网络互联技术梁广民王隆杰chp24GRE和IPSec-VPN24.2IPSecVPN实验指导.doc

《网络互联技术梁广民王隆杰chp24GRE和IPSec-VPN24.2IPSecVPN实验指导.doc》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、IPSecVPN配置1.实验目的通过本实验可以掌握：①IPSecVPN的原理②IPSecVPN的配置2.实验拓扑实验拓扑如图所示。任务：两地已经度连上了internet，现要把两个的网络通过Internet进行互联。数据在Internet传输时要保证安全性，使用SiteToSiteVPN。3.实验步骤1)R1、R2、R3上如图配置IP地址，打开接口，配置路由：RouterA（R1）:enconfthostR1ints1/1noshutdownclockrate128000ipadd202.96.134.1255.255.255.252intloopback0ipadd10.1

2、.1.1255.255.255.0iproute0.0.0.00.0.0.0s1/1Internet（R2）:enconfthostInternetints1/0noshutdownclockrate128000ipadd202.96.134.2255.255.255.252ints1/1noshutdownclockrate128000ipadd61.0.0.1255.255.255.252RouterB（R3）:enconfthostR3ints1/0noshutdownclockrate128000ipadd61.0.0.02255.255.255.252intloop

3、back0ipadd10.2.2.2255.255.255.0iproute0.0.0.00.0.0.0s1/01)配置RouterA（R1）：R1(config)#cryptoisakmppolicy10R1(config-isakmp)#hashmd5R1(config-isakmp)#authenticationpre-shareR1(config-isakmp)#cryptoisakmpidentityaddressR1(config)#cryptoisakmpkey0cisco1234address61.0.0.2R1(config)#cryptoipsectran

4、sform-setTEST-TRANesp-desesp-md5-hmacR1(cfg-crypto-trans)#cryptoipsecsecurity-associationlifetimeseconds86400R1(config)#access-list110permitip10.1.1.00.0.0.25510.2.2.00.0.0.255R1(config)#cryptomapTEST-MAP10ipsec-isakmpR1(config-crypto-map)#setpeer61.0.0.2R1(config-crypto-map)#settransform-s

5、etTEST-TRANR1(config-crypto-map)#matchaddress110R1(config-crypto-map)#setsecurity-associationlifetimeseconds1200R1(config)#interfaceSerial1/1R1(config-if)#cryptomapTEST-MAP2)配置RouterB（R3）R3(config)#cryptoisakmpenableR3(config)#cryptoisakmppolicy10R3(config-isakmp)#hashmd5R3(config-isakmp)#a

6、uthenticationpre-shareR3(config-isakmp)#cryptoisakmpidentityaddressR3(config)#cryptoisakmpkey0cisco1234address202.96.134.1R3(config)#cryptoipsectransform-setTEST-TRANesp-desesp-md5-hmacR3(cfg-crypto-trans)#cryptoipsecsecurity-associationlifetimeseconds86400R3(config)#access-list110permitip1

7、0.2.2.00.0.0.25510.1.1.00.0.0.255R3(config)#cryptomapTEST-MAP10ipsec-isakmpR3(config-crypto-map)#setpeer202.96.134.1R3(config-crypto-map)#settransform-setTEST-TRANR3(config-crypto-map)#matchaddress110R3(config-crypto-map)#setsecurity-associationlifetimes