拓扑：
PC(10.0.0.1、网关10.0.0.254)-----------------（e0/0:10.0.0.254）ROUTER3620(lo0:172.16.0.1)
IOS版本c3620-ik9o3s7-mz.123-21.bin
主要配置步骤:
1.培植IKE策略
2.配置IKE阶段的客户段配置参数(组配置模式)
2.1地址池
2.2KEY值(可户端用来确定自己组身份.)
2.3其他可选配置
3.配置IPSEC转换集合,供动态影射模板调用
4.配置动态影射模板,调用3步骤的转换集
5.配置实际加密影射
5.1配置加密隐射中的IKE组策略查询名(调用上面IKE客户组名)
5.2配置加密影射中的客户段地址响应
5.3在加密影射中调用动态模板
6.配置本地地址池
7.配置相关的路由
8.关联加密影射到接口
vpnserver#sh run
Building configuration...
Current configuration : 1663 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname vpnserver
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
ip cef
!
ip audit po max-events 100
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!配置第一阶段协商策略,IKE策略
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
!
!配置IKE客户端配置组参数,其中clientgroup是自己任意命名
crypto isakmp client configuration group clientgroup
key cisco123 #客户端软件所用的密码
dns 61.148.1.8 #客户段用的DNS,可选
wins 61.148.1.7 #客户段WINS,可选
pool ippool #注意这里还必须调用一下地址池
!
!
!配置IPSEC转换集,供下面的动态影射模板调用
crypto ipsec transform-set ipsectrans esp-3des esp-md5-hmac
!
!配置动态影射摸班,并调用IPSEC转换集
crypto dynamic-map dynamicmap 1
set transform-set ipsectrans
!
!
!配置真实的加密影射,并关联IKE的授权列表,响应客户段地址请求
crypto map actmap isakmp authorization list clientgroup
crypto map actmap client configuration address respond
!调用动态影射模板
crypto map actmap 1 ipsec-isakmp dynamic dynamicmap
!
!
!
interface Loopback0
ip address 172.16.0.1 255.255.0.0
!
interface Ethernet0/0
ip address 10.0.0.254 255.0.0.0
full-duplex
!关联到接口
crypto map actmap
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
!配置本地地址池
ip local pool ippool 192.168.10.1 192.168.10.254
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 Ethernet0/0
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
检验:
vpnserver#sh crypto ipsec sa
interface: Ethernet0/0
Crypto map tag: actmap, local addr. 10.0.0.254
protected vrf:
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.10.13/255.255.255.255/0/0)
current_peer: 10.0.0.100:500
PERMIT, flags={}
#pkts encaps: 57, #pkts encrypt: 57, #pkts digest 57
#pkts decaps: 288, #pkts decrypt: 288, #pkts verify 288
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 10.0.0.254, remote crypto endpt.: 10.0.0.100
path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
current outbound spi: DC3CB5CD
inbound esp sas:
spi: 0x71F177C4(1911650244)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2000, flow_id: 1, crypto map: actmap
sa timing: remaining key lifetime (k/sec): (4468647/2307)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xDC3CB5CD(3694966221)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2001, flow_id: 2, crypto map: actmap
sa timing: remaining key lifetime (k/sec): (4468684/2305)
IV size: 8 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:
vpnserver#sh crypto isakmp sa
dst src state conn-id slot
10.0.0.254 10.0.0.100 QM_IDLE 2 0
说明：用VPN-CLIENT软件4。01连接成功。但需要注意：由于路由器是用的dynamips模拟器，和本电脑网卡桥接，用本电脑上的client软件可以连上，但是数据是只发不收，改用非本电脑连接则一切正常。还需要注意就是PC上一定要设置路由器的IP为网关，否则连接不上（client软件会提示加载网关失败）
（测试split tunnel没成功，不知道是AC
L问题还是模拟器问
文章评论