實(shí)驗(yàn)拓?fù)洹?BR> 
實(shí)驗(yàn)說明：在r1 、r2之間使用快速以太網(wǎng)進(jìn)行連接
在r1上的1.1.1.1/24希望與r2 上的2.2.2.2/24網(wǎng)絡(luò)通過IPSECVPN進(jìn)行通信
采用預(yù)共享密鑰配置
實(shí)驗(yàn)步驟：
接口配置：
r1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r1(config)#int e0/0
r1(config-if)#no sh
*Mar 1 00:02:01.663: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up
*Mar 1 00:02:02.663: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up
r1(config-if)#ip add 192.168.1.1 255.255.255.0
r1(config)#int lo 0
r1(config-if)#ip add 1.1.1.1 255.255.255.0
r1(config-if)#no sh
r1(config)#ip route
r1(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.2
r1(config)#
r2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r2(config)#int e0/0
r2(config-if)#no sh
*Mar 1 00:07:07.839: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up
*Mar 1 00:07:08.839: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up
r2(config-if)#ip add 192.168.1.2 255.255.255.0
r2(config-if)#int lo0
r2(config-if)#ip add 2.2.2.2 255.255.255.0
r2(config-if)#no sh
r2(config-if)#ip route 0.0.0.0 0.0.0.0 192.168.1.1
第二步：配置互聯(lián)網(wǎng)密鑰交換（IKE）
r1(config)#crypto isakmp enable 開啟ISAKMP
r1(config)#cry isakmp policy 10 配置ISAKMP的優(yōu)先級(jí)是10
r1(config-isakmp)#authentication pre-share 認(rèn)證方式是預(yù)共享密鑰
r1(config-isakmp)#encryption 3des 加密方式是 3des
r1(config-isakmp)#group ?
1 Diffie-Hellman group 1
2 Diffie-Hellman group 2
5 Diffie-Hellman group 5
r1(config-isakmp)#group 5 配置密鑰交換參數(shù)選擇1536的diffie-hellman
r1(config-isakmp)#hash sha 配置消息完整性算法為SHA-1（160比特簽名）
r1(config-isakmp)#lifetime 86400 配置ISAKMP建立的SA的壽命
r1(config-isakmp)#exit
r1(config)#crypto isakmp key admin add 192.168.1.2
配置預(yù)共享密鑰，密鑰是admin ，遠(yuǎn)程對(duì)等體的IP地址為192.168.1.2
r2(config)#crypto isakmp enable
r2(config)#
r2(config)#
r2(config)#cry
r2(config)#crypto is
r2(config)#crypto isakmp p
r2(config)#crypto isakmp p?
peer policy profile
r2(config)#crypto isakmp policy 10
r2(config-isakmp)#authentication pre-share
r2(config-isakmp)#authentication pre
r2(config-isakmp)#encryption ?
3des Three key triple DES
aes AES - Advanced Encryption Standard.
des DES - Data Encryption Standard (56 bit keys).
r2(config-isakmp)#encryption 3des
r2(config-isakmp)#group 5
r2(config-isakmp)#hash sha
r2(config-isakmp)#lifetime ?
<60-86400> lifetime in seconds
r2(config-isakmp)#lifetime 86400
r2(config-isakmp)#exit
r2(config)#crypto isakmp key admin add 192.168.1.1
第三步：配置IPSEC變換集
r1(config)#crypto ipsec transform-set r1set esp-3des esp-md5-hmac 創(chuàng)建一個(gè)交換集是ipsec，交換集定義數(shù)據(jù)流量如何被保護(hù)如果不配置連接模式，默認(rèn)是TUNNEL,mode tunnel
r1(cfg-crypto-trans)#exit
r1(config)#crypto map r1* 10 ipsec-isakmp 創(chuàng)建一張MAP表r1*，并關(guān)聯(lián)優(yōu)先集為10的isakmp設(shè)置
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
r1(config-crypto-map)#set peer 192.168.1.2 配置對(duì)等體的地址
r1(config-crypto-map)#set transform-set r1set 將交換集與r1*表關(guān)聯(lián)
r1(config-crypto-map)#match add ?
