gre+IPSE+NAT+策略路由实验

实例1 站点-站点IPSEC VPN+NA T+策略路由配置要求：（1）网络10.2.2.0/24 与10.1.1.0/2通信使用VPN（2）网络10.2.2.0/24 、10.1.1.0/2与Internet通信使用NA T1.R1的配置hostname r1!!crypto isakmp policy 10hash md5authentication pre-sharecrypto isakmp key cisco123 address 200.1.1.2!!crypto ipsec transform-set myset esp-des esp-md5-hmac!crypto map mymap 10 ipsec-isakmpset peer 200.1.1.2set transform-set mysetmatch address 100!interface Ethernet0/0ip address 10.2.2.1 255.255.255.0ip nat insideip virtual-reassemblyhalf-duplex!interface Ethernet0/1ip address 100.1.1.1 255.255.255.0ip nat outsidecrypto map mymap!ip route 0.0.0.0 0.0.0.0 100.1.1.2!ip nat inside source route-map nonat interface Ethernet0/1 overload !access-list 100 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255 access-list 120 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255 access-list 120 permit ip 10.2.2.0 0.0.0.255 any!route-map nonat permit 10match ip address 120!2.R3的配置：hostname r3!crypto isakmp policy 10hash md5authentication pre-sharecrypto isakmp key cisco123 address 100.1.1.1!!crypto ipsec transform-set myset esp-des esp-md5-hmac!crypto map mymap 10 ipsec-isakmpset peer 100.1.1.1set transform-set mysetmatch address 100!interface Ethernet0/0ip address 10.1.1.1 255.255.255.0ip nat inside!interface Ethernet0/1ip address 200.1.1.2 255.255.255.0ip nat outsidecrypto map mymap!ip route 0.0.0.0 0.0.0.0 200.1.1.1!ip nat inside source route-map nonat interface Ethernet0/1 overload!access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255access-list 120 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255access-list 120 permit ip 10.1.1.0 0.0.0.255 any!route-map nonat permit 10match ip address 120!3.R2的配置hostname r2!interface Ethernet0/0ip address 200.2.2.1 255.255.255.0!interface Ethernet0/1ip address 100.1.1.2 255.255.255.0!interface Ethernet0/2ip address 200.1.1.1 255.255.255.0测试：r1#show crypto isakmp sadst src state conn-id slot status100.1.1.1 200.1.1.2 QM_IDLE 1 0 ACTIVE r1#show crypto ipsec sainterface: Ethernet0/1Crypto map tag: mymap, local addr 100.1.1.1protected vrf: (none)local ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)current_peer 200.1.1.2 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 149, #pkts encrypt: 149, #pkts digest: 149#pkts decaps: 64, #pkts decrypt: 64, #pkts verify: 64#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 100.1.1.1, remote crypto endpt.: 200.1.1.2 path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/1current outbound spi: 0xD81B7A10(3625679376)inbound esp sas:spi: 0x124FC348(307217224)transform: esp-des esp-md5-hmac ,in use settings ={Tunnel, }conn id: 2001, flow_id: SW:1, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4418170/856)IV size: 8 bytesreplay detection support: YStatus: ACTIVEinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0xD81B7A10(3625679376)transform: esp-des esp-md5-hmac ,in use settings ={Tunnel, }conn id: 2002, flow_id: SW:2, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4418155/848)IV size: 8 bytesreplay detection support: YStatus: ACTIVEoutbound ah sas:outbound pcp sas:实例2：GRE over IPSEC VPN+NA T+策略路由配置r1#show runhostname r1!crypto isakmp policy 10hash md5authentication pre-sharecrypto isakmp key cisco123 address 200.1.1.2!!crypto ipsec transform-set myset esp-des esp-md5-hmacmode transport!crypto map mymap 10 ipsec-isakmpset peer 200.1.1.2set transform-set mysetmatch address 100!interface Tunnel0ip address 192.168.1.1 255.255.255.252tunnel source 100.1.1.1tunnel destination 200.1.1.2!interface Ethernet0/0ip address 10.2.2.1 255.255.255.0ip nat insideip virtual-reassemblyhalf-duplex!interface Ethernet0/1ip