:
nameif Inside
security-level 100
ip address 192.168.1.1 255.255.255.0
no shut
interface Ethernet1
nameif Outside
security-level 0
ip address 1.1.1.1 255.255.255.252
ip address 1.1.1.2 255.255.255.252
ip nat inside
interface Ethernet0/1
ip address 202.100.1.2 255.255.255.252
ip nat outside
permit ip host 1.1.1.1 any
permit ip 192.168.1.0 0.0.0.255 any
ip route 192.168.1.0 255.255.255.0 1.1.1.1
ip nat inside source static udp 1.1.1.1 500 interface Ethernet0/1 500
ip address 202.100.1.1 255.255.255.252
interface Ethernet0/1
ip address 202.100.1.9 255.255.255.252
interface Ethernet0/2
ip address 202.100.1.5 255.255.255.252
ip address 2.2.2.1 255.255.255.252
ip nat inside
interface Ethernet0/1
ip address 202.100.1.10 255.255.255.252
ip nat outside
ip route 192.168.2.0 255.255.255.0 2.2.2.2
permit ip 192.168.2.0 0.0.0.255 any
ip nat inside source list PAT interface Ethernet0/1 overload
ip nat inside source static udp 2.2.2.2 4500 interface Ethernet0/1 4500
ip nat inside source static udp 2.2.2.2 500 interface Ethernet0/1 500
—如果不配置静态PAT,则不能由总部直接向这边发起***访问。
nameif Inside
security-level 100
ip address 192.168.2.1 255.255.255.0
interface Ethernet1
nameif Outside
security-level 0
ip address 2.2.2.2 255.255.255.252
ip address 192.168.3.1 255.255.255.0
ip nat inside
interface Ethernet0/1
ip address 202.100.1.6 255.255.255.252
ip nat outside
deny ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
deny ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.3.0 0.0.0.255 any
ISP#
*Mar 1 02:44:21.135: ICMP: echo reply sent, src 202.100.1.1, dst 202.100.1.2
*Mar 1 02:44:22.411: ICMP: echo reply sent, src 202.100.1.1, dst 202.100.1.2
*Mar 1 02:44:23.467: ICMP: echo reply sent, src 202.100.1.1, dst 202.100.1.2
*Mar 1 02:44:24.659: ICMP: echo reply sent, src 202.100.1.1, dst 202.100.1.2
*Mar 1 02:44:25.743: ICMP: echo reply sent, src 202.100.1.1, dst 202.100.1.2
ICMP packet debugging is on
ISP#
*Mar 1 02:46:28.855: ICMP: echo reply sent, src 202.100.1.9, dst 202.100.1.10
*Mar 1 02:46:30.151: ICMP: echo reply sent, src 202.100.1.9, dst 202.100.1.10
*Mar 1 02:46:31.363: ICMP: echo reply sent, src 202.100.1.9, dst 202.100.1.10
*Mar 1 02:46:32.427: ICMP: echo reply sent, src 202.100.1.9, dst 202.100.1.10
*Mar 1 02:46:33.631: ICMP: echo reply sent, src 202.100.1.9, dst 202.100.1.10
③上海分支访问互联网测试:
ICMP packet debugging is on
*Mar 1 02:48:03.875: ICMP: echo reply sent, src 202.100.1.5, dst 202.100.1.6
*Mar 1 02:48:05.003: ICMP: echo reply sent, src 202.100.1.5, dst 202.100.1.6
*Mar 1 02:48:06.115: ICMP: echo reply sent, src 202.100.1.5, dst 202.100.1.6
*Mar 1 02:48:07.183: ICMP: echo reply sent, src 202.100.1.5, dst 202.100.1.6
*Mar 1 02:48:08.279: ICMP: echo reply sent, src 202.100.1.5, dst 202.100.1.6
authentication pre-share
encryption des
hash md5
group 2
tunnel-group 202.100.1.6 ipsec-attributes
pre-shared-key cisco
tunnel-group 202.100.1.10 type ipsec-l2l
tunnel-group 202.100.1.10 ipsec-attributes
pre-shared-key cisco
access-list ***-GZ-to-BJ extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list ***-GZ-to-SH extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list ***-GZ-to-SH extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
crypto map crymap 10 match address ***-GZ-to-SH
crypto map crymap 10 set peer 202.100.1.6
crypto map crymap 10 set transform-set transet
crypto map crymap 20 match address ***-GZ-to-BJ
crypto map crymap 20 set peer 202.100.1.10
crypto map crymap 20 set transform-set transet
crypto map crymap interface Outside
authentication pre-share
encryption des
hash md5
group 2
tunnel-group 202.100.1.2 ipsec-attributes
pre-shared-key cisco
access-list *** extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
crypto map crymap 10 set peer 202.100.1.2
crypto map crymap 10 set transform-set transet
crypto map crymap interface Outside
crypto isakmp enable Outside
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 202.100.1.2
permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
set peer 202.100.1.2
set transform-set transet
match address ***
crypto map crymap
crypto map crymap
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 202.100.1.2
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
dst src state conn-id slot status
202.100.1.2 202.100.1.6 QM_IDLE 1 0 ACTIVE
SHGW#show crypto engine connections active
ID Interface IP-Address State Algorithm Encrypt Decrypt
1 Ethernet0/1 202.100.1.6 set HMAC_MD5+DES_56_CB 0 0
2001 Ethernet0/1 202.100.1.6 set DES+MD5 4 0
2002 Ethernet0/1 202.100.1.6 set DES+MD5 0 4
ID Interface IP-Address State Algorithm Encrypt Decrypt
1 Ethernet0/1 202.100.1.6 set HMAC_MD5+DES_56_CB 0 0
2 Ethernet0/1 202.100.1.6 set HMAC_MD5+DES_56_CB 0 0
2001 Ethernet0/1 202.100.1.6 set DES+MD5 4 0
2002 Ethernet0/1 202.100.1.6 set DES+MD5 0 4
2003 Ethernet0/1 202.100.1.6 set DES+MD5 4 0
2004 Ethernet0/1 202.100.1.6 set DES+MD5 0 3
SHGW#show crypto isakmp sa
dst src state conn-id slot status
202.100.1.2 202.100.1.6 QM_IDLE 2 0 ACTIVE
今天的文章两分公支的IPSec***流量走总部测试分享到此就结束了,感谢您的阅读。
版权声明:本文内容由互联网用户自发贡献,该文观点仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 举报,一经查实,本站将立刻删除。
如需转载请保留出处:http://bianchenghao.cn/68251.html