VPN实验四 L2TP over IPSec

《VPN实验四 L2TP over IPSec》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、实验四、L2TPoverIPSec一、实验拓朴图：二、实验目的：1、实现pc到总部RT1的ipsec远程接入2、实现pc与RT1之间L2TP连接三、实验配置：RT1：vpdnenable//开启虚拟拨号模块!vpdn-groupt45//设置一个名为t45的组accept-dialin//属性导入protocoll2tp（pptp）//设置协议为l2tpvirtual-template1//调用virtual-template1配置nol2tptunnelauthentication//禁用l2tp

2、隧道认证pptptunnelecho0!usernameciscopassword0cisco//配置用户名和密码!cryptoisakmppolicy1//配置isakmp阶段一参数encr3des//加密算法为3deshashmd5//hash算法为md5authenticationpre-share//身份认证方式为预共享group2//组号为2cryptoisakmpkeyciscoaddress0.0.0.00.0.0.0//设置对等体为动态0.0.0.0!cryptoipsectrans

3、form-setciscoesp-3desesp-md5-hmac//配置ipsec阶段二参数modetransport//模式为传输模式!cryptodynamic-mapcisco10//设置动态加密图settransform-setcisco//调用交换集!cryptomaphqh10ipsec-isakmpdynamiccisco//静态绑定动态加密图!interfaceLoopback0ipaddress192.168.1.1255.255.255.0!interfaceEthernet0

4、/0ipaddress202.103.96.112255.255.255.0cryptomaphqh//应用静态加密图!interfaceVirtual-Template1//创建virtual-template1ipaddress1.1.1.1255.255.255.0//此地址必须配置，否则没有服务器地址，无法下发地址peerdefaultipaddresspoolt45//配置从地址池t45中下发地址pppauthenticationpap//配置ppp认证方式为pappppauthentic

5、ationchap!iplocalpoolt45192.168.20.1192.168.20.20//配置本地地址池t45iproute0.0.0.00.0.0.0202.103.96.111一、实验调试RT1#showcryptoengineconnectionsactiveIDInterfaceIP-AddressStateAlgorithmEncryptDecrypt6Ethernet0/0202.103.96.112setHMAC_MD5+3DES_56_C002001Ethernet0/0

6、202.103.96.112set3DES+MD50582002Ethernet0/0202.103.96.112set3DES+MD5240RT1#showiprouteC202.103.96.0/24isdirectlyconnected,Ethernet0/01.0.0.0/24issubnetted,1subnetsC1.1.1.0isdirectlyconnected,Virtual-Access2.1192.168.20.0/32issubnetted,1subnetsC192.168.

7、20.1isdirectlyconnected,Virtual-Access2.1C192.168.1.0/24isdirectlyconnected,Loopback0S*0.0.0.0/0[1/0]via202.103.96.111二、分析debugRT1#*Mar101:02:49.663:ISAKMP(0:0):receivedpacketfrom192.168.10.10dport500sport500Global(N)NEWSA//创建一个新的SA*Mar101:02:49.667:IS

8、AKMP:Createdapeerstructfor192.168.10.10,peerport500//为对等体192.168.10.10创建一个端口号为500的SA*Mar101:02:49.675:ISAKMP:localport500,remoteport500//本地端口号为500，对端为500*Mar101:02:49.703:ISAKMP:(0:0:N/A:0):processingSApayload.messageID=0//处理SA负载，消息ID为0