gre over ipsec原理和配置

《gre over ipsec原理和配置》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、greoveripsec这里首先补充一下知识吧：1．Ipsec中有2种封装模式：一种是隧道模式，一种是传输模式；当我们使用GREOVERipsec时，如果使用隧道模式的话，会多封装20个字节的ESP头部，其与GRE添加的头部ip完全相同，故而，在GREoveripsec时，建议使用传输模式。（主要是通讯点和传输点之间的关系）2．配置greoveripsec的时候，可以选择两种的方法，这里都会介绍和给出配置，建议使用第二种方法。3．第二种配置GREoverIPsec的方式：profileProfile可以看做是GREtunnel中

2、的一种保护机制，在使用profile时，无需配置感兴趣流，无需setpeer，如下操作即可：第一种方法：R1:!hostnameR1!cryptoisakmppolicy10hashmd5authenticationpre-sharegroup2cryptoisakmpkeyzhangaddress23.1.1.2!!cryptoipsectransform-setmytransesp-3desesp-md5-hmacmodetransport!cryptomapmymap10ipsec-isakmpsetpeer23.1.1.

3、2settransform-setmytransmatchaddressVPN!!!!interfaceTunnel0ipaddress172.16.1.1255.255.255.0tunnelsourceFastEthernet0/0tunneldestination23.1.1.2tunnelkey123!interfaceLoopback10ipaddress192.168.10.1255.255.255.0!interfaceFastEthernet0/0ipaddress12.1.1.1255.255.255.0dup

4、lexautospeedautocryptomapmymap!routerospf1router-id1.1.1.1log-adjacency-changesnetwork172.16.1.00.0.0.255area0network192.168.10.00.0.0.255area0!ipaccess-listextendedVPNpermitgre12.1.1.00.0.0.25523.1.1.00.0.0.255!EndR2配置：hostnameR2!interfaceLoopback0ipaddress2.2.2.225

5、5.255.255.0!interfaceFastEthernet0/0ipaddress12.1.1.2255.255.255.0duplexautospeedauto!interfaceFastEthernet1/0ipaddress23.1.1.1255.255.255.0duplexautospeedauto!EndR3配置：hostnameR3!cryptoisakmppolicy10hashmd5authenticationpre-sharegroup2cryptoisakmpkeyzhangaddress12.1.

6、1.1!!cryptoipsectransform-setmytransesp-3desesp-md5-hmacmodetransport!cryptomapmymap10ipsec-isakmpsetpeer12.1.1.1settransform-setmytransmatchaddressVPN!interfaceTunnel0ipaddress172.16.1.2255.255.255.0tunnelsourceFastEthernet0/0tunneldestination12.1.1.1tunnelkey123!in

7、terfaceLoopback10ipaddress192.168.30.1255.255.255.0!interfaceFastEthernet0/0ipaddress23.1.1.2255.255.255.0duplexautospeedautocryptomapmymap!routerospf1router-id3.3.3.3log-adjacency-changesnetwork172.16.1.00.0.0.255area0network192.168.30.00.0.0.255area0!noiphttpserver

8、noiphttpsecure-serveriproute0.0.0.00.0.0.023.1.1.1!ipaccess-listextendedVPNpermitgre23.1.1.00.0.0.25512.1.1.00.0.0.255!End第二种方法：在1实