新版CCNP-iscw中文实验手册

CCNP-ISCW实验手册CCNP-ISCW实验手册 (1)实验一：MPLS配置 (2)实验二：ipsec site-to-siteVPN配置 (8)实验三：GRE VPN的配置 (16)实验四：Ezvpn的配置 (20)实验五：本地AAA的配置 (28)实验六：CBAC配置 (31)实验一：MPLS配置实验环境：三台路由器Ethernet接口相连，接口配置如图要求：在三台路由器相连的接口分别启用MPLS,查看相应的结果，在启用前使其在OSPF 下互通。

步骤一：接口配置连通性，启用OSPF路由协议R1(config-if)#int e0/1R1(config-if)#ip add 10.1.1.1 255.255.255.0R1(config-if)#no shutdownR1(config)#int e0/0R1(config-if)#ip add 20.1.1.1 255.255.255.0R1(config-if)#no shR1(config)#router ospf 100 启用路由协议，发布接口R1(config-router)#net 10.1.1.0 0.0.0.255 area 0R1(config-router)#net 20.1.1.0 0.0.0.255 area 0R2(config)#int e0/1R2(config-if)#ip add 20.1.1.2 255.255.255.0R2(config-if)#no shR2(config-if)#int e0/0R2(config-if)#ip add 30.1.1.1 255.255.255.0R2(config-if)#no shR2(config)#router ospf 100R2(config-router)#net 20.1.1.0 0.0.0.255 area 0R2(config-router)#net 30.1.1.0 0.0.0.255 area 0R3(config)#int e0/1R3(config-if)#ip add 30.1.1.2 255.255.255.0R3(config-if)#no shR3(config-if)#int e0/0R3(config-if)#ip add 40.1.1.1 255.255.255.0R3(config-if)#no shR3(config-if)#exitR3(config)#router ospf 100R3(config-router)#net 30.1.1.0 0.0.0.255 area 0R3(config-router)#net 30.1.1.0 0.0.0.255 area 0步骤二：查看路由，并测试连通性R1#show ip route →查看路由表20.0.0.0/24 is subnetted, 1 subnetsC 20.1.1.0 is directly connected, Ethernet0/040.0.0.0/24 is subnetted, 1 subnetsO 40.1.1.0 [110/30] via 20.1.1.2, 00:00:15, Ethernet0/010.0.0.0/24 is subnetted, 1 subnetsC 10.1.1.0 is directly connected, Ethernet0/130.0.0.0/24 is subnetted, 1 subnetsO 30.1.1.0 [110/20] via 20.1.1.2, 00:00:15, Ethernet0/0 R2#show ip route20.0.0.0/24 is subnetted, 1 subnetsC 20.1.1.0 is directly connected, Ethernet0/140.0.0.0/24 is subnetted, 1 subnetsO 40.1.1.0 [110/20] via 30.1.1.2, 00:00:23, Ethernet0/010.0.0.0/24 is subnetted, 1 subnetsO 10.1.1.0 [110/20] via 20.1.1.1, 00:00:23, Ethernet0/130.0.0.0/24 is subnetted, 1 subnetsC 30.1.1.0 is directly connected, Ethernet0/0R3#show ip route →查看路由表，都也学到相关路由20.0.0.0/24 is subnetted, 1 subnetsO 20.1.1.0 [110/20] via 30.1.1.1, 00:00:06, Ethernet0/140.0.0.0/24 is subnetted, 1 subnetsC 40.1.1.0 is directly connected, Ethernet0/010.0.0.0/24 is subnetted, 1 subnetsO 10.1.1.0 [110/30] via 30.1.1.1, 00:00:06, Ethernet0/130.0.0.0/24 is subnetted, 1 subnetsC 30.1.1.0 is directly connected, Ethernet0/1R1#ping 40.1.1.1 →测试连通性Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 40.1.1.1, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 msR3#ping 10.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms步骤三：启用相关接口的MPLS,及快速转发功能R1(config)#ip cef →启用快速转发功能R1(config)#int e0/0R1(config-if)#mpls ip →接口启用MPLSR2(config)#ip cefR2(config)#int e0/1R2(config-if)#mpls ipR2(config-if)#int e0/0R2(config-if)#mpls ipR3(config)#ip cefR3(config)#int e0/1R3(config-if)#mpls ip步骤四：查看MPLS状态R1#show mpls forwarding-table →查看MPLS转发表Local Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface16 16 40.1.1.0/240 Et0/0 20.1.1.2 17Pop tag 30.1.1.0/24 0 Et0/0 20.1.1.2 R2#show mpls forwarding-tableLocal Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface16 Pop tag 40.1.1.0/24 0 Et0/0 30.1.1.217 Pop tag 10.1.1.0/240 Et0/1 20.1.1.1R3#show mpls forwarding-tableLocal Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface16 Pop tag 20.1.1.0/24 0 Et0/1 30.1.1.117 17 10.1.1.0/240 Et0/1 30.1.1.1 R1#show ip cef summary 查看CEF转发汇总信息及标记信息IP