两台出口路由器之间GRE OVER IPSEC+NAT+OSPF

《两台出口路由器之间GRE OVER IPSEC+NAT+OSPF》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、两台出口路由器之间GREOVERIPSEC+NAT+OSPF实验拓扑：拓扑描述：如上图所示：在两台出口路由器上分别实现站点内部PAT上网，同时通过在R1、R3的出接口之间建立GRE隧道来传递两个站点的动态OSPF路由，同时通过在R1、R3之间建立一个传输模式的IPSEC隧道来对两个出接口的GRE感兴趣流量实施保护。具体配置：R1：1、接口和PAT配置interfaceFastEthernet0/0ipaddress12.1.1.1255.255.255.0ipnatoutsideinterfaceFastEthernet0/1ipaddress10

2、.1.1.2255.255.255.0ipnatinsideiproute0.0.0.00.0.0.012.1.1.2ipnatinsidesourcelistnatinterfaceFastEthernet0/0overloadipaccess-listextendednat扩展访问列表-定义NAT流量denyip10.1.1.00.0.0.25510.2.2.00.0.0.255拒绝到siteB的流量（走GRE隧道）permitipanyany2、GRE隧道配置interfaceTunnel0ipaddress192.168.1.1255.25

3、5.255.0tunnelsource12.1.1.1tunneldestination23.1.1.23、OSPF配置routerospf1启用OSPF进程1log-adjacency-changesnetwork10.1.1.20.0.0.0area0将内网接口宣告进区域0network192.168.1.10.0.0.0area0将隧道接口宣告进区域01、IPSEC配置cryptoisakmppolicy1创建一阶段策略encr3desauthenticationpre-sharegroup2cryptoisakmpkey6ciscoaddr

4、ess23.1.1.2指定对端地址和pre-sharekeycryptoipsectransform-setmysetesp-3desesp-sha-hmac二阶段数据加密和完整性校验算法modetransport传输模式（加密连个端点的数据）cryptomapmymap1ipsec-isakmp创建加密映射关联感兴趣流、转换集、对端地址setpeer23.1.1.2settransform-setmysetmatchaddressvpninterfaceFastEthernet0/0cryptomapmymap在出接口下应用加密映射ipacces

5、s-listextendedvpnpermitgrehost12.1.1.1host23.1.1.2IPSECVPN的感兴趣流就是两个出接口间的GRE流量R2:interfaceLoopback0ipaddress2.2.2.2255.255.255.255interfaceFastEthernet0/0ipaddress12.1.1.2255.255.255.0interfaceFastEthernet0/1ipaddress23.1.1.1255.255.255.0R3:1、接口和PAT配置interfaceFastEthernet0/0ipa

6、ddress10.2.2.2255.255.255.0ipnatinsideinterfaceFastEthernet0/1ipaddress23.1.1.2255.255.255.0ipnatoutsideiproute0.0.0.00.0.0.023.1.1.1ipnatinsidesourcelistnatinterfaceFastEthernet0/1overloadipaccess-listextendednat扩展访问列表-定义NAT流量denyip10.2.2.00.0.0.25510.1.1.00.0.0.255拒绝到siteA的流

7、量（走GRE隧道）permitipanyany2、GRE隧道配置interfaceTunnel0ipaddress192.168.1.2255.255.255.0tunnelsource23.1.1.2tunneldestination12.1.1.11、OSPF配置routerospf1log-adjacency-changesnetwork10.2.2.20.0.0.0area0network192.168.1.20.0.0.0area02、IPSEC配置cryptoisakmppolicy1创建一阶段策略encr3desauthenticat

8、ionpre-sharegroup2cryptoisakmpkey6ciscoaddress12.1.1.1指定对端地址和