安全CCIE之路——实验VPN冗错.docVIP

实验 VPN容错 一实验拓扑 Set peer及loopback方式图 Hsrp和rri方式图 二实验要求 做到VPN链路故障切换 三 实验方案一（多对等体） 配置信息 r1#show run crypto isakmp policy 10 hash md5 authentication pre-share group 2 crypto isakmp key cisco address 9.1.1.22 crypto isakmp key cisco address 9.1.1.26 crypto isakmp keepalive 20 DPD配置，检测对端是否安好 crypto ipsec transform-set cisco esp-des esp-md5-hmac crypto map text 10 ipsec-isakmp set peer 9.1.1.22 set peer 9.1.1.26 set transform-set cisco match address 100 interface Loopback0 ip address 10.0.64.1 255.255.255.0 interface Serial0/1 ip address 9.1.1.129 255.255.255.252 serial restart-delay 0 crypto map text ip route 0.0.0.0 0.0.0.0 9.1.1.130 access-list 100 permit ip 10.0.64.0 0.0.0.255 10.1.0.0 0.0.0.255 r3#show run crypto isakmp policy 10 hash md5 authentication pre-share group 2 crypto isakmp key cisco address 9.1.1.129 crypto isakmp keepalive 20 crypto ipsec transform-set cisco esp-des esp-md5-hmac crypto map text 10 ipsec-isakmp set peer 9.1.1.129 set transform-set cisco match address 100 interface Serial0/0 ip address 9.1.1.26 255.255.255.252 serial restart-delay 0 crypto map text ! interface Serial0/2 ip address 9.1.1.22 255.255.255.252 encapsulation frame-relay serial restart-delay 0 frame-relay map ip 9.1.1.21 312 broadcast crypto map text ip route 0.0.0.0 0.0.0.0 9.1.1.21 ip route 0.0.0.0 0.0.0.0 9.1.1.25 50 access-list 100 permit ip 10.1.0.0 0.0.0.255 10.0.64.0 0.0.0.255 测试 r1#ping 10.1.0.1 source 10.0.64.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.0.1, timeout is 2 seconds: Packet sent with a source address of 10.0.64.1 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 12/96/292 ms r1#show crypto isakmp sa dst src state conn-id slot status 9.1.1.22 9.1.1.129 QM_IDLE 1 0 ACTIVE r1#show crypto ipsec sa interface: Serial0/1 Crypto map tag: text, local addr 9.1.1.129 protected vr