在 IOS 路由器上采用隧道分离技术以 NEM 模式下配置 EzVPN 的配置示例

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname RouterA
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
enable password cisco
!
username glenn password 0 cisco123
no network-clock-participate slot 1 
no network-clock-participate wic 0 
aaa new-model
!
!
aaa authentication login userlist local
aaa authorization network groupauthor local 
aaa session-id common
ip subnet-zero
ip cef
!
ip dhcp-server 172.17.81.127
! 
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp keepalive 20 10
!

!--- Group definition for the EzVPN server feature. !--- VPN Clients that connect in need to be defined with this !--- group name/password and are allocated these attributes.

crypto isakmp client configuration group VPNCLIENTGROUP
 key mnbvcxz
 domain nuplex.com.au
 pool vpn1
 acl 150
!
!

!--- IPsec profile for VPN Clients. 
 
crypto isakmp profile VPNclient
   description VPN clients profile
   match identity group VPNCLIENTGROUP
   client authentication list userlist
   isakmp authorization list groupauthor
   client configuration address respond
!
!
crypto ipsec transform-set 3des esp-3des esp-sha-hmac 
!
!         

!--- Configuration for EzVPN Client configuration. These parameters !--- are configured on RouterB. ACL 120 is the new "multiple-subnet" !--- feature of EzVPN. This allows the router to build an additional !--- SA for traffic that matches the line in ACL 120 so that traffic !--- from VPN Clients are routed over the EzVPN Client tunnel !--- to RouterB. Without this, VPN Clients are only able to !--- connect to subnets behind RouterA, and not RouterB.



 crypto ipsec client ezvpn china
 connect auto
 group china key mnbvcxz
 mode network-extension
 peer 10.66.79.105
 acl 120
!
!

 crypto dynamic-map SDM_CMAP_1 99
 set transform-set 3des 
 set isakmp-profile VPNclient
 reverse-route
!
!
crypto map SDM_CMAP_1 99 ipsec-isakmp dynamic SDM_CMAP_1 
!
!
!
interface FastEthernet0/0
 description Outside interface
 ip address 10.66.79.102 255.255.255.224
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 crypto map SDM_CMAP_1
 crypto ipsec client ezvpn china
!
!
interface FastEthernet1/0
 description Inside interface
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 crypto ipsec client ezvpn china inside
!
!

!--- IP pool of addresses. Note that this pool must be !--- a different supernet to any of the split tunnel !--- networks sent down from RouterB.

ip local pool vpn1 192.168.1.1 192.168.1.254
ip classless
ip route 0.0.0.0 0.0.0.0 10.66.79.97
!
no ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0 overload
!
access-list 100 deny   ip 10.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 100 permit ip 10.1.1.0 0.0.0.255 any


!--- Access-list that defines additional SAs for this !--- router to create to the head-end EzVPN server (RouterB). !--- Without this, RouterA only builds an SA for traffic !--- from 10.1.1.0 to 10.2.2.0. VPN Clients !--- that connect (and get a 192.168.1.0 address) !--- are not able to get to 10.2.2.0.

access-list 120 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.255.255.255


!--- Split tunnel access-list for VPN Clients. 
 
access-list 150 permit ip 10.1.1.0 0.0.0.255 any
access-list 150 permit ip 10.2.2.0 0.0.0.255 any
dialer-list 1 protocol ip permit
!
!
control-plane
!
!
!
!
line con 0
 exec-timeout 0 0
 login authentication nada
line aux 0
 modem InOut
 modem autoconfigure type usr_courier
 transport input all
 speed 38400
line vty 0 4
 transport preferred all
 transport input all
!
!
end

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname RouterB
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
!
aaa new-model
!
!

!--- No XAuth is defined but can be if needed.

aaa authorization network groupauthor local 
aaa session-id common
ip subnet-zero
ip cef
!
!         
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp keepalive 10
! 
!

!--- Standard EzVPN server configuration, !--- matching parameters defined on RouterA.
        
crypto isakmp client configuration group china
 key mnbvcxz
 acl 150
!
!
crypto ipsec transform-set 3des esp-3des esp-sha-hmac 
!
crypto dynamic-map dynmap 1
 set transform-set 3des 
 reverse-route
!
!
!
crypto map mymap isakmp authorization list groupauthor
crypto map mymap client configuration address respond
crypto map mymap 10 ipsec-isakmp dynamic dynmap 
!
!
!
!
interface Ethernet0/0
 description Outside interface
 ip address 10.66.79.105 255.255.255.224
 half-duplex
 crypto map mymap
!
!
interface Ethernet0/1
 description Inside interface
 ip address 10.2.2.1 255.255.255.0
 half-duplex
!
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 10.66.79.97
!
!
access-list 150 permit ip 10.0.0.0 0.255.255.255 any
!      
!
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
!
!
!
end