RT1：
crypto isakmp policy 10 //设置ISAKMP策略
encr 3des //使用3DES加密
hash md5 //用MD5作为摘要算法
authentication pre-share //认证方式以预共享密钥
group 2 //定义DH算法为组2
crypto isakmp identity address //使用用IP地址作为身份标识
crypto isakmp key cisco1 address 172.1.2.2 //配置预共享密钥和对方IP
crypto isakmp key cisco2 address 172.1.3.2//配置预共享密钥和对方IP
crypto ipsec transform-set cisco esp-aes esp-md5-hmac //配置传输集参数，用来协商IPSEC SA的策略
!
crypto map RT1 10 ipsec-isakmp //配置加密图
set peer 172.1.2.2 //设置对等体
set transform-set cisco //调用传输集
match address 101 //匹配感兴趣流量
crypto map RT1 20 ipsec-isakmp
set peer 172.1.3.2
set transform-set cisco
match address 102
interface Ethernet0/0
ip address 172.1.1.2 255.255.255.240
crypto map RT1 //在接口上应用加密图
access-list 101 permit ip 192.168.20.0 0.0.0.255 192.168.36.0 0.0.0.255 //定义感兴趣流量
access-list 102 permit ip 192.168.20.0 0.0.0.255 192.168.40.0 0.0.0.255
//定义感兴趣流量
ip route 0.0.0.0 0.0.0.0 172.1.1.1 //两个加密点间必须要通
RT2：
crypto isakmp policy 10 //ISAKMP参数需跟对端一致
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp identity address
crypto isakmp key cisco1 address 172.1.1.2 //共享密钥需跟对端一致
crypto ipsec transform-set cisco esp-aes esp-md5-hmac //IPSEC参数跟对端一致
!
crypto map RT2 10 ipsec-isakmp
set peer 172.1.1.2
set transform-set cisco
match address 101
interface Ethernet0/0
ip address 172.1.2.2 255.255.255.240
crypto map RT2
access-list 101 permit ip 192.168.36.0 0.0.0.255 192.168.20.0 0.0.0.255
ip route 0.0.0.0 0.0.0.0 172.1.2.1 //两个加密点间必须要通
RT3：
crypto isakmp policy 10//ISAKMP参数需跟对端一致
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco2 address 172.1.1.2 //共享密钥需跟对端一致
crypto isakmp identity address
crypto ipsec transform-set cisco esp-aes esp-md5-hmac //IPSEC参数跟对端一致
!
crypto map RT3 10 ipsec-isakmp
set peer 172.1.1.2
set transform-set cisco
match address 101
interface Ethernet0/0
ip address 172.1.3.2 255.255.255.240
crypto map RT3
access-list 101 permit ip 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255
ip route 0.0.0.0 0.0.0.0 172.1.3.1 //两个加密点间必须要通
ISAKMP SA（双向，第一阶段协商完成建立）
RT3#show crypto isakmp sa
dst src state conn-id slot status
172.1.1.2 172.1.3.2 QM_IDLE 1 0 ACTIVE
IPSEC SA（两个单向，inbound和outbound，第二阶段完成建立）
RT3#show crypto ipsec sa
inbound esp sas:
spi: 0x88A9E91(143302289) //安全参数索引
transform: esp-aes esp-md5-hmac ,//IPSEC协商参数
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: RT3 //应用的加密图
sa timing: remaining key lifetime (k/sec): (4528168/1384)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE //SA为活跃状态
outbound esp sas:
spi: 0xB2979D58(2996280664) //安全参数索引
transform: esp-aes esp-md5-hmac ,//IPSEC协商参数
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: RT3 //应用的加密图
sa timing: remaining key lifetime (k/sec): (4528168/1374)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE //SA为活跃状态
debug 信息分析IKE过程：
*Mar 1 00:24:11.715: ISAKMP: received ke message (1/1)
*Mar 1 00:24:11.719: ISAKMP:(0:0:N/A:0): SA request profile is (NULL) 请求配置文件为空，因为没使用profile
*Mar 1 00:24:11.719: ISAKMP: Created a peer struct for 172.1.1.2, peer port 500创建一个对等体172.1.1.2,对端端口为500
*Mar 1 00:24:11.723: ISAKMP: New peer created peer = 0x64960A40 peer_handle = 0x80000002 创建新的对等体为0x64960A40，对等名柄为0x80000002
*Mar 1 00:24:11.727: ISAKMP: Locking peer struct 0x64960A40, IKE refcount 1 for isakmp_initiator 锁定对等体为0x64960A40，isakmp初始化为IKE计数１
