IPSecVPN_高可用

《IPSecVPN_高可用》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、18高可用性设备备份高可用VPN配置(地址没照图做)Clientcryptoisakmppolicy10authenticationpre-sharecryptoisakmpkeyciscoaddress202.100.2.100cryptoisakmpkeepalive10periodiccryptoipsectransform-setmysetesp-desesp-md5-hmaccryptomapmymap10ipsec-isakmpsetpeer202.100.2.100settransform-setmysetmatchaddress101interfa

2、ceLoopback0ipaddress1.1.1.1255.255.255.0interfaceFastEthernet0/0ipaddress202.100.1.1255.255.255.0cryptomapmymapiproute0.0.0.00.0.0.0FastEthernet0/0access-list101permitiphost1.1.1.1host2.2.2.10internetinterfaceFastEthernet0/0ipaddress202.100.1.10255.255.255.0interfaceFastEthernet1/0ipa

3、ddress202.100.2.10255.255.255.0__________________________________________________________________activecryptoisakmppolicy10authenticationpre-sharecryptoisakmpkeyciscoaddress202.100.1.1cryptoisakmpkeepalive10periodiccryptoipsectransform-setmysetesp-desesp-md5-hmaccryptomapmymap10ipsec-

4、isakmpsetpeer202.100.1.1settransform-setmysetmatchaddress101reverse-routetag10reverse-routestatic——当IPsec感知到本设备是active的HSRP状态，那么即使没有SA也会注入感兴趣流路由使得本地内部可以先发起流量interfaceFastEthernet0/0ipaddress202.100.2.1255.255.255.0standby1ip202.100.2.100standby1priority105standby1preemptstandby1namehs

5、rpcryptomapmymapredundancyhsrp——让IPsec感知HSRP路由器的激活和备份状态interfaceFastEthernet1/0ipaddress2.2.2.1255.255.255.0routerospf1redistributestaticsubnetsroute-maps2onetwork2.2.2.00.0.0.255area0iproute0.0.0.00.0.0.0FastEthernet0/0access-list101permitiphost2.2.2.10host1.1.1.1route-maps2opermit10

6、matchtag10__________________________________________________________________standbycryptoisakmppolicy10authenticationpre-sharecryptoisakmpkeyciscoaddress202.100.1.1cryptoisakmpkeepalive10periodiccryptoipsectransform-setmysetesp-desesp-md5-hmaccryptomapmymap10ipsec-isakmpsetpeer202.100

7、.1.1settransform-setmysetmatchaddress101reverse-routetag10reverse-routestatic————因为本地是standby，即使打了这个命令也不会注入路由interfaceFastEthernet0/0ipaddress202.100.2.2255.255.255.0standby1ip202.100.2.100standby1preemptstandby1namehsrpcryptomapmymapredundancyhsrpinterfaceFastEthernet1/0ipaddress2.2.

8、2.225