VPN问题
为什么我按照下面的配置打 VPN还是DOWN状态1.R1基本配置:
[*]R1(config)#interface loopback0
[*]R1(config-if)#ip address 10.1.1.1 255.255.255.0
[*]R1(config-if)#no shutdown
[*]R1(config-if)#interface serial0/0
[*]R1(config-if)#ip address192.168.1.1 255.255.255.252
[*]R1(config-if)#clock rate 56000
[*]R1(config-if)#no shutdown
[*]R1(config)#interface tunnel 0
[*]R1(config-if)#ip unnumbered serial0/0
[*]R1(config-if)#tunnel source serial0/0
[*]R1(config-if)#tunnel destination 192.168.1.1
[*]R1(config-if)#tunnel mode gre ip /---可以不打,默认即为GRE---/
[*]R1(config-if)#no shutdown
[*]R1(config-if)#exit
[*]
2.定义感兴趣流量与路由协议:
[*]R1(config)#access-list 100 permit gre host 192.168.1.1 host 192.168.1.2
[*]R1(config)#ip route 0.0.0.0 0.0.0.0 serial0/0
[*]R1(config)#ip route 10.2.2.0 255.255.255.0 serial0/0
[*]
3.全局启用ISAKMP并定义对等体及其PSK(预共享密钥):
[*]R1(config)#crypto isakmp enable
[*]R1(config)#crypto isakmp key 91lab address 192.168.1.2
[*]
4.定义IKE策略:
[*]R1(config)#crypto isakmp policy 10
[*]R1(config-isakmp)#encryption aes 128 /---默认是DES加密---/
[*]R1(config-isakmp)#hash sha /---默认是SHA-1---/
[*]R1(config-isakmp)#authentication pre-share
[*]R1(config-isakmp)#group 2 /---默认是768位的DH1---/
[*]R1(config-isakmp)#lifetime 3600 /---默认是86400秒---/
[*]R1(config-isakmp)#exit
[*]
5.定义IPSec转换集(transform set):
[*]R1(config)#crypto ipsec transform-set tt esp-aes 128 esp-sha-hmac
[*]R1(cfg-crypto-trans)#mode tunnel
[*]R1(cfg-crypto-trans)#exit
[*]
6.定义crypto map并应用在接口上:
[*]R1(config)#crypto map cisco 10 ipsec-isakmp
[*]R1(config-crypto-map)#match address 100
[*]R1(config-crypto-map)#set peer 192.168.1.2 /---定义要应用crypto map的对等体地址---/
[*]R1(config-crypto-map)#set transform-set tt /---定义crypto map要应用的IPsec转换集---/
[*]R1(config-crypto-map)#exit
[*]R1(config)#interface serial0/0
[*]R1(config-if)#crypto map cisco
[*]
[*]
[*]*Mar1 00:08:31.131: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
[*]
[*]R1(config-if)#end
[*]R1#
拓扑和对端的配置呢
页:
[1]