vpn配置手冊(編輯修改稿)
2025-01-21 14:12 本頁面
【文章內(nèi)容簡介】 e tunnel 21 ip add tunnel source tunnel dest router eigrp 100 no au IKE Phase I policy Router1: crypto isakmp policy 1 authentication pershared hash md5 encr 3des group 2 crypto isakmp key cisco address Router2: crypto isakmp policy 1 authentication pershared hash md5 encr 3des group 2 crypto isakmp key cisco address IPSec Phase II policy Router1: crypto ipsec transformset cisco espdes espshahmac mode transport accesslist 101 permit gre any any crypto map cisco 10 ipsecisakmp set peer set transformset cisco set pfs match address 101 Router2: crypto ipsec transformset cisco espdes espshahmac mode transport accesslist 101 permit gre any any crypto map cisco 10 ipsecisakmp set peer set transformset cisco set pfs match address 101 Apply VPN Configuration Router1: interface e0/0 crypto map cisco Router2: interface e0/0 crypto map cisco 實驗十 、 cisco IOS (13)T and later configuration IPSec Phase II policy Router1: crypto ipsec transformset cisco espdes espshahmac mode transport crypto ipsec profile cisco set transformset cisco Router2: crypto ipsec transformset cisco espdes espshahmac mode transport crypto ipsec profile cisco set transformset cisco Apply VPN Configuration Router1: interface tu 12 tunnel protection ipsec profile cisco Router2: interface tu 21 tunnel protection ipsec profile cisco 實驗十一 、 Geographic HA using ipsec Backup peers 技術特點 通過設置多個 peer的方式， client能夠自動切換 Server的地址。 Peer是一個一個嘗試，從上往下的順序進行。 Basic route Client: ip route e0 Server1: Ip route e0/0 Server2: Ip route e0/0 IKE Phase I policy Client: crypto isakmp policy 10 hash md5 authentication preshare crypto isakmp key cisco address crypto isakmp key cisco address crypto isakmp keepalive 20 3 note: during IKE negotiation ,IKE timer ( 3 retries )detects the peer failure IKE keepalive or DPD detected failed peer after tunnel is established Server1: crypto isakmp policy 10 hash md5 authentication preshare crypto isakmp key cisco address Server2: Same as Server1 IPSec Phase II policy Client: crypto ipsec transformset cisco espdes espshahmac accesslist 101 permit ip crypto map cisco 10 ipsecisakmp set peer set peer set transformset cisco match address 101 Server1: crypto ipsec transformset cisco espdes espshahmac accesslist 101 permit ip crypto map cisco 10 ipsecisakmp set peer set transformset cisco match address 101 Server2: Same as Ser
教學課件相關推薦
鄂ICP備17016276號-1