互联基本配置
!Internet:
int f0/0
ip add 100.1.1.1 255.255.255.0
no shut
exit
int f1/1
ip add 200.1.1.1 255.255.255.0
no shut
exit
int f1/0
ip add 210.1.1.1 255.255.255.0
no shut
exit
int f2/0
ip add 220.1.1.1 255.255.255.0
no shut
exit
!Beijing-Center:
int f0/0
ip add 100.1.1.2 255.255.255.0
no shut
exit
int f1/0
ip add 1.1.1.1 255.255.255.0
no shut
exit
!Shanghai分部：
int f0/0
ip add 210.1.1.2 255.255.255.0
no shut
exit
int f1/0
ip add 2.2.2.2 255.255.255.0
no shut
exit
!PC2
ip 2.2.2.1/24 2.2.2.2
!ShenZhen分部：
int f0/0
ip add 220.1.1.2 255.255.255.0
no shut
exit
int f1/0
ip add 3.3.3.3 255.255.255.0
no shut
exit
PC3
ip 3.3.3.1/24 3.3.3.3
!VMware 虚拟机安装的XP系统，VPCS做客户端EZ×××拨入后无法ping通内网段，只能使用虚拟机。
NoteBook
ip 200.1.1.2/24 200.1.1.1
BeiJing-Center:
ip route 0.0.0.0 0.0.0.0 100.1.1.1
ShangHai:
ip route 0.0.0.0 0.0.0.0 210.1.1.1
ShenZhen:
ip route 0.0.0.0 0.0.0.0 220.1.1.1
!======BeiJing-center=============EZ×××部分===================================
username cisco password 0 cisco
aaa new-model
!
!
!--- Xauth is configured for local authentication.
aaa authentication login userauthen local
aaa authorization network naton local
!--- Create an ISAKMP policy for Phase 1 negotiations.
!--- This policy is for Easy ××× Clients.
crypto isakmp policy 20
hash md5
authentication pre-share
group 2
exit
!
!--- ××× Client configuration for group "naton"
!--- (this name is configured in the ××× Client).
crypto isakmp client configuration group naton
key naton
dns 1.1.11.10 1.1.11.11
wins 1.1.11.12 1.1.11.13
domain cisco.com
pool natonpool
exit
!--- Profile for ××× Client connections, matches the
!--- "hw-client-group" group and defines the XAuth properties.
crypto isakmp profile ×××client
match identity group naton
client authentication list userauthen
isakmp authorization list naton
client configuration address respond
exit
!--- Create the Phase 2 policy for actual data encryption.
crypto ipsec transform-set strong esp-3des esp-md5-hmac
mode transport
exit
!
!--- This dynamic crypto map references the ISAKMP
!--- Profile ××× Client above.
!--- Reverse route injection is used to provide the
!--- DM××× networks access to any Easy ××× Client networks.
crypto dynamic-map dynmap 10
set transform-set strong
set isakmp-profile ×××client
reverse-route
exit
!
!
!--- Crypto map only references the dynamic crypto map above.
crypto map dynmap 1 ipsec-isakmp dynamic dynmap
!
interface FastEthernet0/0
crypto map dynmap
exit
!
ip local pool natonpool 1.1.11.60 1.1.11.80
!=====BeiJing-center============DM×××部分=============================
!--- Keyring that defines the wildcard pre-shared key.
crypto keyring dm***spokes
pre-shared-key address 0.0.0.0 0.0.0.0 key naton123
exit
!
!--- Create an ISAKMP policy for Phase 1 negotiations.
!--- This policy is for DM××× spokes.
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
exit
!
!--- Profile for LAN-to-LAN connection, references
!--- the wildcard pre-shared key and a wildcard
!--- identity (this is what is broken in
!--- Cisco bug ID CSCea77140)
!--- and no XAuth.
crypto isakmp profile DM×××
keyring dm***spokes
match identity address 0.0.0.0
exit
!
!
crypto ipsec transform-set naton-dm esp-3des esp-sha-hmac
mode transport
exit
!--- Create an IPsec profile to be applied dynamically to the
!--- generic routing encapsulation (GRE) over IPsec tunnels.
crypto ipsec profile naton-dm-ips
set security-association lifetime seconds 120
set transform-set naton-dm
set isakmp-profile DM×××
exit
!
!