*Mar 1 00:24:11.731: ISAKMP: local port 500, remote port 500本地端口为500,远端口为500
*Mar 1 00:24:11.731: ISAKMP: set new node 0 to QM_IDLE 为QM_IDLE 设置新的节点0
*Mar 1 00:24:11.735: insert sa successfully sa = 646EC2A4 成功插入安全关联
*Mar 1 00:24:11.739: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode. 不能开始积极模式，尝试主模式
*Mar 1 00:24:11.743: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 172.1.1.2找到对方的共享密钥匹配172.1.1.2
*Mar 1 00:24:11.747: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-07 ID
*Mar 1 00:24:11.747: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-03 ID
*Mar 1 00:24:11.747: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-02 ID
*Mar 1 00:24:11.747: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Mar 1 00:24:11.751: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1 老的状态IKE_READY，新的状态IEK_I_MM1
*Mar 1 00:24:11.755: ISAKMP:(0:0:N/A:0):
beginning Main Mode exchange开始主模式交换
*Mar 1 00:24:11.759: ISAKMP:(0:0:N/A:0): sending packet to 172.1.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE开始发第一个包，进入第阶段一的MM_NO_STATE状态
*Mar 1 00:24:21.763: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...重传阶段1 MM_NO_STATE ..
*Mar 1 00:24:21.763: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1递增错误SA，尝试1 5错误计数器：重发阶段1
*Mar 1 00:24:21.763: ISAKMP:(0:0:N/A:0): sending packet to 172.1.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 1 00:24:31.763: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
*Mar 1 00:24:31.767: ISAKMP (0:0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
*Mar 1 00:24:31.771: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
*Mar 1 00:24:31.775: ISAKMP:(0:0:N/A:0): sending packet to 172.1.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE 重发第一个包，进入第阶段一的MM_NO_STATE状态
*Mar 1 00:24:31.915: ISAKMP (0:0): received packet from 172.1.1.2 dport 500 sport 500 Global (I) MM_NO_STATE收到对方的应答（第二个包）
*Mar 1 00:24:31.935: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH开始IKE主模式交换
*Mar 1 00:24:31.935: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_I_MM2 老的状态为IKE_I_MM1，进入新状态IKE_I_MM2
*Mar 1 00:24:31.947: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0
处理SA负载，消息ID为0
*Mar 1 00:24:31.951: ISAKMP:(0:0:N/A:0): processing vendor id payload处理ID负载
*Mar 1 00:24:31.955: ISAKMP:(0:0:N/A:0): vendor ID seems Unity/DPD but major 245 mismatch
*Mar 1 00:24:31.955: ISAKMP (0:0): vendor ID is NAT-T v7
*Mar 1 00:24:31.955: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 172.1.1.2找到对等体的预共享密钥匹配172.1.1.2
*Mar 1 00:24:31.955: ISAKMP:(0:0:N/A:0): local preshared key found本地预共享密钥找到
*Mar 1 00:24:31.955: ISAKMP : Scanning profiles for xauth ...查看配置文件的扩展认证
*Mar 1 00:24:31.955: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 10 policy 核对ISAKMP的策略信息
*Mar 1 00:24:31.955: ISAKMP: encryption 3DES-CBC 加密算法3DES块加密
*Mar 1 00:24:31.955: ISAKMP: hash MD5 摘要算法为MD5
*Mar 1 00:24:31.955: ISAKMP: default group 2 DH为组2
*Mar 1 00:24:31.955: ISAKMP: auth pre-share 认证为预共享认证
*Mar 1 00:24:31.955: ISAKMP: life type in seconds
*Mar 1 00:24:31.955: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
*Mar 1 00:24:31.955: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0属性被接受，下一个负载为0
