【正文】 .. . . ..學習參考實驗 1 配置 GRE VPN實驗任務一：GRE VPN 基本配置步驟一：搭建實驗環(huán)境在 SWA 上配置 VLAN2，將接口 E1/0/2 加入 VLAN2：[SWA]vlan 2[SWAvlan2]port Ether 1/0/2步驟二：檢測公網連通性查看 SWA 的路由表和端口狀態(tài)，確認其工作正常。[SWA]display ip interface brief*down: administratively down(s): spoofingInterface Physical Protocol IP Address DescriptionVlaninterface1 up up Vlaninte...Vlaninterface2 up up Vlaninte...[SWA]display ip routingtableRouting Tables: Public Destinations : 6 Routes : 6Destination/Mask Proto Pre Cost NextHop Interface也可以使用 display interface 命令。在 RTA 和 RTB 上配置公網接口互通所需的靜態(tài)路由。[RTA]interface GigabitEther0/0[RTAGigabitEther0/0]ip address [RTAGigabitEther0/0]interface GigabitEther0/1[RTAGigabitEther0/1]ip address [RTAGigabitEther0/1]ip routestatic [RTB]interface GigabitEther0/0[RTBGigabitEther0/0]ip address [RTBGigabitEther0/0]interface GigabitEther0/1[RTBGigabitEther0/1]ip address [RTBGigabitEther0/1]ip routestatic 步驟三：配置 GRE 隧道接口[RTA] interface Tunnel0[RTATunnel0] ip address [RTATunnel0] source [RTATunnel0] destination .. . . ..學習參考[RTB] interface Tunnel0[RTBTunnel0] ip address [RTBTunnel0] source [RTBTunnel0] destination 步驟四：為私網配置靜態(tài)路由[RTA] ip routestatic Tunnel0[RTB] ip routestatic Tunnel0配置時也可以用下一跳地址。步驟五：檢驗隧道工作狀況查看 RTA 與 RTB 的路由表，可見公網、私網路由均存在于路由表中： [RTB]display ip routingtableRouting Tables: Public Destinations : 10 Routes : 10Destination/Mask Proto Pre Cost NextHop Interface查看 RTA 和 RTB 的隧道接口狀態(tài)，可見其使用 GRE 封裝，狀態(tài)為 UP：[RTB]display interface Tunnel 0Tunnel0 current state: UPLine protocol current state: UPDescription: Tunnel0 InterfaceThe Maximum Transmit Unit is 1476Inter Address is Encapsulation is TUNNEL, serviceloopbackgroup ID not set.Tunnel source , destination Tunnel keepalive disableTunnel protocol/transport GRE/IP GRE key disabled Checksumming of GRE packets disabledOutput queue : (Urgent queuing : Size/Length/Discards) 0/100/0Output queue : (Protocol queuing : Size/Length/Discards) 0/500/0Output queue : (FIFO queuing : Size/Length/Discards) 0/75/0 Last 300 seconds input: 15 bytes/sec, 0 packets/sec Last 300 seconds output: 21 bytes/sec, 0 packets/sec 133 packets input, 5701 bytes 0 input error 124 packets output, 7469 bytes 0 output error.. . . ..學習參考在 RTA 上打開 GRE 協(xié)議調試開關用 debugging 命令檢驗路由器實際收發(fā)的報文，說明其地址已經改變。RTAterminal monitorRTAterminal debuggingRTAdebugging gre packet在 PCA 上對 RTB 運行 ping 命令，但只發(fā)送一個 ICMP 包：C:\Documents and Settings\Userping n 1 Pinging with 32 bytes of data:Reply from : bytes=32 time1ms TTL=254Ping statistics for : Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),Approximate round trip times in milliseconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms觀察 RTA 上的輸出信息：RTA*Jun 26 16:15:30:443 2022 RTA GRE/7/debug: Tunnel0 packet:After encapsulation, Outgoing packet header (length = 84)*Jun 26 16:15:30:443 2022 RTA GRE/7/debug:Output: Gre packet has been fastswitched successfully, interface index is 0x2f0000.可見 RTA 從 Tunnel0 接口發(fā)出了一個包，源地址為 ，目的地址為 。因為發(fā)送的包已經被 GRE 封裝后在公網發(fā)送了。步驟六：清除靜態(tài)路由用 undo ip routestatic 命令。步驟七：為公網配置動態(tài)路由[RTA]ospf 1[RTAospf1]area []work [RTB]ospf 1[RTBospf1]area []work [SWA]ospf 1[SWAospf1]area []work []work 步驟八：為私網配置動態(tài)路由[RTA]rip 1[RTArip1]version 2[RTArip1]work [RTArip1]work [RTB]rip[RTBrip1]version 2.. . . ..學習參考[RTBrip1]work [RTBrip1]work 步驟九：再次檢驗隧道工作狀況查看 RTA 與 RTB 的路由表： RTBdisplay ip routingtableRouting Tables: Public Destinations : 10 Routes : 10Destination/Mask Proto Pre Cost NextHop Interface轉入下一實驗任務。實驗任務二：GRE VPN 隧道驗證步驟一：單方配置隧道驗證首先在 RTA 上單方啟動隧道驗證：[RTATunnel0]gre key 1234步驟二：檢驗隧道連通性用 ping 命令驗證 PCA 與 PCB 之間的連通性。由于僅單方配置了隧道驗證，此時應該無法連通。C:\Documents and Settings\Userping Pinging with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.Ping statistics for : Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),步驟三：配置錯誤的隧道驗證在 RTB 上也啟動隧道驗證，但驗證值配置與 RTA 不同：[RTBTunnel0]gre key 12345.. . . ..學習參考步驟四：檢驗隧道連通性用 ping 命令驗證 PCA 與 PCB 之間的連通性。由于配置的隧道驗證值錯誤，此時應該無法連通。C:\Documents and Settings\Userping Pinging with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.Ping statistics for : Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),步驟五：正確配置隧道驗證在 RTB 上配置與 RTA 相同的驗證值：[RTBTunnel0]gre key 1234步驟六：檢驗隧道連通性用 ping 命令驗證 PCA 與 PCB 之間的連通性。由于配置的隧道驗證正確，此時應該可以連通。C:\Documents and Settings\Userping Pinging with 32 bytes of data:Reply from : bytes=32 time=1ms TTL=254Reply from : bytes=32 time1ms TTL=254Reply from : bytes=32 time1ms TTL=254Reply from : bytes=32 time1ms TTL=254Ping statistics for : Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milliseconds: Minimum = 0ms, Maximum = 1ms, Average = 0ms注意：由于 RTA 和 RTB 上配置了 RIP 路由，如果隧道驗證值長時間不匹配，RIP 會刪除來自對方的私網路由。在這種情況下，配置了正確的隧道驗證值后需要等待 RIP 重新學習路由。實驗任務三：GRE VPN 隧道 Keepalive步驟一：恢復靜態(tài)路由配置 [RTA]undo ripWarning : Undo RIP process? [Y/N]:y[RTA]undo ospfWarning : Undo OSPF process? [Y/N]:y[RTA]ip routestatic Tunnel0 [RTA]ip routestatic .. .