cisco 配置
发布网友
发布时间：2023-07-14 12:44
共3个回答
热心网友
时间：2024-11-19 17:21
r1#
r1#sh run
Building configuration...
Current configuration : 1521 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname r1
!
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 1
hash md5
authentication pre-share
group 2
crypto isakmp client configuration address-pool local pool192
!
crypto isakmp client configuration group vclient-group
key vclient-key
pool pool192
!
crypto ipsec transform-set vclient-tfs esp-des esp-md5-hmac
!
crypto dynamic-map template-map 1
set transform-set vclient-tfs
!
crypto map *map isakmp authorization list vclient-group
crypto map *map client configuration address respond
crypto map *map 1 ipsec-isakmp dynamic template-map
!
fax interface-type fax-mail
mta receive maximum-recipients 0
!
interface Ethernet0/0
ip address 10.1.1.100 255.255.255.0
half-plex
crypto map *map
!
interface Serial1/0
ip address 172.16.1.1 255.255.255.0
no fair-queue
!
router ospf 100
log-adjacency-changes
redistribute static
network 10.1.1.0 0.0.0.255 area 0
network 172.16.1.0 0.0.0.255 area 0
!
ip local pool pool192 192.168.1.1 192.168.1.254
ip classless
ip route 192.168.1.0 255.255.255.0 Ethernet0/0
ip http server
ip pim bidir-enable
!
call rsvp-sync
!
mgcp profile default
!
dial-peer cor custom
!
line con 0
line aux 0
line vty 0 4
login
!
end
r1#
R2的配置：
r2>en
r2#sh run
Building configuration...
Current configuration : 743 bytes
!
! Last configuration change at 09:45:04 UTC Thu Nov 4 2004
! NVRAM config last updated at 09:47:55 UTC Thu Nov 4 2004
!
version 12.3
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r2
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip subnet-zero
!
ip cef
!
interface FastEthernet0
ip address 172.16.2.1 255.255.255.0
speed auto
no keepalive
!
interface Serial0
ip address 172.16.1.2 255.255.255.0
clockrate 64000
no fair-queue
!
router ospf 100
log-adjacency-changes
network 172.16.1.0 0.0.0.255 area 0
network 172.16.2.0 0.0.0.255 area 0
!
ip classless
no ip http server
!
line con 0
line aux 0
line vty 0 4
login
!
end
r2#
R3的配置：
r3#sh run
Building configuration...
Current configuration : 1391 bytes
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r3
!
logging queue-limit 100
!
ip subnet-zero
!
ip dhcp excluded-address 10.2.2.1
!
ip dhcp pool dhcppool
import all
network 10.2.2.0 255.255.255.0
default-router 10.2.2.1
!
mpls ldp logging neighbor-changes
!
crypto ipsec client ez* vclient
connect auto
group vclient-group key vclient-key
local-address FastEthernet0/0
mode network-extension
peer 10.1.1.100
!
no voice hpi capture buffer
no voice hpi capture destination
!
mta receive maximum-recipients 0
!
interface FastEthernet0/0
ip address 10.1.1.2 255.255.255.0
speed auto
half-plex
crypto ipsec client ez* vclient
!
interface FastEthernet0/1
ip address 10.2.2.1 255.255.255.0
plex auto
speed auto
no keepalive
crypto ipsec client ez* vclient inside
!
router ospf 100
log-adjacency-changes
network 10.1.1.0 0.0.0.255 area 0
network 10.2.2.0 0.0.0.255 area 0
!
router ospf 100
log-adjacency-changes
network 10.1.1.0 0.0.0.255 area 0
network 10.2.2.0 0.0.0.255 area 0
!
ip http server
no ip http secure-server
ip classless
!
call rsvp-sync
!
mgcp profile default
!
dial-peer cor custom
!
line con 0
line aux 0
line vty 0 4
login
!
!
end
r3#
测试：
1. 配置好R3上的* client后，自动进行*连接。可以通过debug cry isa、deb cry ip client ez*、deb cry ip等debug命令输出的信息查看过程与结果。
2. 在R1上扩展ping，source 10.1.1.100 destination 10.2.2.1，通过。
查看show cry ip sa，可以发现数据没有进行加密。
3. 在R1上扩展ping，source 172.16.1.1 destination 10.2.2.1，通过。
查看show cry ip sa，可以发现数据通过加密进行传输。
4. 在R3上扩展ping，source 10.2.2.1 destination 172.16.1.1，通过。
查看show cry ip sa，可以发现数据通过加密进行传输。
5. 在R3上扩展ping，source 10.1.1.2 destination 172.16.1.1，?通过。
查看show cry ip sa，可以发现数据不通过加密。
6. 启动pc * client，ping 172.16.1.1，通过。
在1720上查看show cry ip sa，可以看到数据通过加密进行传输。
7. 在pc * client，ping 10.2.2.1，通过。
在R1和R3上查看show cry ip sa，可以看到数据通过加密进行传输。在R1上show cry isa sa，可以看到两个*连接。
8. 在R3上扩展ping，source 10.2.2.1 destination 192.168.1.10（pc * client获得的ip），通过。查看show cry ip sa，可以发现数据通过加密进行传输。
热心网友
时间：2024-11-19 17:21
热心网友
时间：2024-11-19 17:22
如果什么都不配置的话必须做NAT。并且还要做分离。
按我说的去做吧，不会的再问。