CEF with switching (Table Version 16), flags=0x016 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 016 leaves, 18 nodes, 20896 bytes, 21 inserts, 5 invalidations0 load sharing elements, 0 bytes, 0 referencesuniversal per-destination load sharing algorithm, id 86C8F0BF3(0) CEF resets, 0 revisions of existing leavesResolution Timer: Exponential (currently 1s, peak 1s)0 in-place/0 aborted modificationsrefcounts: 4877 leaf, 4864 nodeTable epoch: 0 (16 entries at this epoch)Adjacency Table has 2 adjacenciesR2#show ip cef summaryIP CEF with switching (Table Version 17), flags=0x017 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 017 leaves, 18 nodes, 21032 bytes, 22 inserts, 5 invalidations0 load sharing elements, 0 bytes, 0 referencesuniversal per-destination load sharing algorithm, id FCD3DE863(0) CEF resets, 0 revisions of existing leavesResolution Timer: Exponential (currently 1s, peak 1s)0 in-place/0 aborted modificationsrefcounts: 4879 leaf, 4864 nodeTable epoch: 0 (17 entries at this epoch)Adjacency Table has 4 adjacenciesR3#show ip cef summaryIP CEF with switching (Table Version 16), flags=0x016 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 016 leaves, 18 nodes, 20896 bytes, 21 inserts, 5 invalidations0 load sharing elements, 0 bytes, 0 referencesuniversal per-destination load sharing algorithm, id 86B9347C3(0) CEF resets, 0 revisions of existing leavesResolution Timer: Exponential (currently 1s, peak 1s) 0 in-place/0 aborted modificationsrefcounts: 4877 leaf, 4864 nodeTable epoch: 0 (16 entries at this epoch)Adjacency Table has 2 adjacencies注：也可用show ip cef detail这条命令来查看详细信息R1#ping 40.1.1.1 测试连通性!!!!!R3#ping 10.1.1.1!!!!!步骤五：显示当前配置信息R1#show runhostname R1ip cef!interface Ethernet0/0ip address 20.1.1.1 255.255.255.0half-duplextag-switching ip!interface Ethernet0/1ip address 10.1.1.1 255.255.255.0half-duplex!router ospf 100network 10.1.1.0 0.0.0.255 area 0network 20.1.1.0 0.0.0.255 area 0!endR2#show runhostname R2!ip cef!interface Ethernet0/0ip address 30.1.1.1 255.255.255.0half-duplextag-switching ip!interface Ethernet0/1ip address 20.1.1.2 255.255.255.0 half-duplextag-switching ip!router ospf 100network 20.1.1.0 0.0.0.255 area 0 network 30.1.1.0 0.0.0.255 area 0 !endR3#show runhostname R3!ip cef!interface Ethernet0/0ip address 40.1.1.1 255.255.255.0 half-duplex!interface Ethernet0/1ip address 30.1.1.2 255.255.255.0 half-duplextag-switching ip!router ospf 100network 30.1.1.0 0.0.0.255 area 0 network 40.1.1.0 0.0.0.255 area 0 !end实验二：ipsec site-to-siteVPN配置环境：两台路由器串口相连，接口配置如图要求：用两个LOOP口模拟VPN感兴趣流来建立IPSEC VPN,IKE1阶段用预共享密钥，IKE2阶段哈希算法用sha,加密算法用DES.步骤一：接口基本配置，并测试连通性R1(config)#int s0R1(config-if)#ip add 10.1.1.1 255.255.255.0R1(config-if)#clock rate 64000R1(config-if)#no shR1(config)#int loop 0R1(config-if)#ip add 1.1.1.1 255.255.255.0R2(config)#int s1R2(config-if)#ip add 10.1.1.2 255.255.255.0R2(config-if)#no shR2(config)#int loop 0R2(config-if)#ip add 1.1.2.1 255.255.255.0R1#ping 10.1.1.2 →测试连通性，再做IPSEC!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/32 msR2#ping 10.1.1.1!