isakmp_profile
主要是用在remote和site to site同时实施的情况,可以实现remote和site to site使用不同的密码.
R1
crypto isakmp policy 10
authentication pre-share
crypto keyring aaa
pre-shared-key address 202.102.1.2 key cisco
crypto isakmp profile bbb
keyring aaa
match identity address 202.102.1.2 255.255.255.255
!
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
!
!
crypto map cisco 10 ipsec-isakmp
set peer 202.102.1.2
set transform-set cisco
set isakmp-profile bbb
match address 100
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
!
!
interface Serial1/1
ip address 202.102.1.1 255.255.255.0
serial restart-delay 0
crypto map cisco
!
ip route 0.0.0.0 0.0.0.0 202.102.1.2
access-list 100 permit ip host 1.1.1.1 host 2.2.2.2
R2
crypto keyring aaa
pre-shared-key address 202.102.1.1 key cisco
!
crypto isakmp policy 1
authentication pre-share
crypto isakmp profile bbb
keyring aaa
match identity address 202.102.1.1 255.255.255.255
!
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 202.102.1.1
set transform-set cisco
set isakmp-profile bbb
match address 100
!
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
!
interface Serial1/0
ip address 202.102.1.2 255.255.255.0
serial restart-delay 0
crypto map cisco
!
ip route 0.0.0.0 0.0.0.0 202.102.1.1
access-list 100 permit ip host 2.2.2.2 host 1.1.1.1
只有这个版本支持:
r1#show version
Cisco IOS Software, 7200 Software (C7200-ADVSECURITYK9-M), Version 12.4(20)T1, R
ELEASE SOFTWARE (fc3)
r2#ping 1.1.1.1 source 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 108/126/160 m
r2#show crypto ipsec sa
interface: FastEthernet0/0
Crypto map tag: cisco, local addr 202.102.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (2.2.2.2/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/0/0)
current_peer 202.102.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 202.102.1.2, remote crypto endpt.: 202.102.1.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0x9C76746(164063046)
本文出自 “上善若水威加海内” 博客，转载请与作者联系！