5、ospf双进程外网在左边

1、OSPF 双进程在左边拓扑需求1、SW1 与 SW2、SW3 之间运行 MSTP。SW2 和 SW3 运行 VRRP。业务 A 走 SW1，业务 B 走SW2。上行故障时可以切换，vrrp 启用认证2、SW1、SW2、RT1 和 RT2 四台设备运行 OSPF（进程 1）。RT1 与 RT2 之间的链路运行在 OSPF进程 1。3、RT1、RT2、RT3 和 RT4 四台设备运行 OSPF（进程 100）。OSPF 100 启用验证。4、OSPF1 和 OSPF100 双向引入。5、RT3 和 RT4 运行 VRRP。业务 A 走RT3，业务 B 走 RT4。6、总部 RT1 与分部 1 的R

2、T3 通过公网接口建立 GRE Over IPSec，RT1 与分部 2 的 RT5 建立GRE Over IPSec。以 loack 接口建立 tunnel，以策略模板建立7 、 网络中所有链路正常的情况下， 总部与分部 1 之间业务 A 的路径为 SW3-SW1-RT1-RT3-SW4。总部与分部 1 之间业务 B 的路径为 SW3-SW2-RT2-RT4-SW4。8、通过修改 Route-policy（不能修改 cost），当 RT1 与 RT3 之间的链路为网通，RT2 与 RT4之间的链路为电信。当网通断，电信正常时，两种业务走电信。当电信断，网通正常时，两种业务走网通。当网通和电信

3、全断时，通过 RT1 与 RT3 之间的 GRE Over IPSec 链路保证业务 A 传输。要求通过浮动静态路由来实现。9、分部 2 的 RT5 与总部的 RT1 建立GRE Over IPSec，要求二者之间运行静态路由。题目明确要求，GRE Over IPSec 链路之间不运行动态路由协议，运行静态路由。10、分别在 RT3 和 RT4 的广域网接口（网通和电务 A 的优先转发。口）启用 QOS 功能，通过 qos 保证业11、r1 与 r3 之间 chap 认证，r2 与 r4 之间 mp-group 绑定，配置rt1#sysname rt1#ike local-name rt1#r

4、outer id 10.254.0.1#ip ttl-expires enableip unreachables enable#acl number 2000rule 0 permit source 192.168.0.0 0.0.255.255acl number 2001rule 0 permit source 172.16.0.0 0.0.255.255acl number 2002rule 0 permit source 192.169.1.0 0.0.0.255acl number 2003rule 0 permit source 172.17.1.0 0.0.0.255acl nu

5、mber 2005rule 0 permit source 192.192.1.0 0.0.0.255rule 5 permit source 192.169.1.0 0.0.0.255#ike peer rt3exchange-mode aggressive pre-shared-key simple 123 id-type nameremote-name rt3#ike peer rt5exchange-mode aggressive pre-shared-key simple 123 id-type nameremote-name rt5#ipsec pro#al 1ipsec poli

6、cy-template rt3 1ike-peer rt3proal 1#ipsec policy-template rt5 1 ike-peer rt5proal 1#ipsec policy r35 1 isakmp template rt3 #ipsec policy r35 2 isakmp template rt5 #local-user r3 password simple h3c service-type ppp#erfaerial0/2/0link-protocol pppppp authentication-mode chap ppp chap user r1ip addre

7、ss 10.3.11.253 255.255.255.252ospf authentication-mode simple plain h3c ospf cost 30#erface Loack0ip address 10.254.0.1 255.255.255.255#erface Loack100ip address 10.10.10.1 255.255.255.255#erface GigabitEthernet0/1/0port link-mode routeip address 10.3.11.1 255.255.255.252ospf authentication-mode sim

8、ple plain h3c ospf cost 10#erface GigabitEthernet0/1/1port link-mode routeip address 10.3.11.5 255.255.255.252ospf cost 10#erface GigabitEthernet0/1/2port link-mode routeip address 61.67.1.1 255.255.255.0ipsec policy r35#erface Tunnel0ip address 13.1.1.1 255.255.255.0source Loack100destination 10.10

9、.10.3keepalive 10 3#erface Tunnel1ip address 15.1.1.1 255.255.255.0source Loack100destination 10.10.10.5keepalive 10 3#ospf 1import-route sic type 1 route-policy p5 import-route ospf 100 type 1 route-policy p2 area 0.0.0.0network 10.3.11.5 0.0.0.0network 10.3.11.1 0.0.0.0network 10.254.0.1 0.0.0.0ne

