使用NAT超载和Cisco Secure VPN Client配置IPSec路由器到路由器

下载选项

PDF (242.1 KB)
在各种设备上使用 Adobe Reader 查看
ePub (91.3 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
Mobi (Kindle) (104.9 KB)
在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看

已更新: 2007 年 5 月 1 日

文档 ID:14132

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

思科IOS®软件版本12.2.7和12.2.8T
Cisco Secure VPN Client 1.1(在IRE客户端帮助>关于菜单中显示为2.1.12)
Cisco 3600 路由器

注意：如果将Cisco 2600系列路由器用于此类VPN场景，则必须将路由器与加密IPsec VPN IOS映像一起安装。

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

Light 配置
House 配置
VPN 客户端配置

Light 配置
Current configuration : 2047 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Light ! boot system flash:c3660-ik9o3s-mz.122-8T ! ip subnet-zero ! ip audit notify log ip audit po max-events 100 ip ssh time-out 120 ip ssh authentication-retries 3 ! !--- IPsec Internet Security Association and !--- Key Management Protocol (ISAKMP) policy. crypto isakmp policy 5 hash md5 authentication pre-share !--- ISAKMP key for static LAN-to-LAN tunnel !--- without extended authenticaton (xauth). crypto isakmp key cisco123 address 10.64.10.45 no-xauth !--- ISAKMP key for the dynamic VPN Client. crypto isakmp key 123cisco address 0.0.0.0 0.0.0.0 !--- Assign the IP address to the VPN Client. crypto isakmp client configuration address-pool local test-pool ! ! ! crypto ipsec transform-set testset esp-des esp-md5-hmac ! crypto dynamic-map test-dynamic 10 set transform-set testset ! ! !--- VPN Client mode configuration negotiation, !--- such as IP address assignment and xauth. crypto map test client configuration address initiate crypto map test client configuration address respond !--- Static crypto map for the LAN-to-LAN tunnel. crypto map test 5 ipsec-isakmp set peer 10.64.10.45 set transform-set testset !--- Include the private network-to-private network traffic !--- in the encryption process. match address 115 !--- Dynamic crypto map for the VPN Client. crypto map test 10 ipsec-isakmp dynamic test-dynamic ! call rsvp-sync ! ! ! ! ! fax interface-type modem mta receive maximum-recipients 0 ! controller E1 2/0 ! ! ! interface FastEthernet0/0 ip address 10.64.10.44 255.255.255.224 ip nat outside duplex auto speed auto crypto map test ! interface FastEthernet0/1 ip address 192.168.100.1 255.255.255.0 ip nat inside duplex auto speed auto ! interface BRI4/0 no ip address shutdown ! interface BRI4/1 no ip address shutdown ! interface BRI4/2 no ip address shutdown ! interface BRI4/3 no ip address shutdown ! !--- Define the IP address pool for the VPN Client. ip local pool test-pool 192.168.1.1 192.168.1.254 !--- Exclude the private network and VPN Client !--- traffic from the NAT process. ip nat inside source route-map nonat interface FastEthernet0/0 overload ip classless ip route 0.0.0.0 0.0.0.0 10.64.10.33 ip http server ip pim bidir-enable ! !--- Exclude the private network and VPN Client !--- traffic from the NAT process. access-list 110 deny ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255 access-list 110 deny ip 192.168.100.0 0.0.0.255 192.168.1.0 0.0.0.255 access-list 110 permit ip 192.168.100.0 0.0.0.255 any !--- Include the private network-to-private network traffic !--- in the encryption process. access-list 115 permit ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255 ! !--- Exclude the private network and VPN Client !--- traffic from the NAT process. route-map nonat permit 10 match ip address 110 ! ! dial-peer cor custom ! ! ! ! ! line con 0 line 97 108 line aux 0 line vty 0 4 ! end

Light 配置

 Current configuration : 2047 bytes
 !
 version 12.2
 service timestamps debug uptime
 service timestamps log uptime
 no service password-encryption
 !
 hostname Light
 !
 boot system flash:c3660-ik9o3s-mz.122-8T
 !
 ip subnet-zero
 !
 ip audit notify log
 ip audit po max-events 100
 ip ssh time-out 120
 ip ssh authentication-retries 3
 !

!--- IPsec Internet Security Association and !--- Key Management Protocol (ISAKMP) policy.

 crypto isakmp policy 5
  hash md5
  authentication pre-share

!--- ISAKMP key for static LAN-to-LAN tunnel !--- without extended authenticaton (xauth).

 crypto isakmp key cisco123 address 10.64.10.45 no-xauth

!--- ISAKMP key for the dynamic VPN Client.

 crypto isakmp key 123cisco address 0.0.0.0 0.0.0.0

!--- Assign the IP address to the VPN Client.

 crypto isakmp client configuration address-pool local test-pool
 !
 !
 ! 
 crypto ipsec transform-set testset esp-des esp-md5-hmac 
 !
 crypto dynamic-map test-dynamic 10
  set transform-set testset 
 !
 !

