IPSec VPN

做IPSec VPN的实验，总部的主机可以PING通分部的主机，而分部的主机PING不通总部的主机，但是可以PING通总部主机的网关。  
, a! b0 O2 S% ?6 Y

求拓扑和配置~~~

男友力max 发表于 2016-1-11 00:22
% O" Z% M2 H8 t  P' q求拓扑和配置~~~

: I( j5 q7 \$ ^4 d" d2 {/ A& |做的是IPSec VPN链路备份
1 X- ]' c' Y) g. ?4 C( t( W& V总部主：
: a, \7 I+ p6 W: r; icrypto isakmp policy 1
authentication pre-share
3 I' P7 g' g' `9 ocrypto isakmp key cisco address 6.1.1.1        
crypto isakmp keepalive 10 periodic
8 S1 f! q* l/ _# N4 e/ [, i& vcrypto ipsec transform-set cisco esp-des esp-md5-hmac
mode tunnel
! f, ]: g9 Q# [6 o2 V; l- Ccrypto map cisco 1 ipsec-isakmp
/ R& ~: |( Y7 \1 G' B) y set peer 6.1.1.1
set transform-set cisco
set reverse-route tag 1
match address vpn
reverse-route
crypto map cisco
备份：
crypto isakmp policy 1
( z& i( P- q% J7 c# N4 d; T; M authentication pre-share
crypto isakmp key cisco address 6.1.1.1        
crypto isakmp keepalive 10 periodic
3 y/ o' j, A  hcrypto ipsec transform-set cisco esp-des esp-md5-hmac
mode tunnel
+ T+ l! h/ `* s, {% x- x# G7 zcrypto map cisco 1 ipsec-isakmp
5 ]" t- ^# L, p1 } set peer 6.1.1.1
set transform-set cisco
set reverse-route tag 1
9 |: b' l+ [  J4 s/ K/ Q match address vpn
reverse-route
2 u* x, Y8 U4 l2 W6 e6 z) s crypto map cisco
分部：
crypto isakmp policy 1
authentication pre-share
% U; \6 p, Z  H8 e. t% Vcrypto isakmp key cisco address 4.1.1.1        
% R; o- [( D* j% j: r5 {crypto isakmp key cisco address 5.1.1.1        
  ^0 l0 v% C  z2 h1 W+ ]crypto isakmp keepalive 10 periodic
' k9 R1 ]4 c* o4 g6 Qcrypto ipsec transform-set cisco esp-des esp-md5-hmac
, P( r( ?$ H" z; G" J  F mode tunnel
crypto map cisco 1 ipsec-isakmp
% R7 I7 R2 U$ P  e, ]0 U; C0 |/ k set peer 4.1.1.1
set peer 5.1.1.1
; {  ~: b, Y& ]4 y; l2 K set transform-set cisco
match address vpn
+ ?6 X3 U: C+ @( J5 Y crypto map cisco