IPSECDMVPN实验配置.docVIP

IPSEC DMVPN 实验配置 SPOKE1，SPOKE2，VPN-gateway为C网络边界路由器，loopback0接口模拟企业内部PC，C网络运行的IGP为OSPF，CE2为OSPF DR。为了防止OSPFneighbor关系不同步进而造成OSPF database不同步，因此CE1，CE2的tunnel 0接口的ospf priority配置为0。将各个分支tunnel 0接口ospf 网络类型配置为broadcast（默认ospf 网络类型为点到多点），这样分支路由器才能在前往目标前缀的路由中将合适的分支指定为下一跳，这样分支之间的数据流就可以直接进行收发而无需经由VPN gateway中转，进而可以动态建立分支与分支之间的IPSEC VPN连接。如果C网络使用距离矢量路由选择协议时，必须禁用水平分割，这样中心路由器才能将路由选择更新从收到他们的mGRE接口重新通告出去。链路状态路由选择协议将自动确定合适的下一跳（网络类型为broadcast）。VPN-gateway为NHRP NHS。 SPOKE1 configuration SPOKE1#sh run Building configuration... Current configuration : 1879 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SPOKE1 ! boot-start-marker boot-end-marker ! ! no aaa new-model ip cef ! ! ! ! no ip domain lookup ! multilink bundle-name authenticated ! ! ! ! ! crypto isakmp policy 10 hash md5 authentication pre-share group 2 crypto isakmp key xinjialove address ! ! crypto ipsec transform-set xinjialove esp-des esp-md5-hmac mode transport ! crypto ipsec profile xinjialove set transform-set xinjialove ! ! ! ! ! ! interface Loopback0 ip address 55 ! interface Tunnel0 ip address no ip redirects ip nhrp authentication cisco ip nhrp map ip nhrp map multicast ip nhrp network-id 1 ip nhrp nhs ip nhrp cache non-authoritative ip ospf network broadcast ip ospf priority 0 tunnel source Serial1/1 tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile xinjialove ! interface FastEthernet0/0 no ip address shutdown duplex half ! interface Serial1/0 no ip address shutdown serial restart-delay 0 ! interface Serial1/1 ip address serial restart-delay 0 clock rate 64000 ! interface Serial1/2 no ip address shutdown serial restart-delay 0 ! interface Serial1/3 no ip address shutdown serial restart-delay 0 ! interface FastEthernet2/0 no ip address shutdown duplex half ! router ospf 1 log-adjacency-changes network area 0 network 55 area 0 ! ip route Serial1/