IpsecVPN对等体冗余之HSRP冗余实验配置.docVIP

Ipsec VPN对等体冗余之HSRP冗余（无状态化故障切换）实验配置 SPOKE，Internal-router的loopback0接口模拟内部网络，VPNHUB1，VPNHUB2模拟VPN gateway，并且他们之间允许HSRP以提供VPN gateway的冗余，VPNHUB1，VPNHUB2的HSRP track接口为其自身的loopback0。SPOKE启用VPN失效对等体检测（DPD），以此检测远程VPN gateway是否存活，进而delete失效对等体的SA，当有感兴趣流时重新发起IPSEC VPN连接，连接到冗余的VPN gateway上。由于本实验使用的IOS不支持SSP，因此无法模拟状态化故障切换。VPNHUB间进行的是无状态好故障切换。VPN gateway内部网络运行OSPF协议，并且需要将VPN reverse-route redistribute进OSPF以便内部网络获悉SPOKE端内部网络路由。 SPOKE configuration SPOKE#sh run Building configuration... Current configuration : 1396 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SPOKE ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ! ! ip cef no ip domain lookup ! ! ! ! ! ! ! ! crypto isakmp policy 10 hash md5 authentication pre-share group 2 crypto isakmp key xinjialove address #HSRP standby virtual IP crypto isakmp keepalive 10 3 periodic ! ! crypto ipsec transform-set xinjialove esp-des esp-md5-hmac ! crypto map xinjialove 10 ipsec-isakmp set peer set transform-set xinjialove match address 100 ! ! ! ! interface Loopback0 ip address 55 ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial1/0 no ip address shutdown serial restart-delay 0 ! interface Serial1/1 ip address serial restart-delay 0 crypto map xinjialove ! interface Serial1/2 no ip address shutdown serial restart-delay 0 ! interface Serial1/3 no ip address shutdown serial restart-delay 0 ! interface FastEthernet2/0 no ip address shutdown duplex auto speed auto ! ip http server no ip http secure-server ! ip route Serial1/1 ! ! access-list 100 permit ip host host ! ! control-plane ! ! ! ! ! ! line con 0 logging synchronous line aux 0 line vty 0 4 ! ! end VPNHUB1 configuration VPNHUB1#sh run Building configuration... Current configuration : 1578 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec