98实验指导(nat-t)-v1

《98实验指导(nat-t)-v1》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、实验指导(NAT-TransparentVPN)一、实验任务任务：两地已经度连上了internet，现要把两个的网络通过Internet进行互联。数据在Internet传输时要保证安全性，使用NAT-TSiteToSiteVPN。R1上有NAT存在，R3的peer应该指向R1。默认时，R4是支持NAT-T的，因此会把ESP的数据包封装在UDP(port:4500)数据包中的。封装格式如下：注：路由器只支持：nat-toverudp4500,不支持udpover其他端口和nat-tovertcp。R4-Local:IP17

2、2.16.14.423.23.23.3UDP:4500ESP10.4.4.410.5.5.5DATAR1-NAT:IP12.12.12.123.23.23.3UDP:4500ESP10.4.4.410.5.5.5DATAR3-Peer:IP23.23.23.312.12.12.1UDP:4500ESP10.5.5.510.4.4.4DATA二、实验步骤1、R1、R2、R3上如图配置IP地址，打开接口，配置路由：RouterA（R1）:hostnameR1-NATints0/0noshutdownclockrate1280

3、00ipadd12.12.12.1255.255.255.0interfaceEthernet1/0noshipaddress172.16.14.1255.255.255.0routereig90noauto-summarynet172.16.14.00.0.0.255iproute0.0.0.00.0.0.0s0/0Internet（R2）:ints0/0noshutdownclockrate128000ipadd12.12.12.2255.255.255.0ints0/1noshutdownclockrate1280

4、00ipadd23.23.23.2255.255.255.0RouterB（R3）:ints0/1noshutdownclockrate128000ipadd23.23.23.3255.255.255.0ints0/0noshutdownclockrate128000ipadd172.16.35.3255.255.255.0iproute0.0.0.00.0.0.0s0/1R4:interfaceLoopback0ipaddress10.4.4.4255.255.255.0interfaceEthernet1/0nosh

5、ipaddress172.16.14.4255.255.255.0R5:interfaceLoopback0ipaddress10.5.5.5255.255.255.0ints0/0noshutdownclockrate128000ipadd172.16.35.5255.255.255.01、配置defaultrouteR1intlo192ipaddress192.168.1.1255.255.255.0routereig90net172.16.14.00.0.0.255net192.168.1.0ipdefault-n

6、etwork192.168.1.0R4routereig90noauto-summarynet10.4.4.00.0.0.255net172.16.14.00.0.0.255R3routeros89net172.16.35.00.0.0.255are0R5routeros89net172.16.35.00.0.0.255are0net10.5.5.00.0.0.255area0R4#shiprouteD*192.168.1.0/24[90/409600]via172.16.14.1,00:00:26,Ethernet1/

7、0R5#shiprouteO*E20.0.0.0/0[110/1]via172.16.35.3,00:04:42,Serial0/01、配置R1-NATinterfaceEthernet1/0ipnatinsideinterfaceSerial0/0ipnatoutsideipnatinsidesourcelist1interfaceSerial0/0overload!access-list1permit172.16.14.00.0.0.255R4#ping23.23.23.3sourcelo0…..R4#ping23.

8、23.23.3!!!!!2、配置R4：cryptoisakmppolicy10encraesauthenticationpre-sharegroup2cryptoisakmpkey0ciscoaddress23.23.23.3cryptoipsectransform-setTR-SETesp-aesesp-sha-h