<100-199> IP access-list number
<2000-2699> IP access-list number (expanded range)
WORD Access-list name
r1(config-crypto-map)#match add 100將拓展訪問控制列表應(yīng)用到r1*中去
（引用擴(kuò)展ACL）
r2(config)#crypto ipsec transform-set r2set esp-3des esp-md5-hmac
r2(cfg-crypto-trans)#exit
r2(config-crypto-map)#set peer 192.168.1.1 配置對(duì)等體的地址
r2(config-crypto-map)#set transform-set r2set
r2(config-crypto-map)#match address 100
r2(config)#cry map r2* 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
r2(config-crypto-map)#match address 100
第四步：定義觸發(fā)流量，即IPSEC連接保護(hù)何種流量
r1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r1(config)#acce 100 per icmp 1.1.1.1 0.0.0.0 2.2.2.2 0.0.0.0
定義對(duì)icmp的數(shù)據(jù)進(jìn)行IPSEC保護(hù)
r1(config)#int e0/0
r1(config-if)#cry map r1* 將加密映射應(yīng)運(yùn)與接口
*Mar 1 01:26:09.023: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
r2(config)#access-list 100 per icmp 2.2.2.2 0.0.0.0 1.1.1.1 0.0.0.0
配置r2上ACL 必須為r1上的鏡像
r2(config)#int e0/0
r2(config-if)#cry map r2*
實(shí)驗(yàn)說明：在r1 、r2之間使用快速以太網(wǎng)進(jìn)行連接
在r1上的1.1.1.1/24希望與r2 上的2.2.2.2/24網(wǎng)絡(luò)通過IPSECVPN進(jìn)行通信
采用預(yù)共享密鑰配置
實(shí)驗(yàn)步驟：
接口配置：
r1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r1(config)#int e0/0
r1(config-if)#no sh
*Mar 1 00:02:01.663: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up
*Mar 1 00:02:02.663: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up
r1(config-if)#ip add 192.168.1.1 255.255.255.0
r1(config)#int lo 0
r1(config-if)#ip add 1.1.1.1 255.255.255.0
r1(config-if)#no sh
r1(config)#ip route
r1(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.2
r1(config)#
r2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r2(config)#int e0/0
r2(config-if)#no sh
*Mar 1 00:07:07.839: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up
*Mar 1 00:07:08.839: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up
r2(config-if)#ip add 192.168.1.2 255.255.255.0
r2(config-if)#int lo0
r2(config-if)#ip add 2.2.2.2 255.255.255.0
r2(config-if)#no sh
r2(config-if)#ip route 0.0.0.0 0.0.0.0 192.168.1.1
第二步：配置互聯(lián)網(wǎng)密鑰交換（IKE）
r1(config)#crypto isakmp enable 開啟ISAKMP
r1(config)#cry isakmp policy 10 配置ISAKMP的優(yōu)先級(jí)是10
r1(config-isakmp)#authentication pre-share 認(rèn)證方式是預(yù)共享密鑰
r1(config-isakmp)#encryption 3des 加密方式是 3des
r1(config-isakmp)#group ?
1 Diffie-Hellman group 1
2 Diffie-Hellman group 2
5 Diffie-Hellman group 5
r1(config-isakmp)#group 5 配置密鑰交換參數(shù)選擇1536的diffie-hellman
r1(config-isakmp)#hash sha 配置消息完整性算法為SHA-1（160比特簽名）
r1(config-isakmp)#lifetime 86400 配置ISAKMP建立的SA的壽命
r1(config-isakmp)#exit
r1(config)#crypto isakmp key admin add 192.168.1.2
配置預(yù)共享密鑰，密鑰是admin ，遠(yuǎn)程對(duì)等體的IP地址為192.168.1.2
r2(config)#crypto isakmp enable
r2(config)#
r2(config)#
r2(config)#cry
r2(config)#crypto is
r2(config)#crypto isakmp p
r2(config)#crypto isakmp p?
peer policy profile
r2(config)#crypto isakmp policy 10
r2(config-isakmp)#authentication pre-share
r2(config-isakmp)#authentication pre
r2(config-isakmp)#encryption ?
3des Three key triple DES
aes AES - Advanced Encryption Standard.
des DES - Data Encryption Standard (56 bit keys).
r2(config-isakmp)#encryption 3des
r2(config-isakmp)#group 5
r2(config-isakmp)#hash sha
r2(config-isakmp)#lifetime ?
<60-86400> lifetime in seconds
r2(config-isakmp)#lifetime 86400
r2(config-isakmp)#exit
r2(config)#crypto isakmp key admin add 192.168.1.1
第三步：配置IPSEC變換集
r1(config)#crypto ipsec transform-set r1set esp-3des esp-md5-hmac 創(chuàng)建一個(gè)交換集是ipsec，交換集定義數(shù)據(jù)流量如何被保護(hù)如果不配置連接模式，默認(rèn)是TUNNEL,mode tunnel
r1(cfg-crypto-trans)#exit
r1(config)#crypto map r1* 10 ipsec-isakmp 創(chuàng)建一張MAP表r1*，并關(guān)聯(lián)優(yōu)先集為10的isakmp設(shè)置
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
r1(config-crypto-map)#set peer 192.168.1.2 配置對(duì)等體的地址
r1(config-crypto-map)#set transform-set r1set 將交換集與r1*表關(guān)聯(lián)
r1(config-crypto-map)#match add ?
<100-199> IP access-list number
<2000-2699> IP access-list number (expanded range)
WORD Access-list name
r1(config-crypto-map)#match add 100將拓展訪問控制列表應(yīng)用到r1*中去
（引用擴(kuò)展ACL）
r2(config)#crypto ipsec transform-set r2set esp-3des esp-md5-hmac
r2(cfg-crypto-trans)#exit
r2(config-crypto-map)#set peer 192.168.1.1 配置對(duì)等體的地址
r2(config-crypto-map)#set transform-set r2set
r2(config-crypto-map)#match address 100
r2(config)#cry map r2* 10 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
r2(config-crypto-map)#match address 100
第四步：定義觸發(fā)流量，即IPSEC連接保護(hù)何種流量
r1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r1(config)#acce 100 per icmp 1.1.1.1 0.0.0.0 2.2.2.2 0.0.0.0
定義對(duì)icmp的數(shù)據(jù)進(jìn)行IPSEC保護(hù)
r1(config)#int e0/0
r1(config-if)#cry map r1* 將加密映射應(yīng)運(yùn)與接口
*Mar 1 01:26:09.023: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
r2(config)#access-list 100 per icmp 2.2.2.2 0.0.0.0 1.1.1.1 0.0.0.0
配置r2上ACL 必須為r1上的鏡像
r2(config)#int e0/0
r2(config-if)#cry map r2*