IPSec-Failover高可靠性.doc

IPSec Failover高可靠性实验clip_image001.jpg (13.55 KB)2007-9-2 22:19如图所示，HUB1和HUB2互作IPSec failover。注：目前仅有HSRP支持，VRRP暂不支持此功能。配置如下：Spoke路由器：crypto isakmp policy 10encr 3desauthentication pre-sharegroup 2crypto isakmp key cisco1234 address 0.0.0.0 0.0.0.0!crypto ipsec transform-set ccsp esp-3des esp-sha-hmac !crypto map cisco 10 ipsec-isakmp set peer 16.1.1.254set transform-set ccsp match address 101!interface Loopback0ip address 10.1.1.1 255.255.255.0!interface FastEthernet0/0ip address 173.16.1.2 255.255.255.0crypto map cisco!ip route 10.2.2.0 255.255.255.0 173.16.1.1!access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255HUB1路由器：crypto isakmp policy 10encr 3desauthentication pre-sharegroup 2crypto isakmp key cisco1234 address 0.0.0.0 0.0.0.0!crypto ipsec transform-set ccsp esp-3des esp-sha-hmac !crypto map cisco 10 ipsec-isakmp set peer 173.1.1.2set transform-set ccsp match address 101!interface FastEthernet0/0ip address 16.1.1.1 255.255.255.0duplex halfstandby 10 ip 16.1.1.254standby 10 priority 101standby 10 preemptstandby 10 name ipsec-publicstandby 10 track FastEthernet1/0crypto map cisco redundancy ipsec-public statefulstandby delay reload 120!interface FastEthernet1/0ip address 10.2.2.1 255.255.255.0duplex halfstandby 20 ip 10.2.2.254standby 20 priority 101standby 20 preemptstandby 20 name ipsec-privatestandby 20 track FastEthernet0/0standby delay reload 120!ip route 0.0.0.0 0.0.0.0 16.1.1.3!access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255!redundancy inter-devicescheme standby ipsec-private!ipc zone defaultassociation 1no shutdownprotocol sctp local-port 5000 local-ip 10.2.2.1 remote-port 5000 remote-ip 10.2.2.2HUB2路由器：crypto isakmp policy 10encr 3desauthentication pre-sharegroup 2crypto isakmp key cisco1234 address 0.0.0.0 0.0.0.0!crypto ipsec transform-set ccsp esp-3des esp-sha-hmac !crypto map cisco 10 ipsec-isakmp set peer 173.1.1.2set transform-set ccsp match address 101!interface FastEthernet0/0ip address 16.1.1.2 255.255.255.0duplex halfstandby 10 ip 16.1.1.254standby 10 priority 101standby 10 preemptstandby 10 name ipsec-publicstandby 10 track FastEthernet1/0crypto map cisco redundancy ipsec-public statefulstandby delay reload 120!interface FastEthernet1/0ip address 10.2.2.2 255.255.255.0duplex halfstandby 20 ip 10.2.2.254standby 20 priority 101standby 20 preemptstandby 20 name ipsec-privatestandby 20 track FastEthernet0/0standby delay reload 120!ip route 0.0.0.0 0.0.0.0 16.1.1.3!access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255!redundancy inter-devicescheme standby ips