cisco_VN完全配置手册.docVIP

最详尽的cisco VPN完全配置手册（1）VPN配置手册－－－Vpn?Access?Server VPN?配置之一：vpn?access?server 网络拓扑：? PC---------Router---------Router? pc?R2?R1 PC配置:? IP?Address：/24? Default?Gateway：54 R1接口ip：?（VPN?Access?Server）? FastEthernet?0/0：54/24? Serial?1/0：/24 R2接口ip：?（Private?Network）? Serial?1/0：：/24? FastEthernet?0/0：54/24 2610的IOS为c2600-jk8o3s-mz.122-8.T5.bin R1步骤：? 1.配置isakmp?policy：? crypto?isakmp?policy?1? hash?md5? authentication?pre-share? group?2 2.配置vpn?client地址池? crypto?isakmp?client?configuration?address-pool?local?pool192? ip?local?pool?pool192??54 3.配置vpn?client有关参数? crypto?isakmp?client?configuration?group?vclient-group? （vclient-group就是在vpn?client的连接配置中需要输入的group?authentication?name。）? key?vclient-key? （vclient-key就是在vpn?client的连接配置中需要输入的group?authentication?password。）? pool?pool192?（client的ip地址从这里选取?）? （以上两个参数必须配置，其他参数还包括domain、dns、wins等，根据情况进行配置。） 4.配置ipsec?transform-set? crypto?ipsec?transform-set?vclient-tfs?esp-des?esp-md5-hmac 5.配置map模板? cry?dynamic-map?template-map?1? set?transform-set?vclient-tfs?（和第四步对应） 6.配置vpnmap? cry?map?vpnmap?1?ipsec-isakmp?dynamic?template-map? （使用第五步配置的map模板?）? crypto?map?vpnmap?isakmp?authorization?list?vclient-group? （使用第三步配置的参数authorization）? crypto?map?vpnmap?client?configuration?address?respond? （响应client分配地址的请求） 说明几点：? （1）vpn?client使用的ip?pool地址不能与Router内部网络ip地址重叠。? （2）?网段模拟公网地址，、?网段用于内部地址，?网段用于vpn通道。 R1的配置： r1#? r1#sh?run? Building?configuration... Current?configuration?:?1521?bytes? !? version?12.2? service?timestamps?debug?uptime? service?timestamps?log?uptime? no?service?password-encryption? !? hostname?r1? !? Enable?Password?cisco? !? ip?subnet-zero? !? ip?audit?notify?log? ip?audit?po?max-events?100? !? crypto?isakmp?policy?1? hash?md5? authentication?pre-share? group?2? crypto?isakmp?client?configuration?address-pool?local?pool192? !? crypto?isakmp?client?configuration?group?vclient-group? key?vclient-key-cisco? pool?vclient-pool? !? cry