【正文】 因?yàn)槭浅醮卧O(shè)計(jì)，系統(tǒng)中難免會(huì)存在各種不足，有待進(jìn)一步的完善。 8 第 3 章 主要設(shè)備 網(wǎng)絡(luò) 配置 總部路由器的配置 為路由命名并賦予 IP hostname zongbu ip dhcp excludedaddress ip dhcp pool zongbu work defaultrouter dnsserver 配置 AAA 認(rèn)證 aaa newmodel aaa authentication login eza local aaa authorization work ezo local username tang password 0 123 配置 IKE 協(xié)商 策略 與參數(shù) crypto isakmp policy 10(10 為 IKE 協(xié)商策略的編號(hào) ) encr 3des hash md5(hash 命令被用來(lái)設(shè)置密鑰認(rèn)證所用的算法 ) authentication preshare crypto isakmp key tom address crypto isakmp client configuration group wzf key 123 pool ez 配置 IPsec 訪問列表與傳輸模式 crypto ipsec transformset tim esp3des espmd5hmac crypto dynamicmap ezmap 10 set transformset tim 配置端口的應(yīng)用 reverseroute crypto map tom client authentication list eza（創(chuàng)建 Crypto Map） crypto map tom isakmp authorization list ezo crypto map tom client configuration address respond 9 crypto map tom 10 ipsecisakmp dynamic ezmap crypto map tom 11 ipsecisakmp set peer （指定了此 Crypto Map 所對(duì)應(yīng)的 VPN 鏈路對(duì)端的 IP 地址） set transformset tim match address 101 no ip domainlookup interface FastEther0/0（配置端口 IP） ip address ip nat inside duplex auto speed auto interface FastEther0/1 ip address ip nat outside duplex auto speed auto crypto map tom interface Vlan1 no ip address shutdown ip local pool wzf ip nat inside source list 100 interface FastEther0/1 overload ip nat inside source static tcp 80 80 ip classless ip route accesslist 100 deny ip accesslist 100 permit ip any accesslist 101 permit ip line con 0 exectimeout 0 0 logging synchronous login 10 line vty 0 4 login end 分公司路由器配置 為路由命名并賦予 IP hostname fenbu ip dhcp excludedaddress ip dhcp pool zongbu work defaultrouter dnsserver 配置 IKE 協(xié)商策略與參數(shù) crypto isakmp policy 10 encr 3des hash md5 authentication preshare crypto isakmp key tom address 配置 IPsec 訪問列表與傳輸模式 crypto ipsec transformset tim esp3des espmd5hmac crypto map tom 10 ipsecisakmp set peer set transformset tim match address 101 no ip domainlookup 配置端口的應(yīng)用 interface FastEther0/0 ip address ip nat outside duplex auto speed auto crypto map tom interface FastEther0/1 ip address ip nat inside 11 duplex auto speed auto interface Vlan1 no ip address shutdown ip nat inside source list 100 interface F