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 32/32/32 ms配置二：配置IKE1和IKE2两个阶段，并应用到接口R1(config)#crypto isakmp policy 10→IKE1阶段策略1R1(config-isakmp)#authen pre-share→将验证修改为预共享R1(config)#crypto isakmp key cisco address 10.1.1.2→定义预共享密钥R1(config)#crypto ipsec transform myset esp-sha-hmac esp-des→定义2阶段的转换集2R1(config)#access-list 100 permit ip 1.1.1.0 0.0.0.255 1.1.2.0 0.0.0.255→定义加密感兴趣流3R1(config)#crypto map mymap 10 ipsec-isakmp→定义2阶段加密图4配置密码映射% NOTE: This new crypto map will remain disabled until a peerand a valid access list have been configured.R1(config-crypto-map)#match address 100→将列表应用到加密图R1(config-crypto-map)#set peer 10.1.1.2→指定对等体R1(config-crypto-map)#set transform-set myset→将转换集映射到加密图R1(config)#int s0R1(config-if)#crypto map mymap→将加密图应用到接口5密码映射应用到接口*Mar 1 00:25:31.499: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ONR1(config)#ip route 1.1.2.0 255.255.255.0 10.1.1.2→指定隧道感兴趣流的路由走向R2(config)#crypto isakmp policy 10→R2与R1端策略要匹配R2(config-isakmp)#authentication pre-shareR2(config-isakmp)#exitR2(config)#crypto isakmp key cisco address 10.1.1.1→密钥一致，地址相互指R2(config)#crypto ipsec transform-set myset esp-des esp-sha-hmacR2(cfg-crypto-trans)#exit →两端必须匹配，默认即为tunnel模式R2(config)#access-list 102 permit ip 1.1.2.0 0.0.0.255 1.1.1.0 0.0.0.255→感兴趣流，两端互指R2(config)#crypto map mymap 10 ipsec-isakmp→加密图% NOTE: This new crypto map will remain disabled until a peerand a valid access list have been configured.R2(config-crypto-map)#set peer 10.1.1.1→对端的物理地址R2(config-crypto-map)#set transform-set mysetR2(config-crypto-map)#match address 102R2(config-crypto-map)#exitR2(config)#ip route 1.1.1.0 255.255.255.0 10.1.1.1→加密图感兴趣流的路由R2(config)#int s1R2(config-if)#crypto map mymap→加密映射应用到接口下*Mar 1 00:31:58.399: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON步骤三：测试流是否加密，直接用接口ping出R1#ping 1.1.2.1!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 32/33/36 msR2#ping 1.1.1.1!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 32/33/36 ms分别在R1和R2上查看两个阶段的关联：R1#show crypto isakmp sa→没有任何关联dst src state conn-id slotR2#show crypto isakmp sadst src state conn-id slotR1#show crypto ipsec sa→没有任何加密包，关联也没有建立interface: Serial0Crypto map tag: mymap, local addr. 10.1.1.1local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)current_peer: 10.1.1.2PERMIT, flags={origin_is_acl,}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2path mtu 1500, media mtu 1500current outbound spi: 0inbound esp sas:inbound ah sas:inbound pcp sas:outbound esp sas:outbound ah sas:outbound pcp sas:R2#show crypto ipsec sainterface: Serial1Crypto map tag: mymap, local addr. 10.1.1.2local ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)remote ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)current_peer: 10.1.1.1PERMIT, flags={origin_is_acl,}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0local crypto endpt.: 10.1.1.2, remote crypto endpt.: 10.1.1.1path mtu 1500, media mtu 1500current outbound spi: 0inbound esp sas:inbound ah sas:inbound pcp sas:outbound esp sas:outbound ah sas:outbound pcp sas:步骤四：用扩展ping来触发感兴趣流量R1#ping ipTarget IP address: 1.1.2.1Repeat count [5]: 10 →将包调为10个，否则一个ping看不到效果Extended commands [n]: ySource address or interface: 1.1.1.1Sending 10, 100-byte ICMP Echos to 1.1.2.1, timeout is 2 seconds:....!!!!!! →已经触发了感兴趣流，并且ping通Success rate is 60 percent (6/10), round-trip min/avg/max = 84/84/84 ms步骤五：再次查看两个阶段的关联，以及加密情况R1#show crypto isa sa →IKE1阶段关联已建立为快速模式dst src state conn-id slot10.1.1.2 10.1.1.1QM_IDLE 1 0R1#show crypto ipsec saIKE2阶段关联建立，并加密了流量，隧道也已成功建立interface: Serial0Crypto