IPSec VPN

做IPSec VPN的实验，总部的主机可以PING通分部的主机，而分部的主机PING不通总部的主机，但是可以PING通总部主机的网关。  
* x7 ?% u# g. B" @  i

求拓扑和配置~~~

男友力max 发表于 2016-1-11 00:22
3 w/ _. r4 F% m3 @. Z/ }' }求拓扑和配置~~~

. C" X/ i& F5 a8 o做的是IPSec VPN链路备份
* m; I; `$ y' X+ S' n  G% ?) Q总部主：
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 6.1.1.1        
  v5 K9 d1 w( |4 ocrypto isakmp keepalive 10 periodic
7 u6 H3 l3 O3 f7 a# M6 K% ]% rcrypto ipsec transform-set cisco esp-des esp-md5-hmac
5 I- }3 X1 Q; U0 |4 \! \ mode tunnel
crypto map cisco 1 ipsec-isakmp
; `$ U/ Z3 d4 ?' G/ Q( M set peer 6.1.1.1
set transform-set cisco
set reverse-route tag 1
2 M$ G' l2 [! h" `# t match address vpn
reverse-route
' k3 |( W, ^2 P, u) p. h crypto map cisco
备份：
crypto isakmp policy 1
( w+ W. g! Y, S. \+ x# [ authentication pre-share
crypto isakmp key cisco address 6.1.1.1        
4 U% \: O0 V! Q( ~crypto isakmp keepalive 10 periodic
2 d0 E0 a, `9 \! O+ l+ Pcrypto ipsec transform-set cisco esp-des esp-md5-hmac
( i* ], ]! q7 t6 \4 H7 ? mode tunnel
crypto map cisco 1 ipsec-isakmp
* O% o$ E& m2 X$ l  q8 d set peer 6.1.1.1
set transform-set cisco
set reverse-route tag 1
; w) E  |- i1 C match address vpn
! K) h) B! f2 [% ]" j+ B; Z reverse-route
! R1 _" r% l, C7 S1 j- c crypto map cisco
: ~6 o% z  `9 Z! u* S3 n分部：
8 Z/ B  g9 r6 G( r6 V7 z2 ~# Qcrypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 4.1.1.1        
crypto isakmp key cisco address 5.1.1.1        
crypto isakmp keepalive 10 periodic
crypto ipsec transform-set cisco esp-des esp-md5-hmac
mode tunnel
2 U% b7 s/ A/ [3 s( o( O3 Z; Lcrypto map cisco 1 ipsec-isakmp
set peer 4.1.1.1
6 c, _" L* w) r" }6 H set peer 5.1.1.1
( C. \) q  V7 i! `, } set transform-set cisco
! B* C( Q9 O, m0 l0 \3 J* P: B match address vpn
crypto map cisco