*Mar 1 00:24:31.999: ISAKMP:(0:1:SW:1): processing vendor id payload
*Mar 1 00:24:31.999: ISAKMP:(0:1:SW:1): vendor ID seems Unity/DPD but major 245 mismatch
*Mar 1 00:24:31.999: ISAKMP (0:134217729): vendor ID is NAT-T v7
*Mar 1 00:24:31.999: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE IKE进程运行主模式
*Mar 1 00:24:31.999: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM2 主模式下发送SA建立报文，端口号为500
*Mar 1 00:24:32.007: ISAKMP:(0:1:SW:1): sending packet to 172.1.1.2 my_port 500 peer_port 500 (I) MM_SA_SETUP 发第三个包，进入阶段1第二状态MM_SA_SETUP
*Mar 1 00:24:32.011: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETEI KE进程完成
*Mar 1 00:24:32.015: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2 New State = IKE_I_MM3 进入新状态IKE_I_MM3
*Mar 1 00:24:32.139: ISAKMP (0:134217729): received packet from 172.1.1.2 dport 500 sport 500 Global (I) MM_SA_SETUP
收到第四个包
*Mar 1 00:24:32.139: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH进入阶段1的第三个状态（发生DH交换）
*Mar 1 00:24:32.143: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM3 New State = IKE_I_MM4 进入新状态IKE_I_MM4
*Mar 1 00:24:32.151: ISAKMP:(0:1:SW:1): processing KE payload. message ID = 0
处理KE负载
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = 0处理随机数负载
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1):found peer pre-shared key matching 172.1.1.2找到预共享密钥匹配172.1.1.2
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1):SKEYID state generated
生成SKEYID
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1): processing vendor id payload
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1): vendor ID is Unity
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1): processing vendor id payload
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1): vendor ID is DPD
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1): processing vendor id payload
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1): speaking to another IOS box!
*Mar 1 00:24:32.203: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE IKE进程运行主模式
*Mar 1 00:24:32.207: ISAKMP:(0:1:SW:1): sending packet to 172.1.1.2 my_port 500 peer_port 500 (I) MM_KEY_EXCH
发第四个包进入第三个状态MM_KEY_EXCH 发生DH交换
*Mar 1 00:24:32.211: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Mar 1 00:24:32.215: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4 New State = IKE_I_MM5 进入新状态IKE_I_MM5
*Mar 1 00:24:32.331: ISAKMP (0:134217729): received packet from 172.1.1.2 dport 500 sport 500 Global (I) MM_KEY_EXCH
*Mar 1 00:24:32.343: ISAKMP:(0:1:SW:1): processing ID payload. message ID = 0
*Mar 1 00:24:32.343: ISAKMP (0:134217729): ID payload
next-payload : 8 下一个负载
type : 1 类型为1
address : 172.1.1.2 地址为172.1.1.2
protocol : 17 协议号为17，表示UDP协议
port : 500 端口号为500
length : 12 长度为12
*Mar 1 00:24:32.351: ISAKMP:(0:1:SW:1):: peer matches *none* of the profiles
*Mar 1 00:24:32.355: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = 0
处理hash负载，消息ID为0
*Mar 1 00:24:32.359: ISAKMP:(0:1:SW:1):SA authentication status:
authenticated SA认证阶段，被认证
*Mar 1 00:24:32.363: ISAKMP:(0:1:SW:1):SA has been authenticated with 172.1.1.2
SA被172.1.1.2认证
*Mar 1 00:24:32.367: ISAKMP: Trying to insert a peer 172.1.3.2/172.1.1.2/500/, and inserted successfully 64960A40.
