GRE over IPsec

----------------------------------上海分公司----------------------------------

R6(config)#interface fastEthernet 0/0

R6(config-if)#ip address 172.17.10.20 255.255.255.0

R6(config-if)#no sh

R6(config)#router eigrp 1

R6(config-router)#no auto-summary

R6(config-router)#network 172.17.10.0 0.0.0.255

R5(config)#interface fastEthernet 0/0

R5(config-if)#ip address 172.17.10.10 255.255.255.0

R5(config-if)#no sh

R5(config)#interface fastEthernet 0/1

R5(config-if)#ip address 10.1.1.5 255.255.255.0

R5(config-if)#no sh

R5(config)#router eigrp 1

R5(config-router)#no auto-summary

R5(config-router)#network 172.17.10.0 0.0.0.255

R5(config-router)#network 10.1.1.0 0.0.0.255

R1(config)#interface fastEthernet 0/1

R1(config-if)#ip address 10.1.1.1 255.255.255.0

R1(config-if)#no sh

R1(config)#interface fastEthernet 0/0

R1(config-if)#ip address 12.1.1.1 255.255.255.0

R1(config-if)#no sh

R1(config)#ip route 0.0.0.0 0.0.0.0 fastEthernet 0/0

R1(config)#router eigrp 1

R1(config-router)#no auto-summary

R1(config-router)#network 10.1.1.0 0.0.0.255

R1#ping 172.17.10.20

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.17.10.20, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 428/462/480 ms

-----------------------------------Internet-----------------------------------

R2(config)#interface fastEthernet 0/0

R2(config-if)#ip address 12.1.1.2 255.255.255.0

R2(config-if)#no sh

R2(config)#interface fastEthernet 0/1

R2(config-if)#ip address 23.1.1.2 255.255.255.0

R2(config-if)#no sh

R3(config)#interface fastEthernet 0/1

R3(config-if)#ip address 23.1.1.3 255.255.255.0

R3(config-if)#no sh

R3(config)#interface fastEthernet 0/0

R3(config-if)#ip address 192.168.1.3 255.255.255.0

R3(config-if)#no sh

R3(config)#ip route 0.0.0.0 0.0.0.0 fastEthernet 0/1

R3(config)#router eigrp 1

R3(config-router)#no auto-summary

R3(config-router)#network 192.168.1.0 0.0.0.255

R3#ping 12.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 12.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 348/384/424 ms

R3#ping 10.1.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.5, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

-----------------------------------北京总部-----------------------------------

R4(config)#interface fastEthernet 0/0

R4(config-if)#ip address 192.168.1.4 255.255.255.0

R4(config-if)#no sh

R4(config)#interface fastEthernet 0/1

R4(config-if)#ip address 192.168.20.10 255.255.255.0

R4(config-if)#no sh

R4(config)#router eigrp 1

R4(config-router)#no auto-summary

R4(config-router)#network 192.168.1.0 0.0.0.255

R4(config-router)#network 192.168.20.0 0.0.0.255

R7(config)#interface fastEthernet 0/1

R7(config-if)#ip address 192.168.20.20 255.255.255.0

R7(config-if)#no sh

R7(config)#router eigrp 1

R7(config-router)#no auto-summary

R7(config-router)#network 192.168.20.0 0.0.0.255

R7#ping 192.168.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 440/596/688 ms

-------------------------------------GRE-------------------------------------

R1(config)#interface tunnel 1

R1(config-if)#ip addr 1.1.1.1 255.255.255.0

R1(config-if)#tunnel source 12.1.1.1

R1(config-if)#tunnel destination 23.1.1.3

R3(config)#interface tunnel 3

R3(config-if)#ip address 1.1.1.3 255.255.255.0

R3(config-if)#tunnel source 23.1.1.3

R3(config-if)#tunnel destination 12.1.1.1

------------------------------------IPsec------------------------------------

R1(config)#crypto isakmp policy 1

R1(config-isakmp)#authentication pre-share

R1(config-isakmp)#encryption 3des

R1(config-isakmp)#hash sha

R1(config-isakmp)#group 2

R1(config)#crypto isakmp key 0 cisco address 23.1.1.3

R1(config)#crypto ipsec transform-set SH esp-3des esp-sha-hmac

R1(cfg-crypto-trans)#mode tunnel

R1(config)#ip access-list extended SH-TO-BJ

R1(config-ext-nacl)#permit gre host 12.1.1.1 host 23.1.1.3

R1(config)#crypto map SH_BJ 1 ipsec-isakmp

R1(config-crypto-map)#set peer 23.1.1.3

R1(config-crypto-map)#set transform-set SH

R1(config-crypto-map)#match address SH-TO-BJ

R1(config)#interface fastEthernet 0/0

R1(config-if)#crypto map SH_BJ

R3(config)#crypto isakmp policy 1

R3(config-isakmp)#authentication pre-share

R3(config-isakmp)#encryption 3des

R3(config-isakmp)#hash sha

R3(config-isakmp)#group 2

R3(config)#crypto isakmp key 0 cisco address 12.1.1.1

R3(config)#crypto ipsec transform-set BJ esp-3des esp-sha-hmac

R3(cfg-crypto-trans)#mode tunnel

R3(config)#ip access-list extended BJ-TO-SH

R3(config-ext-nacl)#permit gre host 23.1.1.3 host 12.1.1.1

R3(config)#crypto map BJ_SH 1 ipsec-isakmp

R3(config-crypto-map)#set peer 12.1.1.1

R3(config-crypto-map)#set transform-set BJ

R3(config-crypto-map)#match address BJ-TO-SH

R3(config)#interface fastEthernet 0/1

R3(config-if)#crypto map BJ_SH

R7#ping 10.1.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.5, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

-----------------------------------EIGRP-----------------------------------

R1(config)#router eigrp 1

R1(config-router)#network 1.1.1.1 0.0.0.0

R3(config)#router eigrp 1

R3(config-router)#network 1.1.1.3 0.0.0.0

R7#ping 172.17.10.20

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.17.10.20, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1192/1488/1844 ms

R7#traceroute 172.17.10.20

Type escape sequence to abort.

Tracing the route to 172.17.10.20

1 192.168.20.10 104 msec 92 msec 132 msec

2 192.168.1.3 388 msec 24 msec 428 msec

3 1.1.1.1 852 msec 852 msec 1116 msec

4 10.1.1.5 1240 msec 644 msec 1100 msec

5 172.17.10.20 1224 msec 1304 msec 1072 msec