address 100.1.1.1 255.255.255.0ip nat outsideip virtual-reassemblyhalf-duplexcrypto map mymap!ip route 0.0.0.0 0.0.0.0 100.1.1.2ip route 10.1.1.0 255.255.255.0 Tunnel0!ip nat inside source route-map nonat interface Ethernet0/1 overload !access-list 100 permit ip host 100.1.1.1 host 200.1.1.2access-list 120 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255 access-list 120 permit ip 10.2.2.0 0.0.0.255 any!route-map nonat permit 10match ip address 120!r3#show run!hostname r3!!crypto isakmp policy 10hash md5authentication pre-sharecrypto isakmp key cisco123 address 100.1.1.1!!crypto ipsec transform-set myset esp-des esp-md5-hmacmode transport!crypto map mymap 10 ipsec-isakmpset peer 100.1.1.1set transform-set mysetmatch address 100!interface Tunnel0ip address 192.168.1.2 255.255.255.252tunnel source 200.1.1.2tunnel destination 100.1.1.1!interface Ethernet0/0ip address 10.1.1.1 255.255.255.0ip nat insideip virtual-reassemblyhalf-duplex!interface Ethernet0/1ip address 200.1.1.2 255.255.255.0ip nat outsideip virtual-reassemblyhalf-duplexcrypto map mymap!ip route 0.0.0.0 0.0.0.0 200.1.1.1ip route 10.2.2.0 255.255.255.0 Tunnel0!ip nat inside source route-map nonat interface Ethernet0/1 overload !access-list 100 permit ip host 200.1.1.2 host 100.1.1.1access-list 120 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 access-list 120 permit ip 10.1.1.0 0.0.0.255 any!route-map nonat permit 10match ip address 120!测试：r3#show crypto isakmp sadst src state conn-id slot status100.1.1.1 200.1.1.2 QM_IDLE 1 0 ACTIVE r3#show crypto ipsec sainterface: Ethernet0/1Crypto map tag: mymap, local addr 200.1.1.2protected vrf: (none)local ident (addr/mask/prot/port): (200.1.1.2/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (100.1.1.1/255.255.255.255/0/0)current_peer 100.1.1.1 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 20, #pkts encrypt: 20, #pkts digest: 20#pkts decaps: 20, #pkts decrypt: 20, #pkts verify: 20#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 200.1.1.2, remote crypto endpt.: 100.1.1.1 path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/1current outbound spi: 0xB147A485(2974262405)inbound esp sas:spi: 0xAC202182(2887786882)transform: esp-des esp-md5-hmac ,in use settings ={Transport, }conn id: 2004, flow_id: SW:4, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4576701/3131)IV size: 8 bytesreplay detection support: YStatus: ACTIVEinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0xB147A485(2974262405)transform: esp-des esp-md5-hmac ,in use settings ={Transport, }conn id: 2003, flow_id: SW:3, crypto map: mymapsa timing: remaining key lifetime (k/sec): (4576700/3130)IV size: 8 bytesreplay detection support: YStatus: ACTIVEoutbound ah sas:outbound pcp sas:r3#show interfaces tunnel 0Tunnel0 is up, line protocol is upHardware is TunnelInternet address is 192.168.1.2/30MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not setKeepalive not setTunnel source 200.1.1.2, destination 100.1.1.1Tunnel protocol/transport GRE/IPKey disabled, sequencing disabledChecksumming of packets disabledTunnel TTL 255Fast tunneling enabledTunnel transmit bandwidth 8000 (kbps)Tunnel receive bandwidth 8000 (kbps)Last input 00:09:41, output 00:09:41, output hang neverLast clearing of "show interface" counters neverInput queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifoOutput queue: 0/0 (size/max)5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec20 packets input, 2244 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort20 packets output, 2484 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 output buffer failures, 0 output buffers swapped out。