实验目的：
R1为总公司的HUB端提供×××接入，R6模拟internet，R2和R3模拟分公司SPOKE端，R2为静态IP，R3为动态IP。运行eigrp学习内网路由，R2访问R3不经过总公司R1，而通过R2和R3之间建立的SPOKE TO SPOKE信道来通信。
最终结果如下:
分公司R3经过一跳（分公司R2的tunnel地址）直接到达分公司R2内网。
r3#traceroute 2.2.2.2 source 3.3.3.3
Type escape sequence to abort.
Tracing the route to 2.2.2.2
1 123.123.123.2 16 msec * 36 msec
实验拓扑图：
|
|
实验配置：
R6只需要配置端口ip地址，但必须配置一条指向总公司R1的静态路由
R1总公司配置：
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key meng address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
mode transport //此处模式也可以是tunnel，默认就是是tunnel模式。
!
crypto ipsec profile gezi //定义ipsec profile
set transform-set myset
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface Tunnel0
ip address 123.123.123.1 255.255.255.0
no ip redirects
ip mtu 1400 //设置分片
//配置吓一跳属性，否则SPOKE TO SPOKE之间的通信必须经过HUB，加大了HUB的负载。
no ip next-hop-self eigrp 1
ip nhrp authentication meng //nhrp认证，不配置也行
ip nhrp map multicast dynamic //映射为动态
ip nhrp network-id 10 //HUB和SPOKE network-id必须一致
ip nhrp cache non-authoritative
no ip split-horizon eigrp 1 //关闭eigrp水平分割，否则R2和R3之间相互学习不到路由
tunnel source 16.16.16.1 //因为是DM×××，所以只需指定source，不需指定destination
tunnel mode gre multipoint //必须指定模式为GER
tunnel key 123456 //通道认证key
tunnel protection ipsec profile gezi 调用ipsec profile
!
interface Serial1/1
ip address 16.16.16.1 255.255.255.0
serial restart-delay 0
clock rate 64000
!
//宣告内网和tunnel接口地址，千万不能宣告外网接口地址！并且最好精确宣告！否则会造成邻居不稳定，疯狂发包！
router eigrp 1
network 1.1.1.0 0.0.0.255
network 123.123.123.0 0.0.0.255
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 16.16.16.6
R2配置：
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key meng address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
mode transport
!
crypto ipsec profile gezi
set transform-set myset
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface Tunnel0
ip address 123.123.123.2 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication meng
ip nhrp map 123.123.123.1 16.16.16.1 //将nhrp的server的 tunnel地址与外网地址映射
ip nhrp map multicast 16.16.16.1 //配置将路由协议用到的组播包转发给server16.16.16.1
ip nhrp network-id 10
ip nhrp nhs 123.123.123.1 //指定nh server地址（总公司R1 tunnel的地址）
ip nhrp cache non-authoritative
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 123456
tunnel protection ipsec profile gezi
!
interface FastEthernet0/0
ip address 26.26.26.2 255.255.255.0
duplex auto
speed auto
!
router eigrp 1
network 2.2.2.0 0.0.0.255
network 123.123.123.0 0.0.0.255
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 26.26.26.6
!
R3配置和R2基本完全相同 差别只在接口地址和tunnel地址的不同