke和hub之间激活动态路由选择协议HUB1(config-if)#ip nhrp holdtime 360 /配置NHRP维持时间，表示改变NHRP NBMA 地址可以在多长时间内被通告才算有效，单位为秒，默认为7200s，范围1-65535，NHRP的spoke端可以维持时间的1/3为周期向hub端注册HUB1(config-if)#ip mtu 1400 /配置隧道接口可以发送IP数据包的MTU，以字节为单位，cisco 推荐值为 1440 或 1436HUB1(config-if)#ip tcp adjust-mss 1360HUB1(config-if)#ip ospf network broadcastHUB1(config-if)#ip ospf cost 100HUB1(config-if)#ip ospf priority 2HUB1(config-if)#delay 1000HUB1(config-if)#tunnel source f0/1HUB1(config-if)#tunnel mode gre multipoint /配置接口采用mGRE封装模式，这种模式不需要配置建立隧道的目的IP地址HUB1(config-if)#tunnel key 123HUB1(config-if)#tunnel protection ipsec profile dmvpn/将IPSec profile 关联到mGRE接口，用于保护mGRE接口的流量-MGRE NHRP配置-HUB1(config)#router ospf 110HUB1(config-router)#net 172.16.1.0 0.0.0.255 area 0HUB1(config-router)#net 192.168.100.0 0.0.0.255 area 0-动态路由配置-HUB1 END-HUB2HUB2(config)#crypto isakmp policy 10HUB2(config-isakmp)#authentication pre-shareHUB2(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0HUB2(config)#crypto isakmp keepalive 10 periodicHUB2(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacHUB2(cfg-crypto-trans)#mode transportHUB2(config)#crypto ipsec profile dmvpnHUB2(ipsec-profile)#set transform-set cisco-IPSEC VPN配置-HUB2(config)#int tunnel 0HUB2(config-if)#ip address 172.16.1.101 255.255.255.0HUB2(config-if)#no ip redirects HUB2(config-if)#ip nhrp network-id 10HUB2(config-if)#ip nhrp map multicast dynamicHUB2(config-if)#ip nhrp map 172.16.1.100 202.100.1.100HUB2(config-if)#ip nhrp map multicast 202.100.1.100HUB2(config-if)#ip nhrp holdtime 360HUB2(config-if)#ip mtu 1400HUB2(config-if)#ip tcp adjust-mss 1360HUB2(config-if)#ip ospf network broadcastHUB2(config-if)#ip ospf cost 105HUB2(config-if)#ip ospf priority 2HUB2(config-if)#delay 1000HUB2(config-if)#tunnel source f0/1HUB2(config-if)#tunnel mode gre multipointHUB2(config-if)#tunnel key 123HUB2(config-if)#tunnel protection ipsec profile dmvpn-MGRE NHRP配置-HUB2(config)#router ospf 110HUB2(config-router)#net 172.16.1.0 0.0.0.255 area 0HUB2(config-router)#net 192.168.100.0 0.0.0.255 area 0-动态路由配置-HUB2 END-spoke1spoke1(config)#crypto isakmp policy 10spoke1(config-isakmp)#authentication pre-sharespoke1(config)#crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0spoke1(config)#crypto isakmp keepalive 10 periodicspoke1(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmacspoke1(cfg-crypto-trans)#mode transportspoke1(config)#crypto ipsec profile dmvpnspoke1(ipsec-profile)#set transform-set cisco-IPSEC VPN配置-spoke1(config)#int tunnel 0spoke1(config-if)#ip address 172.16.1.1 255.255.255.0spoke1(config-if)#no ip redirectsspoke1(config-if)#ip mtu 1400spoke1(config-if)#ip nhrp map 172.16.1.100 202.100.1.100/配置hub的GRE接口地址和公网IP地址静态映射spoke1(config-if)#ip nhrp map multicast 202.100.1.100/开启能向hub发送组播的功能，从而可以在spoke和hub之间激活动态路由选择协议spoke1(config-if)#ip nhrp map 172.16.1.101 202.100.1.101spoke1(config-if)#ip nhrp map multicast 202.100.1.101spoke1(config-if)#ip nhrp network-id 10spoke1(config-if)#ip nhrp holdtime 360spoke1(config-if)#ip nhrp nhs 172.16.1.100spoke1(config-if)#ip nhrp nhs 172.16.1.101/将hub路由器指定为NHRP服务器，注意：是虚拟的IP地址spoke1(config-if)#ip tcp adjust-mss 1360spoke1(config-if)#ip ospf network broadcastspoke1(config-if)#ip ospf priority 0spoke1(config-if)#delay 1000spoke1(config-if)#tunnel source f0/1spoke1(config-if)#tunnel mode gre multipointspoke1(config-if)#tunnel key 123spoke1(config-if)#tunnel protection ipsec profile dmvpn-MGRE NHRP配置-spoke1(config)#router ospf 110spoke1(config-router)#net 172.16.1.0 0.0.0.255 area 0spoke1(config-router)#net 192.168.1.0 0.0.0.255 area 0-动态路由配置-SPOKE1 END-spoke2spoke2(config)#crypto isakmp policy 10spoke2(config-isakmp)#authentication pre-sh