!--- Create a GRE tunnel template which is applied to
!--- all the dynamically created GRE tunnels.
router eigrp 10
network 1.1.1.0 0.0.0.255
network 10.0.0.0 0.0.0.255
no auto-summary
interface Tunnel0
ip address 10.0.0.1 255.255.255.0
no ip redirects
ip mtu 1440
ip nhrp authentication naton123
ip nhrp map multicast dynamic
ip nhrp network-id 1
ip nhrp holdtime 300
no ip split-horizon eigrp 10
no ip next-hop-self eigrp 10
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 0
tunnel protection ipsec profile naton-dm-ips
exit
!
=====ShangHai============DM×××部分=============================
!--- Create an ISAKMP policy for Phase 1 negotiations.
!--- This policy is for DM××× spokes.
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
exit
!
!
crypto isakmp key naton123 address 0.0.0.0 0.0.0.0
crypto ipsec transform-set naton-dm esp-3des esp-sha-hmac
mode transport
exit
!--- Create an IPsec profile to be applied dynamically to the
!--- generic routing encapsulation (GRE) over IPsec tunnels.
crypto ipsec profile naton-dm-ips
set security-association lifetime seconds 120
set transform-set naton-dm
exit
router eigrp 10
network 2.2.2.0 0.0.0.255
network 10.0.0.0 0.0.0.255
no auto-summary
interface Tunnel0
ip address 10.0.0.2 255.255.255.0
no ip redirects
ip mtu 1440
ip nhrp authentication naton123
ip nhrp map 10.0.0.1 100.1.1.2
ip nhrp map multicast 100.1.1.2
ip nhrp network-id 1
ip nhrp holdtime 300
ip nhrp nhs 10.0.0.1
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 0
tunnel protection ipsec profile naton-dm-ips
=====ShenZhen============DM×××部分=============================
!--- Create an ISAKMP policy for Phase 1 negotiations.
!--- This policy is for DM××× spokes.
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
exit
!
!
crypto isakmp key naton123 address 0.0.0.0 0.0.0.0
crypto ipsec transform-set naton-dm esp-3des esp-sha-hmac
mode transport
exit
!--- Create an IPsec profile to be applied dynamically to the
!--- generic routing encapsulation (GRE) over IPsec tunnels.
crypto ipsec profile naton-dm-ips
set security-association lifetime seconds 120
set transform-set naton-dm
exit
router eigrp 10
network 3.3.3.0 0.0.0.255
network 10.0.0.0 0.0.0.255
no auto-summary
interface Tunnel0
ip address 10.0.0.3 255.255.255.0
no ip redirects
ip mtu 1440
ip nhrp authentication naton123
ip nhrp map 10.0.0.1 100.1.1.2
ip nhrp map multicast 100.1.1.2
ip nhrp network-id 1
ip nhrp holdtime 300
ip nhrp nhs 10.0.0.1
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 0
tunnel protection ipsec profile naton-dm-ips
测试iPS：
Beijing-Cent：
#sh crypto ips sa
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 100.1.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (100.1.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (210.1.1.2/255.255.255.255/47/0)
current_peer 210.1.1.2 port 500
protected vrf: (none)
local ident (addr/mask/prot/port): (100.1.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (220.1.1.2/255.255.255.255/47/0)
current_peer 220.1.1.2 port 500
ShangHai:
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 210.1.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (210.1.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (100.1.1.2/255.255.255.255/47/0)
current_peer 100.1.1.2 port 500
Shenzhen:
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 220.1.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (220.1.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port
BeiJing-Center#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
100.1.1.2 220.1.1.2 QM_IDLE 1002 ACTIVE
100.1.1.2 210.1.1.2 QM_IDLE 1001 ACTIVE
ShangHai#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
100.1.1.2 210.1.1.2 QM_IDLE 1001 ACTIVE
ShenZhen#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
100.1.1.2 220.1.1.2 QM_IDLE 1001 ACTIVE
BeiJing-Center#sh crypto engine connections activ
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
139 IPsec 3DES+SHA 0 13 13 100.1.1.2
140 IPsec 3DES+SHA 13 0 0 100.1.1.2
141 IPsec 3DES+SHA 0 3 3 100.1.1.2
142 IPsec 3DES+SHA 2 0 0 100.1.1.2
1001 IKE MD5+3DES 0 0 0 100.1.1.2
1002 IKE MD5+3DES 0 0 0 100.1.1.2
BeiJing-Center##ping 2.2.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/98/232 ms
BeiJing-Center##ping 3.3.3.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/78/100 ms
NoteBook
进入虚拟机添加IP地址200.1.1.2 255.255.255.0 200.1.1.1，安装cisco ××× Client 配置如下（name：naton，password：naton）：
双击***，输入用户名cisco，密码cisco，显示拨入成功；
ping 总部服务器地址全通，Easy ×××配置成功。
本实验全部完成，请提出意见或建议，谢谢。