10、twork 192.168.255.253 0.0.0.0network 172.16.255.253 0.0.0.0#ospf 100import-route ospf 1 type 1 route-policy p1 area 0.0.0.0authentication-mode simple network 10.3.11.253 0.0.0.0#route-policy p1 permit node 10 if-match acl 2000apply cost 500route-policy p1 permit node 20 if-match acl 2001apply cost 1

11、000route-policy p2 permit node 10 if-match acl 2002apply cost 100route-policy p2 permit node 20 if-match acl 2003apply cost 1000route-policy p5 permit node 10 if-match acl 2005apply cost 5000#ip route-sip route-s ip route-sic 0.0.0.0 0.0.0.0 61.67.1.2ic 192.169.1.0 255.255.255.0 Tunnel0 preference 2

12、50ic 192.192.1.0 255.255.255.0 Tunnel1 preference 250#rt1 die satotal phase-1 SAs:2connection-idpeerflagphase9131114202.112.1.1202.112.1.164.67.1.164.67.1.1RDRD RD RD1212IPSECIPSEC IPSEC IPSECflag meaningRD-READY ST-STAYALIVE RL-REPLACED FD-FADING TO-TIMEOUTrt1disp ipsec sa=erface: GigabitEthernet0/

13、1/2 path MTU: 1500=IPsec policy name: r35sequence number: 1 mode: templateconnection id: 6encapsulation mode: tunnel perfect forward secrecy: tunnel:localaddress: 61.67.1.1remote address: 202.112.1.1 flow:sour addr: 10.10.10.1/255.255.255.255port: 0protocol: IPdest addr: 10.10.10.5/255.255.255.255po

14、rt: 0protocol: IPinbound ESP SAsspi: 1270198313 (0 x4bb5b029)proal: ESP-ENCRYPT-DES ESP-AUTH-MD5sa duration (kilobytes/sec): 1843200/3600sa remaining duration (kilobytes/sec): 1843166/-171 max received sequence-number: 762anti-replay check enable: Y anti-replay window size: 32udp encapsulation used

15、for nat traversal: Noutbound ESP SAsspi: 3692379999 (0 xdc153f5f)proal: ESP-ENCRYPT-DES ESP-AUTH-MD5sa duration (kilobytes/sec): 1843200/3600sa remaining duration (kilobytes/sec): 1843167/-171 max received sequence-number: 763udp encapsulation used for nat traversal: NIPsec policy name: r35sequence

16、number: 1 mode: templateconnection id: 7encapsulation mode: tunnel perfect forward secrecy:tunnel:localaddress: 61.67.1.1remote address: 64.67.1.1 flow:sour addr: 10.10.10.1/255.255.255.255port: 0protocol: IPdest addr: 10.10.10.3/255.255.255.255port: 0protocol: IPinbound ESP SAsspi: 131070937 (0 x7c

17、d9)proal: ESP-ENCRYPT-DES ESP-AUTH-MD5sa duration (kilobytes/sec): 1843200/3600sa remaining duration (kilobytes/sec): 1843166/-171max received sequence-number: 770anti-replay check enable: Y anti-replay window size: 32udp encapsulation used for nat traversal: Noutbound ESP SAsspi: 348651931 (0 x14c8

18、019b)proal: ESP-ENCRYPT-DES ESP-AUTH-MD5sa duration (kilobytes/sec): 1843200/3600sa remaining duration (kilobytes/sec): 1843166/-171 max received sequence-number: 771udp encapsulation used for nat traversal: N rt1disp ip routing-tableRouting Tables: PublicDestinations : 30Routes : 30Destination/Mask

19、ProtoPreCostNextHoperface0.0.0.0/010.3.11.0/3010.3.11.1/3210.3.11.4/3010.3.11.5/3210.3.11.8/3010.3.11.12/3010.3.11.248/3010.3.11.252/3010.3.11.253/3210.3.11.254/3210.10.10.1/3210.253.0.0/2410.254.0.1/3210.254.0.2/3210.254.0.3/3210.254.0.4/3213.1.1.0/2413.1.1.1/3215.1.1.0/2415.1.1.1/3261.67.1.0/2461.

