Gre over ipsec与ipsec over gre.doc

Gre over ipsec（很实用） Gre 实现私网连通性 ipsec实现数据安全性R1 R1#sh runBuilding configuration.Current configuration : 1474 bytes!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R1!boot-start-markerboot-end-marker!no aaa new-modelmemory-size iomem 5ip cef!no ip domain lookup!multilink bundle-name authenticated!archive log config hidekeys! !crypto isakmp policy 10 encr 3des authentication pre-share group 2crypto isakmp key sunan address 13 （对端公网ip）!crypto ipsec transform-set t10 esp-3des esp-sha-hmac （传输模式）!crypto map p1 10 ipsec-isakmp set peer 13 set transform-set t10 match address 111! interface Tunnel0 ip address tunnel source FastEthernet0/0 tunnel destination 13!interface FastEthernet0/0 ip address 12 duplex auto speed auto crypto map p1!interface FastEthernet0/1 ip address duplex auto speed auto!router ospf 1 （使用T0口建立ospf邻居） log-adjacency-changes passive-interface default no passive-interface Tunnel0 network 55 area 0 network 55 area 0! ip forward-protocol nd!no ip http serverno ip http secure-server!access-list 111 permit ip host 12 host 13no cdp run!control-plane!line con 0 exec-timeout 0 0 logging synchronousline aux 0 exec-timeout 0 0 logging synchronousline vty 0 4 loginendR2R2 show run R1#sh runBuilding configuration.Current configuration : 1474 bytes!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R1!boot-start-markerboot-end-marker!no aaa new-modelmemory-size iomem 5ip cef!no ip domain lookup!multilink bundle-name authenticated!archive log config hidekeys! !crypto isakmp policy 10 encr 3des authentication pre-share group 2crypto isakmp key sunan address 13!crypto ipsec transform-set t10 esp-3des esp-sha-hmac !crypto map p1 10 ipsec-isakmp set peer 13 set transform-set t10 match address 111! interface Tunnel0 ip address tunnel source FastEthernet0/0 tunnel destination 13!interface FastEthernet0/0 ip address 12 duplex auto speed auto crypto map p1!interface FastEthernet0/1 ip address duplex auto speed auto!router ospf 1 log-adjacency-changes passive-interface default no passive-interface Tunnel0 network 55 area 0 network 55 area 0! ip forward-protocol nd!no ip http serverno ip http secure-server!access-list 111 permit ip host 12 host 13no cdp run!control-plane! line con 0 exec-timeout 0 0 logging synchronousline aux 0 exec-timeout 0 0 logging synchronousline vty 0 4 loginendipsec配置1. sa一致2. set peer 点是公网ip3. acl 感兴趣流量写 公网主机 到对端公网主机 4. 模式 最好用 隧道模式 传输模式也行 5. 加密图绑在 公网出口上Ipec over gre（没意义）还是上面的拓扑R1 R1 show run R1#sh runBuilding configuration.Current configuration : 1535 bytes!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R1!boot-start-markerboot-end-marker!no aaa new-modelmemory-size iomem 5ip cef!no ip domain lookup!multilink bundle-name authenticated!archive log config hidekeys! !crypto isakmp policy 10 encr 3des authentication pre-share group 2crypto isakmp key sunan address !crypto ipsec transform-set t10 esp-3des esp-sha-hmac !crypto map p1 local-address Loopback0crypto map p1 10 ipsec-isakmp set peer set transform-set t10 match address 111!interface Loopback0 ip address 55!interface Tunnel0 ip address tunnel source FastEthernet0/0 tunnel destination 13 crypto map p1!interface FastEthernet0/0 ip address 12 duplex auto speed auto!interface FastEthernet0/1 ip address duplex auto speed auto!router ospf 1 log-adjacency-changes network area 0 network 55 area 0 network 55 area 0!ip forward-protocol nd!no ip http serverno ip http secure-server!access-list 111 permit ip 55 55no cdp run!control-plane!line con 0 exec-timeout 0 0 logging synchronousline aux 0 exec-timeout 0 0 logging synchronousline vty 0 4 login!EndR2 R2 show run Building configuration.Current configuration : 1535 bytes!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R2!boot-start-markerboot-end-marker!no aaa new-modelmemory-size iomem 5ip cef!no ip domain lookup! *Mar 1 00:13:36.259: %SYS-5-CONFIG_I: Configured from console by consolemultilink bundle-name authenticated!archive log config hidekeys! !crypto isakmp policy 10 encr 3des authentication pre-share group 2crypto isakmp key sunan address !crypto ipsec transform-set t10 esp-3des esp-sha-hmac （2种模式都可以）!crypto map p1 local-address Loopback0 （使用loopback 地址建立peer为了引流量）crypto map p1 10 ipsec-isakmp set peer set transform-set t10 match address 111! interface Loopback0 ip address 55!interface Tunnel0 ip address tunnel source FastEthernet0/0 tunnel destination 12 crypto map p1!interface FastEthernet0/0 ip address 13 duplex auto speed auto!interface FastEthernet0/1 ip address duplex auto speed auto!router ospf 1 （T0口建立ospf