Dynamic-to-Static IPSec with NAT

sam-i-am

Current configuration:

!

version 12.2

service timestamps debug uptime 

service timestamps log up time

no service password-encryption

!

hostname sam-i-am

!

ip subnet-zero

!

!--- These are the IKE policies.

crypto isakmp policy 1

!--- Defines an Internet Key Exchange (IKE) policy. 

!--- Use the crypto isakmp policy command 

!--- in global configuration mode. 

!--- IKE policies define a set of parameters to be used 

!--- during the IKE phase I negotiation.

 IKE策略定义了IKE 第一阶段协商的参数集

hash md5

authentication pre-share

!--- Specifies pre-shared keys as the authentication method.

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0

 因为对等体的IP或名称都不知道,所以可以使用8个0来表示任意对等体

!--- Configures a pre-shared authentication key,

!--- used in global configuration mode.

!

!--- These are the IPSec policies.

 设置IPSEC转换集,这是集合是安全协议和算法的一个合法组合.

crypto ipsec transform-set rtpset esp-des esp-md5-hmac

!--- A transform set is an acceptable combination 

!--- of security protocols and algorithms.

!--- This command defines a transform set

!--- that has to be matched on the peer router.

crypto dynamic-map rtpmap 10

 设置一个加密动态映射,留给下面的加密映射调用,这个动态映射起到一个模板
作用,它可以自动与对等体进行协商请求一个新的SA.所以这个模式下不设置对等体!

!--- Use dynamic crypto maps to create policy templates 

!--- that can be used to process negotiation requests 

!--- for new security associations (SA) from a remote IPSec peer, 

!--- even if you do not know all of the crypto map parameters 

!--- required to communicate with the remote peer,

!--- such as the IP address of the peer.

set transform-set rtpset

 调用自己的映射集

!--- Configure IPSec to use the transform set "rtpset"

!--- that was defined previously.

match address 115

 指定哪些流量是要加密的

!--- Assign an extended access list to a crypto map entry 

!--- that is used by IPSec to determine which traffic 

!--- should be protected by crypto and which traffic 

!--- does not need crypto protection.

crypto map rtptrans 10 ipsec-isakmp dynamic rtpmap

 配置加密映射,这个与静态的加密映射不同,它多了个dynamic rtpmap,调用了
上面设置的动态模板rtpmap,所以本来应该在加密映射下该设置的对等体\映射集调用\
ACL调用 现在就不用在设置了,因为放到crypto dynamic-map模板里设置了

!--- Specifies that this crypto map entry is to reference 

!--- a preexisting dynamic crypto map.

!

interface Ethernet0

 ip address 10.2.2.3 255.255.255.0

 no ip directed-broadcast

 ip nat inside

 !--- This indicates that the interface is connected to the

 !--- inside network, which is subject to NAT translation.

 no mop enabled

!

interface Serial0

 ip address 99.99.99.1 255.255.255.0

 no ip directed-broadcast

 ip nat outside

 !--- This indicates that the interface is connected 

 !--- to the outside network.

crypto map rtptrans

!--- Use the crypto map interface configuration command

!--- to apply a previously defined crypto map set to an interface.

!

ip nat inside source route-map nonat interface Serial0 overload

!--- Except the private network from the NAT process.

ip classless

ip route 0.0.0.0 0.0.0.0 Serial0

no ip http server

!

access-list 115 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

access-list 115 deny ip 10.2.2.0 0.0.0.255 any

!--- Include the private-network-to-private-network traffic

!--- in the encryption process.

access-list 120 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

access-list 120 permit ip 10.2.2.0 0.0.0.255 any

!--- Except the private network from the NAT process.

route-map nonat permit 10

 match ip address 120

!

line con 0

 transport input none

line aux 0

line vty 0 4

 password ww

 login

!

end

dr_whoovie

Current configuration:

!

version 12.2

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname dr_whoovie

!

ip subnet-zero

!

!--- These are the IKE policies.

crypto isakmp policy 1

!--- Defines an Internet Key Exchange (IKE) policy. 

!--- Use the crypto isakmp policy command 

!--- in global configuration mode. 

!--- IKE policies define a set of parameters to be used 

!--- during the IKE phase I negotiation.

 hash md5

authentication pre-share

!--- Specifies pre-shared keys as the authentication method.

crypto isakmp key cisco123 address 99.99.99.1 

!--- Configures a pre-shared authentication key,

!--- used in global configuration mode.

!

!--- These are the IPSec policies.

crypto ipsec transform-set rtpset esp-des esp-md5-hmac

!--- A transform set is an acceptable combination 

!--- of security protocols and algorithms.

!--- This command defines a transform set

!--- that has to be matched on the peer router.

!

crypto map rtp 1 ipsec-isakmp  

!--- Creates a crypto map and indicates that IKE will be used 

!--- to establish the IPSec SAs for protecting 

!--- the traffic specified by this crypto map entry.

 这个路由器就是静态设置对等体,不在加密映射语句里调用crypto dynamic-map了

set peer 99.99.99.1

!--- Use the set peer command to specify an IPSec peer in a crypto map entry.

set transform-set rtpset 

!--- Configure IPSec to use the transform set "rtpset"

!--- that was defined previously.

 match address 115

!--- Include the private-network-to-private-network traffic

!--- in the encryption process.

!

interface Ethernet0

ip address 10.1.1.1 255.255.255.0

 no ip directed-broadcast

 ip nat inside

 !--- This indicates that the interface is connected to the

 !--- inside network, which is subject to NAT translation.

 no mop enabled

!

interface Serial0

 ip address negotiated

 !--- Specifies that the IP address for this interface

 !--- is obtained via PPP/IPCP address negotiation.

 !--- This example was set up in a lab with an IP address

 !--- assigned with IPCP.

 no ip directed-broadcast

 ip nat outside

 !--- This indicates that the interface is connected 

 !--- to the outside network.

 encapsulation ppp

 no ip mroute-cache

 no ip route-cache

 crypto map rtp

 !--- Use the crypto map interface configuration command

 !--- to apply a previously defined crypto map set to an interface.

ip nat inside source route-map nonat interface Serial0 overload

!--- Except the private network from the NAT process.

ip classless

ip route 0.0.0.0 0.0.0.0 Serial0

no ip http server

!

access-list 115 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

access-list 115 deny ip 10.1.1.0 0.0.0.255 any

!--- Include the private-network-to-private-network traffic

!--- in the encryption process.<


o:p>

access-list 120 deny   ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

access-list 120 permit ip 10.1.1.0 0.0.0.255 any

!--- Except the private network from the NAT process.

dialer-list 1 protocol ip permit

dialer-list 1 protocol ipx permit

route-map nonat permit 10

 match ip address 120

!

line con 0

 transport input none

line aux 0

line vty 0 4

 password ww

 login

!

end