温馨提示×

温馨提示×

您好,登录后才能下订单哦!

密码登录×
登录注册×
其他方式登录
点击 登录注册 即表示同意《亿速云用户服务条款》

GNS3 配置Dynamic p2p GRE over IPsec

发布时间:2020-06-10 02:43:31 阅读:3289 作者:开源殿堂 栏目:网络安全
开发者测试专用服务器限时活动,0元免费领,库存有限,领完即止! 点击查看>>

1、实验拓扑

GNS3 配置Dynamic p2p GRE over IPsec

2、基础网络配置

R1配置:

ip dhcp excluded-address 13.1.1.1 13.1.1.2

ip dhcp pool net13

   network 13.1.1.0 255.255.255.0

   default-router 13.1.1.1 

interface FastEthernet0/0

 ip address 12.1.1.1 255.255.255.0

interface FastEthernet1/0

 ip address 13.1.1.1 255.255.255.0

R2配置:

interface FastEthernet0/0

 ip address 12.1.1.2 255.255.255.0

interface FastEthernet1/0

 ip address 172.16.1.254 255.255.255.0

ip route 0.0.0.0 0.0.0.0 12.1.1.1

R3配置:

interface Loopback0

 ip address 3.3.3.3 255.255.255.0

interface FastEthernet0/0

 ip address dhcp

interface FastEthernet1/0

 ip address 192.168.1.254 255.255.255.0

ip route 0.0.0.0 0.0.0.0 13.1.1.1

R4配置:

interface FastEthernet0/0

 ip address 172.16.1.1 255.255.255.0

ip route 0.0.0.0 0.0.0.0 172.16.1.254

R5配置:

interface FastEthernet0/0

 ip address 192.168.1.1 255.255.255.0

ip route 0.0.0.0 0.0.0.0 192.168.1.254

3、配置Dynamic p2p GRE over IPsec

3.1、配置GRE

R2配置:

interface Tunnel2

 ip address 1.1.1.1 255.255.255.0

 tunnel source 12.1.1.2

 tunnel destination 3.3.3.3

ip route 3.3.3.3 255.255.255.255 12.1.1.1

这条路由必须配置,这是配置规则要求的

R3配置:

interface Tunnel3

 ip address 1.1.1.2 255.255.255.0

 tunnel source Loopback0

 tunnel destination 12.1.1.2

3.2、R2配置Dynamic LAN-to-LAN ×××(相对普通的Dynamic LAN-to-LAN ×××多了一条指令)

crypto isakmp policy 1

 encr 3des

 authentication pre-share

 group 2

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0

crypto ipsec transform-set ccie esp-3des esp-sha-hmac 

crypto dynamic-map dymap 1

 set transform-set ccie 

crypto map mymap 1 ipsec-isakmp dynamic dymap (经测试,这条指令可以不写)

crypto map mymap local-address FastEthernet0/0

interface FastEthernet0/0

 crypto map mymap

3.3、R3配置LAN-to-LAN ×××(与普通LAN-to-LAN ×××的ACL不同,多了一条指令)

crypto isakmp policy 1

 encr 3des

 authentication pre-share

 group 2

crypto isakmp key cisco123 address 12.1.1.2

crypto ipsec transform-set ccie esp-3des esp-sha-hmac 

access-list 100 permit gre 3.3.3.0 0.0.0.255 12.1.1.0 0.0.0.255

crypto map mymap 1 ipsec-isakmp 

 set peer 12.1.1.2

 set transform-set ccie 

 match address 100

crypto map mymap local-address FastEthernet0/0(经测试,这条指令可以不写

interface FastEthernet0/0

 crypto map mymap

3.4、配置动态路由协议(此时私网流量走的都是隧道。)

R2配置:

router ospf 1

 network 1.1.1.0 0.0.0.255 area 0

 network 172.16.1.0 0.0.0.255 area 0

R3配置:

router ospf 1

 network 1.1.1.0 0.0.0.255 area 0

 network 192.168.1.0 0.0.0.255 area 0

4、NAT对Dynamic p2p GRE over IPsec的影响与NAT对Static p2p GRE over IPsec的影响一样

亿速云「云服务器」,即开即用、新一代英特尔至强铂金CPU、三副本存储NVMe SSD云盘,价格低至29元/月。点击查看>>

向AI问一下细节
推荐阅读:
  1. GNS3优化
  2. 简单介绍GNS3

免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。

AI

开发者交流群×