实验拓扑图：
1.IP地址配置

2.在R1、R3、R4上配置到ISP的默认路由（即到R2）
R1:    ip route 0.0.0.0 0.0.0.0 172.16.12.2
R2:    ip route 0.0.0.0 0.0.0.0 172.16.23.2
R3:    ip route 0.0.0.0 0.0.0.0 172.16.24.2
3.在R1、R3、R4上配置tunnel口和NHRP
  R1:
int tunnel 0
ip add 192.168.1.1 255.255.255.0
tunnel source f0/0
tunnel mode gre multipoint 
tunnel key 99

ip nhrp authentication cisco123
ip nhrp network-id 999
ip nhrp map multicast dynamic
  R3:
int tunnel 0
ip add 192.168.1.3 255.255.255.0
tunnel source f0/0
tunnel mode gre multipoint 
tunnel key 99

ip nhrp authentication cisco123
ip nhrp network-id 999
ip nhrp nhs 192.168.1.1
ip nhrp map multicast 172.16.12.1
ip nhrp map 192.168.1.1 172.16.12.1 
  R4：
int tunnel 0
ip add 192.168.1.4 255.255.255.0
tunnel source f2/0
tunnel mode gre multipoint 
tunnel key 99

ip nhrp authentication cisco123
ip nhrp network-id 999
ip nhrp nhs 192.168.1.1
ip nhrp map multicast 172.16.12.1
ip nhrp map 192.168.1.1 172.16.12.1 
4.在R1、R3、R4配置EIGRP
  R1：
router eigrp 10
no auto-summary
network 10.10.1.1 0.0.0.0
network 192.168.1.1 0.0.0.0
  R3：
router eigrp 10
no auto-summary
network 10.10.3.3 0.0.0.0
network 192.168.1.3 0.0.0.0
  R4：
router eigrp 10
no auto-summary
network 10.10.4.4 0.0.0.0
network 192.168.1.4 0.0.0.0
5.在R1上关闭水平分割，并把R3、R4之间的路由的下一跳指向正确的地址
no ip next-hop-self eigrp 10   *10为EIGRP进程号
no ip split-horizon eigrp 10   *关闭水平分割

   查看R1、R3、R4的OSPF邻居表



6.在R1、R3、R4上配置IPSec ×××
  R1:
crypto isakmp policy 10
encryption 3des
hash sha
authentication pre-share
group 2
crypto isakmp key ccna-ccnp add 0.0.0.0
exit
crypto ipsec transform-set ccie esp-3des esp-sha-hmac

crypto ipsec profile dm***
set transform-set ccie

int tunnel 0
tunnel protecion ipsec profile dm***
  R3:
crypto isakmp policy 10
encryption 3des
hash sha
authentication pre-share
group 2
crypto isakmp key ccna-ccnp add 0.0.0.0
exit
crypto ipsec transform-set ccie esp-3des esp-sha-hmac

crypto ipsec profile dm***
set transform-set ccie

int tunnel 0
tunnel protecion ipsec profile dm***
  R4:
crypto isakmp policy 10
encryption 3des
hash sha
authentication pre-share
group 2
crypto isakmp key ccna-ccnp add 0.0.0.0
exit
crypto ipsec transform-set ccie esp-3des esp-sha-hmac

crypto ipsec profile dm***
set transform-set ccie

int tunnel 0
tunnel protecion ipsec profile dm***

    注意：R1、R3、R4上都要配置IPSec ××× ！原因如下：
    如果只在R3、R4上配置IPSec，而R1上不配置IPSec。  R1、R3、R4 的EIGRP邻接关系会很快断开，这是因为，DM×××会加密所有通过tunnel口的数据包，包括EIGRP数据包，在R3和R4上发出的EIGRP hello包都已加密，而R1上没有配置IPSec，和R3、R4之间无法传递hello包。

7.show crypto isakmp sa
  R1:
  R3:
  R4: