在PAT中实现sitetositeipsecvpn

650) this.width=650;" border="0" alt="" src="http://cdn.verydemo.com/upload/2013_06_01/13700629506750.jpg" /> 建立如上图所示拓扑图，下面是相关的操作 hostname r1 ! ! ! ! ! ! ! ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-s

建立如上图所示拓扑图，下面是相关的操作

hostname r1
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
!
crypto isakmp key cisco address 10.1.1.2
!
!
crypto ipsec transform-set mytrans esp-3des
!
crypto map mymap 1 ipsec-isakmp
set peer 10.1.1.2
set transform-set mytrans
match address 111
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.0
ip nat outside
duplex auto
speed auto
crypto map mymap
!
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
router rip
network 10.0.0.0
network 192.168.1.0
!
ip nat pool mynat 10.1.1.1 10.1.1.1 netmask 255.255.255.255
ip nat inside source list 112 pool mynat overload
ip classless
ip route 192.168.2.0 255.255.255.0 10.1.1.2
!
!
access-list 111 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 112 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 112 permit ip 192.168.1.0 0.0.0.255 any

由于在此路由器中配置了NAT转换，故 在此要进行隧道分离，不然无法正常进行vpn连接，在NAT转换中拒绝crypto map 中match address 匹配的数据流。
hostname r2
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
!
crypto isakmp key cisco address 10.1.1.1
!
!
crypto ipsec transform-set mytrans esp-3des
!
crypto map mymap 1 ipsec-isakmp
set peer 10.1.1.1
set transform-set mytrans
match address 111
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.2 255.255.255.0
ip nat outside
duplex auto
speed auto
crypto map mymap
!
interface FastEthernet0/1
ip address 192.168.2.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
router rip
network 10.0.0.0
network 192.168.2.0
!
ip classless
ip route 192.168.1.0 255.255.255.0 10.1.1.1
!
!
access-list 111 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 112 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 112 permit ip 192.168.2.0 0.0.0.255 any

由于在此路由器中配置了NAT转换，故 在此要进行隧道分离，不然无法正常进行vpn连接，在NAT转换中拒绝crypto map 中match address 匹配的数据流。
交流探讨MSN：tianyahaijiao8888@hotmail.com

天涯