ipsecvpn高级应用(1)反向路由注入.doc

反向路由注入R1R2R3R4预配interface Loopback0 ip address 1.1.1.1 255.255.255.255interface Serial1/1 ip address 10.1.12.1 255.255.255.0 serial restart-delay 0ip route 0.0.0.0 0.0.0.0 10.1.12.2预配interface Loopback0 ip address 2.2.2.2 255.255.255.255interface Serial1/0 ip address 10.1.12.2 255.255.255.0 serial restart-delay 0interface Serial1/1 ip address 10.1.23.2 255.255.255.0 serial restart-delay 0预配interface Loopback0 ip address 3.3.3.3 255.255.255.255interface Serial1/0 ip address 10.1.23.3 255.255.255.0 serial restart-delay 0interface Serial1/1 ip address 10.1.34.3 255.255.255.0 serial restart-delay 0router ospf 1 log-adjacency-changes network 10.1.34.3 0.0.0.0 area 0ip route 0.0.0.0 0.0.0.0 10.1.23.2预配interface Loopback0 ip address 4.4.4.4 255.255.255.255interface Serial1/0 ip address 10.1.34.4 255.255.255.0 serial restart-delay 0router ospf 1 log-adjacency-changes network 0.0.0.0 255.255.255.255 area 0配置一个L2L的VPNaccess-list 100 permit ip host 1.1.1.1 host 4.4.4.4crypto isakmp policy 10 authentication pre-sharecrypto isakmp key cisco address 10.1.23.3crypto ipsec transform-set cisco esp-3des esp-md5-hmac crypto map cisco 10 ipsec-isakmp set peer 10.1.23.3 set transform-set cisco match address 100interface Serial1/1 ip address 10.1.12.1 255.255.255.0 serial restart-delay 0 crypto map cisco配置一个L2L的VPNaccess-list 100 permit ip host 4.4.4.4 host 1.1.1.1crypto isakmp policy 10 authentication pre-sharecrypto isakmp key cisco address 10.1.12.1crypto ipsec transform-set cisco esp-3des esp-md5-hmac crypto map cisco 10 ipsec-isakmp set peer 10.1.12.1 set transform-set cisco match address 100interface Serial1/0 ip address 10.1.23.3 255.255.255.0 serial restart-delay 0 crypto map ciscoSiteB去不了SiteA，因为在Inside中并没有去往1.1.1.1的路由通过在SiteB上写一个静态路由，重分发进OSPF中，让Inside学到去1.1.1.1的路由crypto map cisco 10 ipsec-isakmp reverse-route（当产生sa的时候，会产生一条静态路由）*在做试验的时候，如果对这个命令后面加关键字的时候，要记得清IPSEC连接状态，因为反向路由是在IPSEC连接后才产生的*router ospf 1redistribute static subnets reverse-route +关键字 static (直一但触发了ipsec sa会一直产生一个静态路由，即使ipsec sa超时也不会消失) +关键字 tag (为产生的反向路由加个tag标记，当重分发进OPSF的时候，可以做route-map精确匹配) +关键字