H3CTE实验：GRE-over-IPsec.doc

H3CTE实验：GRE Over IPsecVPN+OSPF实验拓扑：配置脚本：R1dis currinterface Ethernet0/0/0 port link-mode route ip address 192.168.1.2 255.255.255.0#ip route-static 0.0.0.0 0.0.0.0 192.168.1.1#R5dis currinterface Ethernet0/0/0 port link-mode route ip address 192.168.2.2 255.255.255.0# ip route-static 0.0.0.0 0.0.0.0 192.168.2.1#R2dis curr#acl number 3000 rule 0 permit ip source 10.1.23.2 0 destination 10.1.34.4 0 rule 5 deny ip#domain ekestin authentication ppp local access-limit disable state active idle-cut disable self-service-url disable#ike proposal 1#ike peer peer1 proposal 1 pre-shared-key simple ekestin remote-address 10.1.34.4 local-address 10.1.23.2#ipsec proposal 1 esp authentication-algorithm sha1 esp encryption-algorithm aes 128#ipsec policy map 10 isakmp security acl 3000 ike-peer peer1 proposal 1 #local-user R2 password simple ekestin service-type ppp#interface Ethernet0/0/0 port link-mode route ip address 192.168.1.1 255.255.255.0#interface Serial0/0/0 link-protocol ppp ppp authentication-mode chap domain ekestin ppp chap user R3 ppp chap password simple ekestin ip address ppp-negotiate ipsec policy map#interface LoopBack0 ip address 2.2.2.2 255.255.255.255#interface Tunnel0 ip address 10.1.100.1 255.255.255.0 source 10.1.23.2 destination 10.1.34.4# ospf 1 area 0.0.0.0 network 10.1.23.2 0.0.0.0#ospf 2 area 0.0.0.0 network 10.1.100.1 0.0.0.0 network 192.168.1.1 0.0.0.0# ip route-static 192.168.2.0 255.255.255.0 Tunnel0#R4dis curr#acl number 3000 rule 0 permit ip source 10.1.34.4 0 destination 10.1.23.2 0 rule 5 deny ip#domain ekestinauthentication ppp local access-limit disable state active idle-cut disable self-service-url disable#ike proposal 1#ike peer peer1 proposal 1 pre-shared-key simple ekestin remote-address 10.1.23.2 local-address 10.1.34.4#ipsec proposal 1 esp authentication-algorithm sha1 esp encryption-algorithm aes 128#ipsec policy map 10 isakmp security acl 3000 ike-peer peer1 proposal 1#local-user R4 password simple ekestin service-type ppp#interface Ethernet0/0/0 port link-mode route ip address 192.168.2.1 255.255.255.0#interface Serial0/0/0 link-protocol ppp ppp mp Mp-group 1#interface Serial0/0/1 link-protocol ppp ppp mp Mp-group 1#interface Mp-group1 ip address 10.1.34.4 255.255.255.0 ipsec policy map# interface LoopBack0 ip address 4.4.4.4 255.255.255.255#interface Tunnel0 ip address 10.1.100.2 255.255.255.0 source 10.1.34.4 destination 10.1.23.2#ospf 1 area 0.0.0.0 network 10.1.34.4 0.0.0.0# ospf 2 area 0.0.0.0 network 192.168.2.1 0.0.0.0 network 10.1.100.2 0.0.0.0# ip route-static 192.168.1.0 255.255.255.0 Tunnel0R3dis curr# domain default enable ekestin# router id 3.3.3.3# rpr mac-address timer aging 100#domain ekestin authentication ppp local access-limit disable state active idle-cut disable self-service-url disable ip pool 1 10.1.23.2domain system access-limit disable state active idle-cut disable self-service-url disable#local-user R3 password simple ekestin service-type ppp#interface Serial0/0/0 link-protocol ppp ppp authentication-mode chap domain ekestin ppp chap user R2 ppp chap password simple ekestin ppp ipcp remote-address forced remote address pool 1 ip address 10.1.23.3 255.255.255.0#interface Serial0/0/1 link-protocol ppp ppp mp Mp-group 1#interface Serial0/0/2 link-protocol ppp ppp mp Mp-group 1#interface Mp-group1 ip address 10.1.34.3 255.255.255.0#interface LoopBack0 ip address 3.3.3.3 255.255.255.255#ospf 1 area 0.0.0.0 network 10.1.23.3 0.0.0.0 network 10.1.34.3 0.0.0.0R5 ping -c 1000 192.168.1.2 PING 192.168.1.2: 56 data bytes, press CTRL_C to break Reply from 192.168.1.2: bytes=56 Sequence=1 ttl=253 time=30 ms Reply from 192.168.1.2: bytes=56 Sequence=2 ttl=253 time=4 ms Reply from 192.168.1.2: bytes=56 Sequence=3 ttl=253 time=35 ms Reply from 192.168.1.2: bytes=56 Sequence=4 ttl=253 time=11 ms Reply from 192.168.1.2: bytes=56 Sequence=5 ttl=253 time=25 ms R1ping -c 1000 192.168.2.2 PING 192.168.2.2: 56 data bytes, press CTRL_C to break Reply from 192.168.2.2: bytes=56 Sequence=1 ttl=253 time=44 ms Reply from 192.168.2.2: bytes=56 Seque