20、67.1.1/32127.0.0.0/8127.0.0.1/32172.16.0.0/16Sic 60Direct 0Direct 0Direct 0Direct 0 OSPF OSPF OSPFDirect 0Direct 0Direct 0Direct 0 OSPFDirect 0 OSPF OSPF OSPFDirect 0Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0 OSPF0000061.67.1.210.3.11.1127.0.0.110.3.11.5127.0.0.110.3.11.210.3.11.25410.

21、3.11.25410.3.11.253127.0.0.110.3.11.254127.0.0.110.3.11.6127.0.0.110.3.11.210.3.11.610.3.11.613.1.1.1127.0.0.115.1.1.1127.0.0.161.67.1.1127.0.0.1127.0.0.1127.0.0.110.3.11.6GE0/1/2GE0/1/0InLoop0 GE0/1/1InLoop0 GE0/1/0S0/2/0 S0/2/0S0/2/0 InLoop0 S0/2/0 InLoop0GE0/1/1InLoop0 GE0/1/0 GE0/1/1 GE0/1/1Tun0

22、 InLoop0 Tun1 InLoop0 GE0/1/2InLoop0 InLoop0 InLoop0GE0/1/1101010204060000010110101010101011000000001012172.17.1.0/24192.168.0.0/16192.169.1.0/24192.192.1.0/24O_ASEOSPF O_ASE150101501101153010.3.11.210.3.11.610.3.11.25415.1.1.1GE0/1/0GE0/1/1S0/2/0 Tun1Sic 2500rt2#sysname rt2#router id 10.254.0.2 #ip

23、 ttl-expires enableip unreachables enable#acl number 2000rule 0 permit source 192.168.0.0 0.0.255.255acl number 2001rule 0 permit source 172.16.0.0 0.0.255.255acl number 2002rule 0 permit source 192.169.1.0 0.0.0.255acl number 2003rule 0 permit source 172.17.1.0 0.0.0.255#local-user h3c password sim

24、ple rt2 service-type ppp#erfaerial0/2/0link-protocol pppppp mp Mp-group 1#erfaerial0/2/1link-protocol pppppp mp Mp-group 1#erface Mp-group1ip address 10.3.11.249 255.255.255.252ospf authentication-mode simple plain h3c ospf cost 20#erface Loack0ip address 10.254.0.2 255.255.255.255#erface GigabitEth

25、ernet0/1/0port link-mode routeip address 10.3.11.2 255.255.255.252ospf authentication-mode simple plain h3c ospf cost 10#erface GigabitEthernet0/1/1port link-mode routeip address 10.3.11.9 255.255.255.252ospf cost 10#ospf 1import-route ospf 100 type 1 route-policy p2 area 0.0.0.0network 10.3.11.9 0.

26、0.0.0network 10.3.11.2 0.0.0.0network 10.254.0.2 0.0.0.0network 192.168.255.252 0.0.0.0network 172.16.255.252 0.0.0.0#ospf 100import-route ospf 1 type 1 route-policy p1 area 0.0.0.0authentication-mode simple network 10.3.11.249 0.0.0.0#route-policy p1 permit node 10 if-match acl 2000apply cost 1000r

27、oute-policy p1 permit node 20 if-match acl 2001apply cost 500route-policy p2 permit node 10 if-match acl 2002apply cost 1000route-policy p2 permit node 20 if-match acl 2003apply cost 100 rt2disp ip routing-tableRouting Tables: PublicDestinations : 22Routes : 22Destination/MaskProtoPreCostNextHoperfa

28、ce10.3.11.0/3010.3.11.2/3210.3.11.4/3010.3.11.8/3010.3.11.9/3210.3.11.12/3010.3.11.248/3010.3.11.249/3210.3.11.250/3210.3.11.252/3010.253.0.0/2410.254.0.1/3210.254.0.2/3210.254.0.3/3210.254.0.4/32127.0.0.0/8127.0.0.1/32172.16.0.0/16172.17.1.0/24192.168.0.0/16192.169.1.0/24192.192.1.0/24Direct 0Direc

29、t 0 OSPFDirect 0Direct 0 OSPFDirect 0Direct 0Direct 0 OSPF OSPF OSPFDirect 0 OSPF OSPFDirect 0Direct 0 OSPF O_ASE OSPF O_ASE O_ASE0010.3.11.2127.0.0.110.3.11.110.3.11.9127.0.0.110.3.11.25010.3.11.249127.0.0.110.3.11.25010.3.11.25010.3.11.1010.3.11.1127.0.0.110.3.11.1010.3.11.10127.0.0.1127.0.0.110.3