map tag: mymap, local addr. 10.1.1.1local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)current_peer: 10.1.1.2PERMIT, flags={origin_is_acl,}#pkts encaps: 6, #pkts encrypt: 6, #pkts digest 6#pkts decaps: 6, #pkts decrypt: 6, #pkts verify 6#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 14, #recv errors 0local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2path mtu 1500, media mtu 1500current outbound spi: 84AEB2E6inbound esp sas:spi: 0x1E44AB1D(507816733)transform: esp-des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 2000, flow_id: 1, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4607999/3520)IV size: 8 bytesreplay detection support: Yinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0x84AEB2E6(2226041574)transform: esp-des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 2001, flow_id: 2, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4607999/3520)IV size: 8 bytesreplay detection support: Youtbound ah sas:outbound pcp sas:R2#show crypto isa sadst src state conn-id slot10.1.1.2 10.1.1.1 QM_IDLE 1 0R2#show crypto ipsec sainterface: Serial1Crypto map tag: mymap, local addr. 10.1.1.2local ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)remote ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)current_peer: 10.1.1.1PERMIT, flags={origin_is_acl,}#pkts encaps: 6, #pkts encrypt: 6, #pkts digest 6#pkts decaps: 6, #pkts decrypt: 6, #pkts verify 6#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0local crypto endpt.: 10.1.1.2, remote crypto endpt.: 10.1.1.1path mtu 1500, media mtu 1500current outbound spi: 1E44AB1Dinbound esp sas: →进站流已经产生spi: 0x84AEB2E6(2226041574)transform: esp-des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 2000, flow_id: 1, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4607999/3502)IV size: 8 bytesreplay detection support: Yinbound ah sas:inbound pcp sas:outbound esp sas: →出站流已经产生spi: 0x1E44AB1D(507816733)transform: esp-des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 2001, flow_id: 2, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4607999/3502)IV size: 8 bytesreplay detection support: Youtbound ah sas:outbound pcp sas:配置五：查看当前的配置R1#show runhostname R1!crypto isakmp policy 10authentication pre-sharecrypto isakmp key cisco address 10.1.1.2!crypto ipsec transform-set myset esp-des esp-sha-hmac!crypto map mymap 10 ipsec-isakmpset peer 10.1.1.2set transform-set mysetmatch address 102!interface Loopback0ip address 1.1.1.1 255.255.255.0!interface Serial0ip address 10.1.1.1 255.255.255.0clockrate 64000crypto map mymap!ip route 1.1.2.0 255.255.255.0 10.1.1.2!access-list 102 permit ip 1.1.1.0 0.0.0.255 1.1.2.0 0.0.0.255 !endR2#show runhostname R2!crypto isakmp policy 10authentication pre-sharecrypto isakmp key cisco address 10.1.1.1!crypto ipsec transform-set myset esp-des esp-sha-hmac!crypto map mymap 10 ipsec-isakmpset peer 10.1.1.1set transform-set mysetmatch address 102!interface Loopback0ip address 1.1.2.1 255.255.255.0!interface Serial1ip address 10.1.1.2 255.255.255.0crypto map mymap!ip route 1.1.1.0 255.255.255.0 10.1.1.1!access-list 102 permit ip 1.1.2.0 0.0.0.255 1.1.1.0 0.0.0.255 !end实验三：GRE VPN的配置环境：三台路由器串口相连，接口配置如图要求：在R1和R3之间建立GRE隧道，地址如图步骤一：接口配置连通性，R1(config)#int s0R1(config-if)#ip add 20.1.1.1 255.255.255.0R1(config-if)#no