思科路由器关于动态VPN的配置

《思科路由器关于动态VPN的配置》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、实现动态vpn的一个例子最近看vpn的东西比较多，发现现在很多厂家都在关注中小企业的基于动态ip地址的vpn的实现。当然cisco也不例外，在他的ios12.3(4)T中开始支持动态的地址解析vpnpeer的方式。来看个例子现在CiscoIOS12.3(4)T中新增了根据DNS名称来建立VPNpeer的命令，借助希网(3322.org)、有一个动态地址Site-to-SiteVPN的案例，你自己改一下配置就可以了总部：pix525adsl静态ip,内部ip地址168.98.0.0分部：cisco2621adsl动态ip,内部ip地址168.98.1.0

2、要求，总部，分部，均VPN连接可上网，分部168.98.1.0网段访问总部168.98.0.0网段时，自动建立总部的防火墙配置：:Saved:Writtenbyenable_15at16:16:19.510UTCSunJul252004PIXVersion6.3(3)interfaceethernet0autointerfaceethernet1autonameifethernet0outsidesecurity0nameifethernet1insidesecurity100enablepassword2KFQnbNIdI.2KYOUencrypte

3、dhostnamepixfirewalldomain-namelocaldomainfixupprotocoldnsmaximum-length512fixupprotocolftp21fixupprotocolh323h2251720fixupprotocolh323ras1718-1719fixupprotocolhttp80fixupprotocolrsh514fixupprotocolrtsp554fixupprotocolsip5060fixupprotocolsipudp5060fixupprotocolskinny2000fixuppro

4、tocolsmtp25fixupprotocolsqlnet1521fixupprotocoltftp69namesobject-groupservicehttp2tcpport-objecteqwwwport-objectrange90809090access-listnonatpermitip168.98.0.0255.255.255.0168.98.1.0255.255.255.0pagerlines24mtuoutside1500mtuinside1500ipaddressoutsidea.b.c.d255.255.255.128ipaddre

5、ssinside168.98.0.254255.255.255.0ipauditinfoactionalarmipauditattackactionalarmnofailoverfailovertimeout0:00:00failoverpoll15nofailoveripaddressoutsidenofailoveripaddressinsidepdmlocation168.98.0.250255.255.255.255insidepdmlocation168.98.1.0255.255.255.0outsidepdmhistoryenablear

6、ptimeout14400global(outside)1interfacenat(inside)0access-listnonatnat(inside)10.0.0.00.0.0.000conduitpermiticmpanyanyconduitpermittcpanyobject-grouphttp2anyrouteoutside0.0.0.00.0.0.0电信网关1timeoutxlate3:00:00timeoutconn1:00:00half-closed0:10:00udp0:02:00rpc0:10:00h2251:00:00timeou

7、th3230:05:00mgcp0:05:00sip0:30:00sip_media0:02:00timeoutuauth0:05:00absoluteaaa-serverTACACS+protocoltacacs+aaa-serverRADIUSprotocolradiusaaa-serverLOCALprotocollocalhttpserverenablehttp168.98.0.250255.255.255.255insidenosnmp-serverlocationnosnmp-servercontactsnmp-servercommunit

8、ypublicnosnmp-serverenabletrapsfloodguardenable