ISAKMP Profile使用在总部与多个站点进行IPSEC ×××通信，且总部与不同分支使用不同的第一阶段策略时使用。
以下为拓扑：
直发R2，R4，R5的配置：
R1：
!
!
!
!
!
!
crypto keyring keyring //创建于对端R4使用的KEY
pre-shared-key address 34.1.1.4 key cisco
crypto keyring r5keyring
pre-shared-key address 35.1.1.5 key cisco
!
crypto isakmp policy 10 //Policy10用于与R4的第一阶段策略
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 20 //Policy20用于与R5的第一阶段策略
authentication pre-share
crypto isakmp profile r4profile //创建于R4建立IKE的profile
keyring keyring //关联keyring
match identity address 34.1.1.4 255.255.255.255 //match identity 指出对端
crypto isakmp profile r5profile
keyring r5keyring
match identity address 35.1.1.5 255.255.255.255
!
!
crypto ipsec transform-set set esp-des esp-md5-hmac
!
!
crypto map mapr1 10 ipsec-isakmp //因为接口上只能调用一个MAP，所以只能创建一个MAP然后用不同的序号将不同的profile和地址关联
set peer 34.1.1.4
set transform-set set
set isakmp-profile r4profile
match address r4list
crypto map mapr1 20 ipsec-isakmp
set peer 35.1.1.5
set transform-set set
set isakmp-profile r5profile
match address r5list
!
!
interface Ethernet0/0
ip address 192.168.1.2 255.255.255.0
half-duplex
!
interface Ethernet0/1 //在接口调用MAP
ip address 23.1.1.2 255.255.255.0
half-duplex
crypto map mapr1
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 Ethernet0/1
!
ip access-list extended r4list
permit ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255
ip access-list extended r5list
permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255
!
!
control-plane
!
R4：
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 23.1.1.2
!
!
crypto ipsec transform-set set esp-des esp-md5-hmac
!
crypto map map 10 ipsec-isakmp
set peer 23.1.1.2
set transform-set set
match address r4
!
!
!
!
interface Ethernet0/0
ip address 34.1.1.4 255.255.255.0
half-duplex
crypto map map
!
interface Ethernet0/1
ip address 192.168.4.1 255.255.255.0
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 Ethernet0/0
!
!
!
ip access-list extended r4
permit ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255
R5：
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 23.1.1.2
!
!
crypto ipsec transform-set set esp-des esp-md5-hmac
!
crypto map map 10 ipsec-isakmp
set peer 23.1.1.2
set transform-set set
match address list
!
!
!
!
interface Ethernet0/0
ip address 35.1.1.5 255.255.255.0
half-duplex
crypto map map
!
interface Ethernet0/1
ip address 192.168.5.1 255.255.255.0
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 Ethernet0/0
!
!
!
ip access-list extended list
permit ip 192.168.5.0 0.0.0.255 192.168.1.0 0.0.0.255
总结：在ISAKMP Profile中用
crypto isakmp profile r5profile
keyring r5keyring
match identity address 35.1.1.5 255.255.255.255
代替了 crypto isakmp key 0 cisco add 35.1.1.5命令