30、.11.1010.3.11.25010.3.11.1010.3.11.110.3.11.1GE0/1/0InLoop0 GE0/1/0GE0/1/1InLoop0Mp-group1 Mp-group1 InLoop0Mp-group1 Mp-group1 GE0/1/1 GE0/1/0InLoop0 GE0/1/1 GE0/1/1InLoop0 InLoop0GE0/1/1Mp-group1 GE0/1/1 GE0/1/0 GE0/1/0102000103000010101060111001010111000101501015015011520121105010rt3#sysname rt3#

31、ike local-name rt3#router id 10.254.1.1#ip ttl-expires enableip unreachables enable#qos pql 1 protocol ip acl 3001 queue top#acl number 2000rule 0 permit source 192.169.1.0 0.0.0.255acl number 2001rule 0 permit source 172.17.1.0 0.0.0.255acl number 2005rule 0 permit source 192.168.0.0 0.0.255.255#ac

32、l number 3000rule 0 permit ip source 10.10.10.3 0 destination 10.10.10.1 0acl number 3001rule 0 permit ip source 192.169.1.0 0.0.0.255 destination 192.168.0.0 0.0.255.255#vlan 10 #vlan 20 #ike peer rt1exchange-mode aggressive pre-shared-key simple 123 id-type nameremote-name rt1remote-address 61.67.

33、1.1#ipsec pro#al 1ipsec policy rt1 1 isakmpsecurity acl 3000 ike-peer rt1proal 1#local-user r1 password simple h3c service-type ppp#erfaerial0/2/0link-protocol pppppp authentication-mode chap ppp chap user r3ip address 10.3.11.254 255.255.255.252ospf authentication-mode simple plain h3c ospf cost 30

34、qos pq pql 1#erface Loack0ip address 10.254.1.1 255.255.255.255#erface Loack100ip address 10.10.10.3 255.255.255.255#erface Vlan-erface10ip address 192.169.1.253 255.255.255.0vrrp vrid 10 virtual-ip 192.169.1.254vrrp vrid 10 priority 105vrrp vrid 10 trackerfaerial0/2/0#erface Vlan-erface20shutdownip

35、 address 172.17.1.253 255.255.255.0vrrp vrid 20 virtual-ip 172.17.1.254#erface Ethernet0/4/0port link-mode bridge port link-type trunkport trunk permit vlan 1 10 20ipx encapsulation ethernet-2#erface GigabitEthernet0/1/0port link-mode routeip address 10.3.11.13 255.255.255.252ospf authentication-mod

36、e simple plain h3c ospf cost 10#erface GigabitEthernet0/1/1port link-mode routeip address 64.67.1.1 255.255.255.0ipsec policy rt1#erface Tunnel0ip address 13.1.1.3 255.255.255.0source Loack100destination 10.10.10.1keepalive 10 3#ospf 100import-route direct type 1 route-policy p1 import-route s ic ty

37、pe 1 route-policy p5 area 0.0.0.0authentication-mode simple network 10.3.11.13 0.0.0.0network 10.3.11.254 0.0.0.0#route-policy p1 permit node 10if-match acl 2000apply cost 500route-policy p1 permit node 20 if-match acl 2001apply cost 1000route-policy p5 permit node 10 if-match acl 2005apply cost 500

38、0#ip route-sic 0.0.0.0 0.0.0.0 64.67.1.2ip route-sic 192.168.0.0 255.255.0.0 Tunnel0 preference 200rt3die satotal phase-1 SAs:1connection-idpeerflagphase8561.67.1.161.67.1.1RD|STRD|ST21IPSECIPSECflag meaningRD-READY ST-STAYALIVE RL-REPLACED FD-FADING TO-TIMEOUTrt3disp ipse rt3disp ipsec sa=erface: G

39、igabitEthernet0/1/1 path MTU: 1500=IPsec policy name: rt1sequence number: 1 mode: isakmpconnection id: 4encapsulation mode: tunnel perfect forward secrecy:tunnel:localaddress: 64.67.1.1remote address: 61.67.1.1 flow:sour addr: 10.10.10.3/255.255.255.255dest addr: 10.10.10.1/255.255.255.255port: 0pro

40、tocol: IPport: 0protocol: IPinbound ESP SAsspi: 724980060 (0 x2b36515c)proal: ESP-ENCRYPT-DES ESP-AUTH-MD5sa duration (kilobytes/sec): 1843200/3600sa remaining duration (kilobytes/sec): 1843199/3580 max received sequence-number: 4anti-replay check enable: Y anti-replay window size: 32udp encapsulati