!--- VPN Client mode configuration negotiation, !--- such as IP address assignment and xauth.

 crypto map test client configuration address initiate
 crypto map test client configuration address respond

!--- Static crypto map for the LAN-to-LAN tunnel.

 crypto map test 5 ipsec-isakmp   
  set peer 10.64.10.45
  set transform-set testset 

!--- Include the private network-to-private network traffic !--- in the encryption process.

  match address 115

!--- Dynamic crypto map for the VPN Client.

 crypto map test 10 ipsec-isakmp dynamic test-dynamic 
 !


 call rsvp-sync
 !
 !
 !         
 !
 !
 fax interface-type modem
 mta receive maximum-recipients 0
 !
 controller E1 2/0
 !
 !
 !
 interface FastEthernet0/0
  ip address 10.64.10.44 255.255.255.224
  ip nat outside
  duplex auto
  speed auto
  crypto map test
 !
 interface FastEthernet0/1
  ip address 192.168.100.1 255.255.255.0
  ip nat inside
  duplex auto
  speed auto
 !
 interface BRI4/0
  no ip address
  shutdown
 !
 interface BRI4/1
  no ip address
  shutdown
 !
 interface BRI4/2
  no ip address
  shutdown
 !
 interface BRI4/3
  no ip address
  shutdown
 !
 
!--- Define the IP address pool for the VPN Client.

 ip local pool test-pool 192.168.1.1 192.168.1.254

!--- Exclude the private network and VPN Client !--- traffic from the NAT process.

 ip nat inside source route-map nonat interface FastEthernet0/0 overload 
 ip classless
 ip route 0.0.0.0 0.0.0.0 10.64.10.33
 ip http server
 ip pim bidir-enable
 !

!--- Exclude the private network and VPN Client !--- traffic from the NAT process.

 access-list 110 deny   ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
 access-list 110 deny   ip 192.168.100.0 0.0.0.255 192.168.1.0 0.0.0.255
 access-list 110 permit ip 192.168.100.0 0.0.0.255 any

!--- Include the private network-to-private network traffic !--- in the encryption process.

 access-list 115 permit ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
 !

!--- Exclude the private network and VPN Client !--- traffic from the NAT process.

 route-map nonat permit 10
  match ip address 110 
 !
 !
 dial-peer cor custom
 !
 !
 !
 !
 !
 line con 0
 line 97 108
 line aux 0
 line vty 0 4
 !
 end

House 配置
Current configuration : 1689 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname house ! boot system flash:c3660-jk8o3s-mz.122-7.bin ! ip subnet-zero ! ! no ip domain-lookup ! ip audit notify log ip audit po max-events 100 ip ssh time-out 120 ip ssh authentication-retries 3 ! !--- IPsec ISAKMP policy. crypto isakmp policy 5 hash md5 authentication pre-share !--- ISAKMP key for static LAN-to-LAN tunnel without xauth authenticaton. crypto isakmp key cisco123 address 10.64.10.44 no-xauth ! ! crypto ipsec transform-set testset esp-des esp-md5-hmac ! !--- Static crypto map for the LAN-to-LAN tunnel. crypto map test 5 ipsec-isakmp set peer 10.64.10.44 set transform-set testset !--- Include the private network-to-private network traffic !--- in the encryption process. match address 115 ! call rsvp-sync cns event-service server ! ! ! ! ! fax interface-type modem mta receive maximum-recipients 0 ! ! ! interface FastEthernet0/0 ip address 10.64.10.45 255.255.255.224 ip nat outside duplex auto speed auto crypto map test ! interface FastEthernet0/1 ip address 192.168.200.1 255.255.255.0 ip nat inside duplex auto speed auto ! interface BRI2/0 no ip address shutdown ! interface BRI2/1 no ip address shutdown ! interface BRI2/2 no ip address shutdown ! interface BRI2/3 no ip address shutdown ! interface FastEthernet4/0 no ip address shutdown duplex auto speed auto ! !--- Exclude the private network traffic !--- from the dynamic (dynamic association to a pool) NAT process. ip nat inside source route-map nonat interface FastEthernet0/0 overload ip classless ip route 0.0.0.0 0.0.0.0 10.64.10.33 no ip http server ip pim bidir-enable ! !--- Exclude the private network traffic from the NAT process. access-list 110 deny ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255 access-list 110 permit ip 192.168.200.0 0.0.0.255 any !--- Include the private network-to-private network traffic !--- in the encryption process. access-list 115 permit ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255 !--- Exclude the private network traffic from the NAT process. route-map nonat permit 10 match ip address 110 ! ! ! dial-peer cor custom ! ! ! ! ! line con 0 line aux 0 line vty 0 4 login ! end

House 配置

Current configuration : 1689 bytes
 !
 version 12.2
 service timestamps debug uptime
 service timestamps log uptime
 no service password-encryption
 !
 hostname house
 !
 boot system flash:c3660-jk8o3s-mz.122-7.bin
 !
 ip subnet-zero
 !
 !
 no ip domain-lookup
 !
 ip audit notify log
 ip audit po max-events 100
 ip ssh time-out 120
 ip ssh authentication-retries 3
 !

