在私有网络和公共网络之间通过预置共享、NAT 超载配置路由器间的 IPSec

rp-3640-2b#show running config
Building configuration...

Current configuration:
!
version 12.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname rp-3640-2b
!
ip subnet-zero
!

!

!--- Defines the Internet Key Exchange (IKE) policies.


crypto isakmp policy 1


!--- Defines an IKE policy. Use the crypto isakmp policy !--- command in global configuration mode. IKE policies !--- define a set of parameters !--- that are used during the IKE phase I negotiation.


hash md5 
authentication pre-share


!--- Specifies preshared keys as the authentication method.


crypto isakmp key cisco123 address 95.95.95.2 


!--- Configures a preshared authentication key, used in !--- global configuration mode. 


!
crypto ipsec transform-set rtpset esp-des esp-md5-hmac  


!--- Defines a transform-set. This is an acceptable !--- combination of security protocols and algorithms, !--- which has to be matched on the peer router.


!
crypto map rtp 1 ipsec-isakmp  


!--- Indicates that IKE is used to !--- establish the IPSec security associations (SAs) that protect !--- the traffic specified by this crypto map entry.


set peer 95.95.95.2


!--- Sets the IP address of the remote end.


set transform-set rtpset 


!--- Configures IPSec to use the transform-set !--- "rtpset" defined earlier.

 
match address 115


!--- This is used to assign an extended access list to a !--- crypto map entry which is used by IPSec !--- to determine which traffic should be protected !--- by crypto and which traffic does not !--- need crypto protection. 


!
interface Ethernet0/0
ip address 98.98.98.1 255.255.255.0
no ip directed-broadcast
!
interface Ethernet0/1
ip address 99.99.99.2 255.255.255.0
no ip directed-broadcast
no ip route-cache


!--- Enable process switching for !--- IPSec to encrypt outgoing packets. !--- This command disables fast switching.


no ip mroute-cache
crypto map rtp


!--- Configures the interface to use !--- the crypto map "rtp" for IPSec.


!

.
.


!--- Output suppressed.


.
.
ip classless
ip route 0.0.0.0 0.0.0.0 99.99.99.1


!--- Default route to the next hop address.


no ip http server
!
access-list 115 permit ip 98.98.98.0 0.0.0.255 10.103.1.0 0.0.0.255


!--- This access-list option causes all IP traffic !--- that matches the specified conditions to be !--- protected by IPSec using the policy described by !--- the corresponding crypto map command statements.


access-list 115 deny ip 98.98.98.0 0.0.0.255 any

!
line con 0
transport input none
line aux 0
line vty 0 4
login
!
end

rp-3640-6a#show running config
Building configuration...

Current configuration:
!
version 12.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname rp-3640-6a
!

!
ip subnet-zero




!--- Defines the IKE policies.


!
crypto isakmp policy 1


!--- Defines an IKE policy. !--- Use the crypto isakmp policy !--- command in global configuration mode. IKE policies !--- define a set of parameters !--- that are used during the IKE phase I negotiation.


hash md5
authentication pre-share


!--- Specifies preshared keys as the authentication method.


crypto isakmp key cisco123 address 99.99.99.2 


!--- Configures a preshared authentication key, !--- used in global configuration mode.
 

!
crypto ipsec transform-set rtpset esp-des esp-md5-hmac 


!--- Defines a transform-set. This is an !--- acceptable combination of security protocols and algorithms, !--- which has to be matched on the peer router.


crypto map rtp 1 ipsec-isakmp


!--- Indicates that IKE is used to establish !--- the IPSec SAs that protect the traffic !--- specified by this crypto map entry.


set peer 99.99.99.2


!--- Sets the IP address of the remote end.


set transform-set rtpset


!--- Configures IPSec to use the transform-set !--- "rtpset" defined earlier.

 
match address 115


!--- Used to assign an extended access list to a !--- crypto map entry which is used by IPSec !--- to determine which traffic should be protected !--- by crypto and which traffic does not !--- need crypto protection.



.
.


!--- Output suppressed.


.
.
!
interface Ethernet3/0
ip address 95.95.95.2 255.255.255.0
no ip directed-broadcast
ip nat outside


!--- Indicates that the interface is !--- connected to the outside network. 


no ip route-cache


!--- Enable process switching for !--- IPSec to encrypt outgoing packets. !--- This command disables fast switching.


no ip mroute-cache
crypto map rtp


!--- Configures the interface to use the !--- crypto map "rtp" for IPSec.



!
interface Ethernet3/2
ip address 10.103.1.75 255.255.255.0
no ip directed-broadcast
ip nat inside


!--- Indicates that the interface is connected to !--- the inside network (the network subject to NAT translation).
 

!

ip nat pool FE30 95.95.95.10 95.95.95.10 netmask 255.255.255.0


!--- Used to define a pool of IP addresses for !--- NAT. Use the ip nat pool command in !--- global configuration mode.


ip nat inside source route-map nonat pool FE30 overload


!--- Used to enable NAT of !--- the inside source address. Use the ip nat inside source !--- command in global configuration mode. !--- The 'overload' option enables the router to use one global !--- address for many local addresses.


ip classless
ip route 0.0.0.0 0.0.0.0 95.95.95.1


!--- Default route to the next hop address.



no ip http server
!
access-list 110 deny ip 10.103.1.0 0.0.0.255 98.98.98.0 0.0.0.255
access-list 110 permit ip 10.103.1.0 0.0.0.255 any


!--- Addresses that match this ACL are NATed while !--- they access the Internet. They are not NATed !--- if they access the 98.98.98.0 network.


access-list 115 permit ip 10.103.1.0 0.0.0.255 98.98.98.0 0.0.0.255


!--- This access-list option causes all IP traffic that !--- matches the specified conditions to be !--- protected by IPSec using the policy described !--- by the corresponding crypto map command statements.


access-list 115 deny ip 10.103.1.0 0.0.0.255 any

route-map nonat permit 10
match ip address 110
!

!
line con 0


line vty 0 4

!
end