×××通道的建立

要把internet上的两个局域网通过加密的通道连接起来

左边代表一个局域网，中间代表着Internet，右边是另一个局域网。

 

 

我们要在两个路由器上配置来建立×××通道

一、先在左边的路由器R1上配置

1、配置信息
r1>en
r1#conf t
r1(config)#crypto isakmp enable
r1(config)#crypto isakmp policy 1
r1(config-isakmp)#hash sha
r1(config-isakmp)#authentication pre-share
r1(config)#crypto isakmp key 6 ming address 200.200.2.2
r1(config)#crypto ipsec transform-set xinzhan ah-sha-hmac esp-3des
r1(cfg-crypto-trans)#exit
r1(config)#access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
r1(config)#crypto ipsec transform-set xinzhan ah-sha-hmac esp-3des
r1(cfg-crypto-trans)#access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
r1(config)#crypto map xian 2 ipsec-isakmp
r1(config-crypto-map)#set peer 200.200.2.2
r1(config-crypto-map)#set transform-set xinzhan
r1(config-crypto-map)#match address 110
r1(config-crypto-map)#int f0/0
r1(config-if)#crypto map xian
r1(config-if)#exit

2、查看配置信息
r3#show crypto map
Crypto Map "xian" 2 ipsec-isakmp
        Peer = 200.200.2.2
        Extended IP access list 110
            access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
        Current peer: 200.200.2.2
        Security association lifetime: 100 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                xinzhan,
        }
        Interfaces using crypto map xian:
                Ethernet0/0

二、再在右边的路由器R3上配置

1、配置R3
r3>en
r3#conf t
r3(config)#crypto isakmp enable
r3(config)#crypto isakmp policy 2
r3(config-isakmp)#hash sha
r3(config-isakmp)#authentication pre-share
r3(config)#crypto isakmp key 6 ming address 100.100.1.1
r3(config)#crypto ipsec transform-set xinzhan ah-sha-hmac esp-3des
r3(cfg-crypto-trans)#exit
r3(config)#access-list 111 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
r3(config)#crypto ipsec transform-set xinzhan ah-sha-hmac esp-3des
r3(cfg-crypto-trans)#access-list 111 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
r3(config)#crypto map xian 2 ipsec-isakmp
r3(config-crypto-map)#set peer 100.100.1.1
r3(config-crypto-map)#set transform-set xinzhan
r3(config-crypto-map)#match address 111
r3(config-crypto-map)#int f0/1
r3(config-if)#crypto map xian
r3(config-if)#exit

2、查看配置信息
r3#show crypto map
Crypto Map "xian" 2 ipsec-isakmp
        Peer = 100.100.1.1
        Extended IP access list 111
            access-list 111 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
        Current peer: 100.100.1.1
        Security association lifetime: 100 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                xinzhan,
        }
        Interfaces using crypto map xian:
                Ethernet0/1

3、在中间的路由器上模拟internet

r1>en
r1#conf t

r1(config)#host internet

r1(config)#no ip domain-lookup

r1(config)#int f0/0

r1(config-if)#ip add 100.100.2.2 255.255.0.0

r1(config-if)#no shutdown

r1(config-if)#int f0/1

r1(config-if)#ip add 200.200.1.1 255.255.0.0

r1(config-if)#no shutdown

r1(config-if)#exit

4、配置完测试能否ping通
VPCS 2 >ping 192.168.1.2
192.168.1.2 icmp_seq=1 time=96.000 ms
192.168.1.2 icmp_seq=2 time=58.000 ms
192.168.1.2 icmp_seq=3 time=19.000 ms
192.168.1.2 icmp_seq=4 time=19.000 ms
192.168.1.2 icmp_seq=5 time=79.000 ms

VPCS 1 >ping 192.168.2.2
192.168.2.2 icmp_seq=1 time=96.000 ms
192.168.2.2 icmp_seq=2 time=58.000 ms
192.168.2.2 icmp_seq=3 time=19.000 ms
192.168.2.2 icmp_seq=4 time=19.000 ms
192.168.2.2 icmp_seq=5 time=79.000 ms