!--- IPsec ISAKMP policy.

 crypto isakmp policy 5
  hash md5 
  authentication pre-share

!--- ISAKMP key for static LAN-to-LAN tunnel without xauth authenticaton.

 crypto isakmp key cisco123 address 10.64.10.44 no-xauth
 !
 !
 crypto ipsec transform-set testset esp-des esp-md5-hmac 
 !

!--- Static crypto map for the LAN-to-LAN tunnel.

 crypto map test 5 ipsec-isakmp   
  set peer 10.64.10.44
  set transform-set testset 

!--- Include the private network-to-private network traffic !--- in the encryption process.

  match address 115 
 !
 call rsvp-sync
 cns event-service server
 !
 !
 !
 !
 !
 fax interface-type modem
 mta receive maximum-recipients 0
 !
 !
 !         
 interface FastEthernet0/0
  ip address 10.64.10.45 255.255.255.224
  ip nat outside
  duplex auto
  speed auto
  crypto map test
 !
 interface FastEthernet0/1
  ip address 192.168.200.1 255.255.255.0
  ip nat inside
  duplex auto
  speed auto
 !
 interface BRI2/0
  no ip address
  shutdown
 !
 interface BRI2/1
  no ip address
  shutdown
 !
 interface BRI2/2
  no ip address
  shutdown
 !
 interface BRI2/3
  no ip address
  shutdown
 !
 interface FastEthernet4/0
  no ip address
  shutdown
  duplex auto
  speed auto
 !
 
!--- Exclude the private network traffic !--- from the dynamic (dynamic association to a pool) NAT process.

 ip nat inside source route-map nonat interface FastEthernet0/0 overload
 ip classless
 ip route 0.0.0.0 0.0.0.0 10.64.10.33
 no ip http server
 ip pim bidir-enable
 !
 
!--- Exclude the private network traffic from the NAT process.

 access-list 110 deny   ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
 access-list 110 permit ip 192.168.200.0 0.0.0.255 any

!--- Include the private network-to-private network traffic !--- in the encryption process.

 access-list 115 permit ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
 
!--- Exclude the private network traffic from the NAT process.

 route-map nonat permit 10
  match ip address 110
 !
 !
 !
 dial-peer cor custom
 !
 !
 !
 !
 !
 line con 0
 line aux 0
 line vty 0 4
  login
 !
 end

VPN 客户端配置
Network Security policy: 1- TOLIGHT My Identity Connection security: Secure Remote Party Identity and addressing ID Type: IP subnet 192.168.100.0 255.255.255.0 Port all Protocol all Connect using secure tunnel ID Type: IP address 10.64.10.44 Pre-shared Key=123cisco Authentication (Phase 1) Proposal 1 Authentication method: pre-shared key Encryp Alg: DES Hash Alg: MD5 SA life: Unspecified Key Group: DH 1 Key exchange (Phase 2) Proposal 1 Encapsulation ESP Encrypt Alg: DES Hash Alg: MD5 Encap: tunnel SA life: Unspecified no AH 2- Other Connections Connection security: Non-secure Local Network Interface Name: Any IP Addr: Any Port: All

VPN 客户端配置

Network Security policy:
       1- TOLIGHT
       My Identity
       Connection security: Secure
       Remote Party Identity and addressing
       ID Type: IP subnet
       192.168.100.0
       255.255.255.0
       Port all Protocol all
       
  Connect using secure tunnel
         ID Type: IP address
         10.64.10.44

       
  Pre-shared Key=123cisco

       
  Authentication (Phase 1)
         Proposal 1
         Authentication method: pre-shared key
         Encryp Alg: DES
         Hash Alg: MD5
         SA life: Unspecified
         Key Group: DH 1

       
  Key exchange (Phase 2)
         Proposal 1
         Encapsulation ESP
         Encrypt Alg: DES
         Hash Alg: MD5
         Encap: tunnel
         SA life: Unspecified
         no AH

       
  2- Other Connections
         Connection security: Non-secure
         Local Network Interface
         Name: Any
         IP Addr: Any
         Port: All