*Mar 1 00:24:32.371: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Mar 1 00:24:32.375: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM5 New State = IKE_I_MM6
*Mar 1 00:24:32.375: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Mar 1 00:24:32.375: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM6 New State = IKE_I_MM6
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1):beginning Quick Mode exchange, M-ID of -456080992
第一阶段协议完成，进入阶段2快速模式
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1): sending packet to 172.1.1.2 my_port 500 peer_port 500 (I) QM_IDLE
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1):Node -456080992, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1):Old State = IKE_QM_READY New State = IKE_QM_I_QM1
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Mar 1 00:24:32.379: ISAKMP:(0:1:SW:1):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Mar 1 00:24:32.531: ISAKMP (0:134217729): received packet from 172.1.1.2 dport 500 sport 500 Global (I) QM_IDLE
*Mar 1 00:24:32.531: ISAKMP:(0:1:SW:1): processing HASH payload. message ID = -456080992 处理HASH负载
*Mar 1 00:24:32.531: ISAKMP:(0:1:SW:1): processing SA payload. message ID = -456080992 处理SA负载
*Mar 1 00:24:32.531: ISAKMP:(0:1:SW:1):Checking IPSec proposal 1 检查IPSEC提交位为1
*Mar 1 00:24:32.531: ISAKMP: transform 1, ESP_3DES ESP封装，3DES加密
*Mar 1 00:24:32.531: ISAKMP: attributes in transform:
*Mar 1 00:24:32.531: ISAKMP: encaps is 1 (Tunnel)隧道模式，封装ESP
*Mar 1 00:24:32.531: ISAKMP: SA life type in seconds
*Mar 1 00:24:32.531: ISAKMP: SA life duration (basic) of 3600
*Mar 1 00:24:32.531: ISAKMP: SA life type in kilobytes
*Mar 1 00:24:32.531: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
*Mar 1 00:24:32.531: ISAKMP: authenticator is HMAC-MD5 hash算法为MD5
*Mar 1 00:24:32.531: ISAKMP:(0:1:SW:1):atts are acceptable. 属性被接受
*Mar 1 00:24:32.535: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = -456080992
*Mar 1 00:24:32.539: ISAKMP:(0:1:SW:1): processing ID payload. message ID = -456080992
*Mar 1 00:24:32.543: ISAKMP:(0:1:SW:1): processing ID payload. message ID = -456080992
*Mar 1 00:24:32.555: ISAKMP: Locking peer struct 0x64960A40, IPSEC refcount 1 for for stuff_ke
*Mar 1 00:24:32.555: ISAKMP:(0:1:SW:1): Creating IPSec SAs 创建ipsec SA集
*Mar 1 00:24:32.555: inbound SA from 172.1.1.2 to 172.1.3.2 (f/i) 0/ 0
(proxy 192.168.20.0 to 192.168.40.0)inbound方向本地为172.1.3.2，远端为172.1.1.2,远端保护流量为192.168.20.0到192.168.40.0
Mar 1 00:24:32.555: has spi 0x935D598C and conn_id 0 and flags 2
安全参数索引
*Mar 1 00:24:32.555: lifetime of 3600 seconds IPSEC密钥生存时间
*Mar 1 00:24:32.555: lifetime of 4608000 kilobytes
*Mar 1 00:24:32.555: has client flags 0x0
*Mar 1 00:24:32.555: outbound SA from 172.1.3.2 to 172.1.1.2 (f/i) 0/0
(proxy 192.168.40.0 to 192.168.20.0)出方向的IPSEC SA，从172.1.3.2到172.1.1.2,保护流量为192.168.40.0到192.168.20.0
*Mar 1 00:24:32.555: has spi -1624356453 and conn_id 0 and flags A
安全参数索引
*Mar 1 00:24:32.555: lifetime of 3600 seconds
*Mar 1 00:24:32.555: lifetime of 4608000 kilobytes
*Mar 1 00:24:32.555: has client flags 0x0
*Mar 1 00:24:32.555: ISAKMP:(0:1:SW:1): sending packet to 172.1.1.2 my_port 500 peer_port 500 (I) QM_IDLE
*Mar 1 00:24:32.559: ISAKMP:(0:1:SW:1):deleting node -456080992 error FALSE reason "No Error"
*Mar 1 00:24:32.563: ISAKMP:(0:1:SW:1):Node -456080992, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Mar 1 00:24:32.567: ISAKMP:(0:1:SW:1):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE IKE阶段二，快速模式完成