98实验指导(NAT-T)-v1.docVIP

实验指导(NAT-Transparent VPN) 实验任务 任务：两地已经度连上了internet，现要把两个的网络通过Internet进行互联。数据在Internet传输时要保证安全性，使用NAT-T Site To Site VPN。 R1上有NAT存在，R3的peer应该指向R1。默认时，R4是支持NAT-T的，因此会把ESP的数据包封装在UDP(port:4500)数据包中的。封装格式如下： 注：路由器只支持：nat-t over udp 4500,不支持udp over 其他端口和nat-t over tcp。 R4-Local: IP UDP:4500 ESP DATA R1-NAT: IP UDP:4500 ESP DATA R3-Peer: IP UDP:4500 ESP DATA 实验步骤 R1、R2、R3上如图配置IP地址，打开接口，配置路由： RouterA（R1）: hostname R1-NAT int s0/0 no shutdown clock rate 128000 ip add interface Ethernet1/0 no sh ip address router eig 90 no auto-summary net 55 ip route s0/0 Internet（R2）: int s0/0 no shutdown clock rate 128000 ip add int s0/1 no shutdown clock rate 128000 ip add RouterB（R3）: int s0/1 no shutdown clock rate 128000 ip add int s0/0 no shutdown clock rate 128000 ip add ip route s0/1 R4: interface Loopback0 ip address interface Ethernet1/0 no sh ip address R5: interface Loopback0 ip address int s0/0 no shutdown clock rate 128000 ip add 配置default route R1 int lo192 ip address router eig 90 net 55 net ip default-network R4 router eig 90 no auto-summary net 55 net 55 R3 router os 89 net 55 are 0 R5 router os 89 net 55 are 0 net 55 area 0 R4#sh ip route D* /24 [90/409600] via , 00:00:26, Ethernet1/0 R5#sh ip route O*E2 /0 [110/1] via , 00:04:42, Serial0/0 配置R1-NAT interface Ethernet1/0 ip nat inside interface Serial0/0 ip nat outside ip nat inside source list 1 interface Serial0/0 overload ! access-list 1 permit 55 R4#ping source lo0 ….. R4#ping !!!!! 配置R4： crypto isakmp policy 10 encr aes authentication pre-share group 2 crypto isakmp key 0 cisco address crypto ipsec transform-set TR-SET esp-aes esp-sha-hmac crypto map STATIC-MAP 10 ipsec-isakmp set peer set transform-set TR-SET match address 110 access-list 110 permit ip 55 55 interface e1/0 crypto map STATIC-MAP !把加密应用到接口 配置R3 crypto isakmp policy 10 encr aes authentication pre-share grou