中心端配置.docVIP

一．拓扑 二．中心端点配置 ZX#sh run IKE 阶段一 crypto isakmp policy 10 authentication pre-share crypto isakmp key cisco address ! IKE 阶段二 crypto ipsec transform-set trans esp-des esp-md5-hmac ! crypto dynamic-map vpnmap 10 set transform-set trans ! crypto map vpnmap 10 ipsec-isakmp dynamic vpnmap ! interface Loopback0 ip address 55 interface FastEthernet0/2 no switchport ip address crypto map vpnmap ! ip http server no ip http secure-server ip route 55 0 ip route 55 0 ! ip access-list extended vpn permit ip host host ! ZX#sh crypto en conn a ID Interface IP-Address State Algorithm Encrypt Decrypt 1 FastEthernet0/2 set HMAC_SHA+DES_56_CB 0 0 2001 FastEthernet0/2 set DES+MD5 0 0 2002 FastEthernet0/2 set DES+MD5 0 0 2003 FastEthernet0/2 set DES+MD5 0 100 2004 FastEthernet0/2 set DES+MD5 100 0 三．分支端点配置 FZ#sh run Building configuration... ! crypto isakmp policy 10 authentication pre-share crypto isakmp key cisco address ! ! crypto ipsec transform-set trans esp-des esp-md5-hmac ! crypto map vpnmap 10 ipsec-isakmp set peer set transform-set trans match address vpn ! ! ! ! interface Loopback0 ip address 55 ! interface Loopback2 no ip address ! interface FastEthernet0/0 no switchport ip address crypto map vpnmap ! interface FastEthernet0/1 ! ip http server no ip http secure-server ip route 55 0 ip route 55 0 ! ! ! ! ip access-list extended vpn permit ip host host log ip access-list extended vpnmap ! ! ! End 二．调试信息解说 4506-1# *Mar 1 00:14:29.891: ISAKMP (0:0): received packet from dport 500 sport 500 Global (N) NEW SA *Mar 1 00:14:29.895: ISAKMP: Created a peer struct for , peer port 500 *Mar 1 00:14:29.899: ISAKMP: New peer created peer = 0x6420DFB0 peer_handle = 0*Mar 1 00:14:29.903: IS