41、on used for nat traversal: Noutbound ESP SAsspi: 2300243273 (0 x891aed49)proal: ESP-ENCRYPT-DES ESP-AUTH-MD5sa duration (kilobytes/sec): 1843200/3600sa remaining duration (kilobytes/sec): 1843199/3580 max received sequence-number: 5udp encapsulation used for nat traversal: N rt3disp ip routing-table

42、Routing Tables: PublicDestinations : 21Routes : 21Destination/MaskProtoPreCostNextHoperface0.0.0.0/010.3.11.12/3010.3.11.13/3210.3.11.248/3010.3.11.252/3010.3.11.253/3210.3.11.254/3210.10.10.3/3210.254.1.1/3213.1.1.0/2413.1.1.3/3264.67.1.0/2464.67.1.1/32127.0.0.0/8127.0.0.1/32172.16.0.0/16172.17.1.0

43、/24192.168.0.0/16192.169.1.0/24192.169.1.253/32192.169.1.254/32Sic 60Direct 0Direct 0 OSPFDirect 0Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0 O_ASE O_ASE O_ASEDirect 0Direct 0Direct 100064.67.1.210.3.11.13127.0.0.110.3.11.1410.3.11.25410.3.11.253127.0.0.1127.0.0.

44、1127.0.0.113.1.1.3127.0.0.164.67.1.1127.0.0.1127.0.0.1127.0.0.110.3.11.1410.3.11.1410.3.11.253192.169.1.253127.0.0.1127.0.0.1GE0/1/1GE0/1/0InLoop0 GE0/1/0S0/2/0 S0/2/0 InLoop0 InLoop0 InLoop0 Tun0 InLoop0 GE0/1/1InLoop0 InLoop0 InLoop0GE0/1/0 GE0/1/0S0/2/0 Vlan10 InLoop0InLoop01030000000000001501501

45、50000530510530rt3disp vrrpIPv4 Standby Information:Run ModeRun Method: Standard: Virtual MACTotal number of virtual routers : 2erfaceVRIDSeRunPriAdverTimerAuthTypeVirtualIPVlan10Vlan201020MasterInitialize1051001NoneNone192.169.1.254172.17.1.2541rt4#sysname rt4#router id 10.254.1.2#ip ttl-expires ena

46、bleip unreachables enable#qos pql 1 protocol ip acl 3001 queue top#acl number 2000rule 0 permit source 192.169.1.0 0.0.0.255acl number 2001rule 0 permit source 172.17.1.0 0.0.0.255#acl number 3001rule 0 permit ip source 192.169.1.0 0.0.0.255 destination 192.168.0.0 0.0.255.255#vlan 10 #vlan 20#erfae

47、rial0/2/0link-protocol pppppp mp Mp-group 1#erfaerial0/2/1link-protocol pppppp mp Mp-group 1#erface Mp-group1ip address 10.3.11.250 255.255.255.252ospf authentication-mode simple plain h3c ospf cost 20qos pq pql 1#erface Loack0ip address 10.254.1.2 255.255.255.255#erface Vlan-erface10shutdownip addr

48、ess 192.169.1.252 255.255.255.0vrrp vrid 10 virtual-ip 192.169.1.254#erface Vlan-erface20ip address 172.17.1.252 255.255.255.0vrrp vrid 20 virtual-ip 172.17.1.254vrrp vrid 20 priority 105vrrp vrid 20 trackerface Mp-group1#erface Ethernet0/4/0port link-mode bridge port link-type trunkport trunk permi

49、t vlan 1 10 20ipx encapsulation ethernet-2#erface GigabitEthernet0/1/0port link-mode routeip address 10.3.11.14 255.255.255.252ospf authentication-mode simple plain h3c ospf cost 10#ospf 100import-route direct type 1 route-policy p1 area 0.0.0.0authentication-mode simple network 10.3.11.14 0.0.0.0ne

50、twork 10.3.11.250 0.0.0.0#route-policy p1 permit node 10 if-match acl 2000apply cost 1000route-policy p1 permit node 20if-match acl 2001apply cost 500 rt4disp ip routing-table Routing Tables: PublicDestinations : 15Routes : 15Destination/MaskProtoPreCostNextHoperface10.3.11.12/3010.3.11.14/3210.3.11

51、.248/3010.3.11.249/3210.3.11.250/3210.3.11.252/3010.254.1.2/32127.0.0.0/8127.0.0.1/32172.16.0.0/16172.17.1.0/24172.17.1.252/32172.17.1.254/32192.168.0.0/16192.169.1.0/24rt4disp vrrpDirect 0Direct 0Direct 0Direct 0Direct 0 OSPFDirect 0Direct 0Direct 0 O_ASEDirect 0Direct 0Direct 10000010.3.11.14127.0

52、.0.110.3.11.25010.3.11.249127.0.0.110.3.11.13127.0.0.1127.0.0.1127.0.0.110.3.11.249172.17.1.252127.0.0.1127.0.0.110.3.11.1310.3.11.13GE0/1/0InLoop0 Mp-group1 Mp-group1 InLoop0GE0/1/0InLoop0 InLoop0 InLoop0Mp-group1 Vlan20 InLoop0 InLoop0GE0/1/0GE0/1/01040000150000520O_ASE150O_ASE150540510IPv4 Standb

53、y Information:Run ModeRun Method: Standard: Virtual MACTotal number of virtual routers : 2erfaceVRIDSeRunPriAdverAuthVirtualIPTimerTypeVlan10Vlan201020InitializeMaster1001051NoneNone192.169.1.254172.17.1.2541rt5#sysname rt5#ike local-name rt5#router id 10.254.2.1#ip ttl-expires enableip unreachables

54、 enable#acl number 3001rule 0 permit ip source 10.10.10.5 0 destination 10.10.10.1 0# #ike peer rt1exchange-mode aggressive pre-shared-key simple 123 id-type nameremote-name rt1remote-address 61.67.1.1#ipsec pro#al 1ipsec policy rt1 1 isakmpsecurity acl 3001 ike-peer rt1proal 1#erface Loack0ip addre

55、ss 10.254.2.1 255.255.255.255#erface Loack10ip address 192.192.1.1 255.255.255.255#erface Loack100ip address 10.10.10.5 255.255.255.255#erface GigabitEthernet0/1/0port link-mode routeip address 202.112.1.1 255.255.255.0ipsec policy rt1#erface Tunnel1ip address 15.1.1.5 255.255.255.0source Loack100de

56、stination 10.10.10.1keepalive 10 3#ip route-sic 0.0.0.0 0.0.0.0 202.112.1.2ip route-sic 192.0.0.0 255.0.0.0 10.5.1.5ip route-sic 192.168.0.0 255.255.0.0 Tunnel1#rt5disp ip routing-table Routing Tables: PublicDestinations : 11Routes : 11Destination/MaskProtoPreCostNextHoperface0.0.0.0/010.10.10.5/321

57、0.254.2.1/3215.1.1.0/2415.1.1.5/32127.0.0.0/8127.0.0.1/32192.168.0.0/16192.192.1.1/32202.112.1.0/24202.112.1.1/32Sic 60Direct 0Direct 0Direct 0Direct 0Direct 0Direct 0Sic 60Direct 0Direct 0Direct 000000000000202.112.1.2127.0.0.1127.0.0.115.1.1.5127.0.0.1127.0.0.1127.0.0.115.1.1.5127.0.0.1202.112.1.1

58、127.0.0.1GE0/1/0InLoop0 InLoop0 Tun1 InLoop0 InLoop0 InLoop0 Tun1 InLoop0 GE0/1/0InLoop0rt5die satotal phase-1 SAs:1connection-idpeerflagphase141761.67.1.161.67.1.1RD|STRD|ST12IPSECIPSECflag meaningRD-READY ST-STAYALIVE RL-REPLACED FD-FADING TO-TIMEOUTrt5disp ipsec sa=erface: GigabitEthernet0/1/0 pa

59、th MTU: 1500=IPsec policy name: rt1sequence number: 1 mode: isakmpconnection id: 5encapsulation mode: tunnel perfect forward secrecy: tunnel:localaddress: 202.112.1.1remote address: 61.67.1.1 flow:sour addr: 10.10.10.5/255.255.255.255port: 0protocol: IPdest addr: 10.10.10.1/255.255.255.255port: 0pro

60、tocol: IPinbound ESP SAsspi: 2285971553 (0 x88412861)proal: ESP-ENCRYPT-DES ESP-AUTH-MD5sa duration (kilobytes/sec): 1843200/3600sa remaining duration (kilobytes/sec): 1843196/3238 max received sequence-number: 72anti-replay check enable: Y anti-replay window size: 32udp encapsulation used for nat t