【正文】 5 packet(s) received % packet loss roundtrip min/avg/max = 30/34/40 ms[FW1]ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=253 time=70 ms Reply from : bytes=56 Sequence=2 ttl=253 time=60 ms Reply from : bytes=56 Sequence=3 ttl=253 time=70 ms Reply from : bytes=56 Sequence=4 ttl=253 time=70 ms Reply from : bytes=56 Sequence=5 ttl=253 time=60 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet loss roundtrip min/avg/max = 60/66/70 ms[FW2]ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=253 time=40 ms Reply from : bytes=56 Sequence=2 ttl=253 time=30 ms Reply from : bytes=56 Sequence=3 ttl=253 time=40 ms Reply from : bytes=56 Sequence=4 ttl=253 time=30 ms Reply from : bytes=56 Sequence=5 ttl=253 time=30 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet loss roundtrip min/avg/max = 30/34/40 ms[FW2]ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=254 time=30 ms Reply from : bytes=56 Sequence=2 ttl=254 time=30 ms Reply from : bytes=56 Sequence=3 ttl=254 time=30 ms Reply from : bytes=56 Sequence=4 ttl=254 time=30 ms Reply from : bytes=56 Sequence=5 ttl=254 time=30 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet lossroundtrip min/avg/max = 30/30/30 msRRR。配置時，封裝模式使用隧道模式，使用ESP協(xié)議對數(shù)據(jù)進行保護。[FW1]ike proposal 10 [FW1ikeproposal10]authenticationalgorithm。[FW1]ipsec proposal tran1 [FW1ipsecproposaltran1]encapsulationmode tunnel [FW1ipsecproposaltran1]transform esp [FW1ipsecproposaltran1]esp authenticationalgorithm sha1 [FW1ipsecproposaltran1]esp encryptionalgorithm des[FW2]ipsec proposal tran1 [FW2ipsecproposaltran1]encapsulationmode tunnel [FW2ipsecproposaltran1]transform esp [FW2ipsecproposaltran1]esp authenticationalgorithm sha1 [FW2ipsecproposaltran1]esp encryptionalgorithm des在防火墻FW1和FW2上配置IKE安全提議。[FW1]acl 3000 [FW1acladv3000]rule permit ip source destination [FW2]acl 3000 [FW2acladv3000]rule permit ip source destination 配置分部網(wǎng)絡到總部內網(wǎng)的靜態(tài)路由。[FW1]firewall packetfilter default permit interzone trust untrust[FW1]firewall packetfilter default permit interzone local untrust[FW2]firewall packetfilter default permit interzone trust untrust[FW2]firewall packetfilter default permit interzone local untrust步驟三. 配置路由，實現(xiàn)網(wǎng)絡的連通在RRRFW1和FW2上配置單區(qū)域OSPF,、。配置時注意所有的Loopback接口配置掩碼均為24位。并要求總部、分部網(wǎng)絡之間，總部、分支辦公室之間傳輸?shù)臄?shù)據(jù)需要加密。 掌握在路由器上配置GRE over IPSec VPN的方法拓撲圖圖12 Eudemon防火墻VPN配置場景你是你們公司的網(wǎng)絡管理員。[FW]display interzone 15:42:11 2011/12/25interzone trust untrust detect javablocking 2001 outboundinterzone trust dmz detect ftp detect userdefined 3001 outbound附加實驗: 思考并驗證思考一下，在企業(yè)網(wǎng)絡中，如果用戶和服務都非常多，網(wǎng)絡設計時該如何設計？同時可以采用什么方法簡化配置？最終設備配置[R1]display currentconfiguration [V200R001C00SPC200] sysname R1interface GigabitEthernet0/0/1 ip address interface LoopBack0 ip address interface LoopBack1 ip address ip routestatic return[R2]display currentconfiguration [V200R001C00SPC200] sysname R2interface GigabitEthernet0/0/1 ip address interface LoopBack0 ip address ip routestatic return[R3]display currentconfiguration [V200R001C00SPC200] sysname R3interface GigabitEthernet0/0/1 ip address interface LoopBack0 ip address ip routestatic return[FW]display currentconfiguration sysname FW firewall packetfilter default deny interzone local trust direction inbound firewall packetfilter default deny interzone local trust direction outbound firewall packetfilter default deny interzone local untrust direction inbound firewall packetfilter default deny interzone local untrust direction outbound firewall packetfilter default deny interzone local dmz direction inbound firewall packetfilter default deny interzone local dmz direction outbound firewall packetfilter default deny interzone trust untrust direction inbound firewall packetfilter default deny interzone trust dmz direction inbound firewall packetfilter default deny interzone dmz untrust direction inbound firewall packetfilter default deny interzone dmz untrust direction outbound undo firewall ipv6 session linkstate check vlan batch 1 12 undo firewall session linkstate check firewall defend portscan enable firewall defend portscan maxrate 5000 firewall defend portscan blacklisttimeout 30 runmode firewall update schedule ips daily 5:51 update schedule av daily 5:51 security server domain webmanager enable l2fwdfast enableacl number 2001 rule 5 permit source acl number 3001 rule 5 permit udp destinationport eq tftpinterface Vlanif12 ip address interface Cellular5/0/0 linkprotocol pppinterface Ethernet0/0/0 ip address interface Ethernet1/0/0 portswitch port linktype access port access vlan 12interface Ethernet2/0/0 ip address firewall zone local set priority 100firewall zone trust set priority 85 add interface Vlanif12 firewall zone untrust set priority 5 add interface Ethernet0/0/0firewall zone dmz set priority 50 add interface Ethernet2/0/0firewall interzone trust untrust detect javablocking 2001 outboundfirewall interzone trust dmz detect ftp detect userdefined 3001 outboundnqajitter tagversion 1 ip routestatic ip routestatic ip routestatic ip routestatic banner enable firewall blacklist enable firewall blacklist item userinterface