ipsecvpn远端动态接入主模式与积极模式

《ipsecvpn远端动态接入主模式与积极模式》由会员上传分享，免费在线阅读，更多相关内容在应用文档-天天文库。

1、分部分配动态ip总部用固定ip分部作为发起方R1（主模式）Cryptoisakmppolocy10(五元组)Encr3desAuthenticationpre-shareGroup2Lifetime86400HashshaCryptoisakemidentityaddress（用id标识）Cryptoisakmpkey0sunanaddress0.0.0.0（对端接入不知道对端ip用0.0.0.0）Cryptoipsectransform-sett10esp-3desesp-sha-hmac（设置变换集）M

2、odetrExitAccess-list111permitip192.168.2.00.0.0.255any（同样不知道对端感兴趣流量用any）Cryptodynamic-mapp110(设置加密图动态)Settransform-sett10Matchaddress111Cryptomapp290ipsec-isakmpdynamicp1（因为接口上要绑静态加密图所以把动态图绑到静态上）Intf0/0（绑静态图）Cryptomapp2R2cryptoisakmpenablecryptoisakmppolic

3、y10encryption3deshashshaauthenticationpre-sharegroup2lifetime86400exitcryptoisakempidentityaddresscryptoisakmpkey0sunanaddress202.103.96.112（总部ip是知道的并且这是分部做为发起方的条件）cryptoipsectransform-sett10esp-3desesp-sha-hmacmodetrexitaccess-list111permitip192.168.3.00.

4、0.0.255192.168.2.00.0.0.255（感兴趣流量分部也知道的）crytomapp110ipsec-isakmpsetpeer202.103.96.112settransorm-sett10matchaddress111exitintf0/0cryptomapp1R1showrunBuildingconfiguration...Currentconfiguration:1329bytes!version12.4servicetimestampsdebugdatetimemsecservice

5、timestampslogdatetimemsecnoservicepassword-encryption!hostnameR1!boot-start-markerboot-end-marker!!noaaanew-modelmemory-sizeiomem5ipcef!!!!noipdomainlookup!multilinkbundle-nameauthenticated!!!!!!archivelogconfighidekeys!!cryptoisakmppolicy10encr3desauthent

6、icationpre-sharegroup2cryptoisakmpkeysunanaddress0.0.0.00.0.0.0!!cryptoipsectransform-sett10esp-3desesp-sha-hmacmodetransport!cryptodynamic-mapp110settransform-sett10matchaddress111cryptodynamic-mapp120settransform-sett10!!cryptomapp290ipsec-isakmpdynamicp

7、1!!!!!!!interfaceFastEthernet0/0ipaddress202.103.96.112255.255.255.0duplexautospeedautocryptomapp2!interfaceFastEthernet0/1ipaddress192.168.2.1255.255.255.0duplexautospeedauto!ipforward-protocolndiproute0.0.0.00.0.0.0202.103.96.113（没路由一切都是浮云）!!noiphttpserv

8、ernoiphttpsecure-server!access-list111permitip192.168.2.00.0.0.255anynocdprun!!control-plane!linecon0exec-timeout00loggingsynchronouslineaux0exec-timeout00loggingsynchronouslinevty04login!!endR1#unallAllpossi