103实验指导(1对多 Site To Site VPN).doc

实验指导(1对多 Site To Site VPN) 实验任务 R1:RotuerA、 R2:Internet、 R3:RotuerB、 R4:RotuerC RouterB、RouterC采用VPN和总部连接 总部和不同分部之间的VPN采用不同的参数、密码 要保证三个site之间都可以互相通信 实验步骤 R1、R2、R3上如图配置IP地址，打开接口，配置路由： Switch（S1）: Switch(config)#int f0/0 Switch(config-if)#shutdown RouterA（R1）: int s1/1 no shutdown clock rate 128000 ip add 52 int loopback0 ip add ip route s1/1 Internet（R2）: int s1/0 no shutdown clock rate 128000 ip add 52 int s1/1 no shutdown clock rate 128000 ip add 52 int e0/0 no shutdown duplex full ip add 52 RouterB（R3）: int s1/0 no shutdown clock rate 128000 ip add 2 52 int loopback0 ip add ip route s1/0 RouterC（R4）: int e0/0 no shutdown duplex full ip add 52 int loopback0 ip add ip route RouterA:和RouterB之间联通的配置： ！ crypto isakmp policy 10 hash md5 authentication pre-share ！ crypto isakmp key 0 cisco1234 address ! crypto ipsec transform-set SITE2 esp-des esp-md5-hmac ! crypto map TEST-MAP 10 ipsec-isakmp set peer set transform-set SITE2 match address 110 ! interface Serial1/1 crypto map TEST-MAP ！ access-list 110 permit ip 55 55 ! RouterB：和RouterA之间联通的配置: ! crypto isakmp policy 10 hash md5 authentication pre-share ! crypto isakmp key 0 cisco1234 address ! crypto ipsec transform-set SITE1 esp-des esp-md5-hmac ! crypto map TEST-MAP 10 ipsec-isakmp set peer set transform-set SITE1 match address 110 ! interface Serial1/0 crypto map TEST-MAP ！ access-list 110 permit ip 55 55 ! RouterA:和RouterC之间联通的配置: ！ crypto isakmp policy 20 encry aes hash sha group 2 authentication pre-share ！ crypto isakmp key 0 123456 address ! crypto ipsec transform-set SITE3 esp-3des esp-sha ! crypto map TEST-MAP 20 ipsec-isakmp set peer set transform-set SITE3 match address 120 ! interface Serial1/1 crypto map TEST-MAP ！ access-list 120 permit ip 55 55 RouterC：和RouterA之间联通的配置: ！ crypto isakmp policy 10 encry aes hash sha group 2 authentication pre-share ！ crypto isakmp key 0 123456 address ! crypto