shR1(config-if)#int lo0R1(config-if)#ip add 10.1.1.1 255.255.255.0 →虚拟私有网络R1(config)#ip route 0.0.0.0 0.0.0.0 20.1.1.2 →上互联网的缺省路由ISP(config)#int s0 →ISP路由器虚拟互联网ISP(config-if)#ip add 30.1.1.1 255.255.255.0ISP(config-if)#cl ra 64000ISP(config-if)#no shISP(config-if)#int s1ISP(config-if)#ip add 20.1.1.2 255.255.255.0ISP(config-if)#cl ra 64000ISP(config-if)#no shR3(config)#int s1R3(config-if)#ip add 30.1.1.2 255.255.255.0R3(config-if)#no shR3(config-if)#int loo 0R3(config-if)#ip add 40.1.1.1 255.255.255.0→虚拟私有网络R3(config-if)#exitR3(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.1→上互联网的缺省路由步骤二：测试哪些可达，哪些不可达R3#ping 10.1.1.1 →由于ISP没有私网的路由Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:U.U.USuccess rate is 0 percent (0/5)R3#ping 20.1.1.1 →合法地址是能够通讯的Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 20.1.1.1, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 56/60/64 ms步骤三：实施GRE隧道技术R1(config)#int tunnel 0 →进入隧道接口*Mar 1 00:15:45.607: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to downR1(config-if)#ip add 100.1.1.1 255.255.255.0 →指定IP地址，两端要在一个网段R1(config-if)#tunnel source s0 →指定承载隧道的源和目的接口R1(config-if)#tunnel destination 30.1.1.2*Mar 1 00:17:49.167: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to upR1(config-if)#no shR1(config)#ip route 40.1.1.0 255.255.255.0 tunnel 0 →为私有网络指路由走tunnel 接口R3(config)#int tunnel 0*Mar 1 00:19:49.919: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to downR3(config-if)#ip add 100.1.1.2 255.255.255.0R3(config-if)#tunnel source s1 →互指源和目的R3(config-if)#tunnel destination 20.1.1.1*Mar 1 00:20:32.103: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to upR3(config-if)#no shR3(config-if)#exitR3(config)#ip route 10.1.1.0 255.255.255.0 tunnel 0 →指对端的私有网络步骤四：做PING测试R1#ping 40.1.1.1 →都已PING通，证明GRE隧道已建立Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 40.1.1.1, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 72/72/76 msR3#ping 10.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 72/72/76 ms步骤五：验证结果R1#show int tunnel 0Tunnel0 is up, line protocol is up →tunnel接口已经UPHardware is TunnelInternet address is 100.1.1.1/24R3#show int tunnel 0Tunnel0 is up, line protocol is upHardware is TunnelInternet address is 100.1.1.2/24R1#show int tunnel 0 accounting→tunnel接口的统计信息，包的统计Tunnel0Protocol Pkts In Chars In Pkts Out Chars OutIP 10 1000 10 1000 R3#show int tunnel 0 accountingTunnel0Protocol Pkts In Chars In Pkts Out Chars OutIP 101000 10 1000 步骤六：显示当前配置R1#show runhostname R1!interface Loopback0ip address 10.1.1.1 255.255.255.0!interface Tunnel0ip address 100.1.1.1 255.255.255.0tunnel source Serial0tunnel destination 30.1.1.2!interface Serial0ip address 20.1.1.1 255.255.255.0!ip route 0.0.0.0 0.0.0.0 20.1.1.2ip route 40.1.1.0 255.255.255.0 Tunnel0EndISP#show runhostname ISP!interface Serial0ip address 30.1.1.1 255.255.255.0 clockrate 64000!interface Serial1ip address 20.1.1.2 255.255.255.0 clockrate 64000!endR3#show runhostname R3!interface Loopback0ip address 40.1.1.1 255.255.255.0!interface Tunnel0ip address 100.1.1.2 255.255.255.0 tunnel source s1tunnel destination 20.1.1.1!interface Serial1ip address 30.1.1.2 255.255.255.0!ip route 0.0.0.0 0.0.0.0 30.1.1.2ip route 10.1.1.0 255.255.255.0 Tunnel0 !End实验四：Ezvpn的配置环境：路由器（cisco）r1在一个公司的总部为EZVPN的server,远程internet用户要访问总部的内网，远程用户用的是cisco的EZVPN软件。