配置Cisco VPN 5000和路由器以開啟GRE隧道

簡介

本檔案概述了允許執行Cisco IOS®軟體的思科路由器和Cisco VPN 5000系列集中器開啟通用路由封裝(GRE)通道所需的組態。

必要條件

需求

本文件沒有特定需求。

採用元件

本文中的資訊係根據以下軟體和硬體版本：

• Cisco IOS軟體版本12.0(7)T

• Cisco VPN 5000 Concentrator軟體版本5.2.19US

• Cisco VPN 5002 Concentrator

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路正在作用，請確保您已瞭解任何指令可能造成的影響。

慣例

如需文件慣例的詳細資訊，請參閱思科技術提示慣例。

設定

本節提供用於設定本文件中所述功能的資訊。

注意：要查詢有關本文檔中使用的命令的其他資訊，請使用命令查詢工具(僅限註冊客戶)。

網路圖表

本檔案會使用下圖中所示的網路設定。

組態

本檔案會使用此處顯示的組態。

• Cisco VPN 5002 Concentrator

• 運行Cisco IOS軟體的路由器

[ General ]
 IPSecGateway             = 200.1.1.2
 DeviceName               = "omar5002"
 EthernetAddress          = 00:00:a5:
 e9:c8:00
 DeviceType               = VPN 5002/8 Concentrator
 ConfiguredOn             = Timeserver not configured
 ConfiguredFrom           = Command Line, from Console
 EnablePassword           =
 Password                 =


[ IP Ethernet 1:0 ]
 Mode                     = Routed
 SubnetMask               = 255.255.255.0
 IPAddress                = 200.1.1.1


[ IP Ethernet 0:0 ]
 Mode                     = Routed
 SubnetMask               = 255.255.255.0
 IPAddress                = 10.10.10.1


[ Tunnel Partner VPN 1 ]
 EncryptMethod            = None
 Encryption               = Off
 Authentication           = Off
 KeyManage                = Manual
 Mode                     = Main
 Partner                  = 100.1.1.1
 LocalAccess              = "10.10.10.0/24"
 BindTo                   = "ethernet1:0"
 Peer                     = "20.20.20.0/24"


[ IP Static ]
 20.20.20.0 255.255.255.0 vpn 1 1


[ IP VPN 1 ]
 Numbered                 = Off
 Mode                     = Routed
 Configuration size is 1107 out of 65500 bytes.
 omar5002#

Router Configuration:
Router#show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
!
ip subnet-zero
!
!
!
interface Tunnel0
ip unnumbered Ethernet1
no ip directed-broadcast
tunnel source 100.1.1.1
tunnel destination 200.1.1.1
!
interface Ethernet0
ip address 100.1.1.1 255.255.255.0
no ip directed-broadcast
!
interface Ethernet1
ip address 20.20.20.1 255.255.255.0
no ip directed-broadcast
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 100.1.1.2 1
ip route 10.10.10.0 255.255.255.0 Tunnel0
no ip http server
!
!
line con 0
transport input none
line aux 0
line vty 0 4
login
!
end

驗證

本節提供的資訊可用於確認您的組態是否正常運作。

輸出直譯器工具(僅供註冊客戶使用)支援某些show命令，此工具可讓您檢視show命令輸出的分析。

• show vpn statistics verbose — 提供詳細的隧道資訊。

• show interface — 提供介面統計資訊。

這是從Cisco VPN 5002集中器獲取的show vpn statistics verbose命令輸出示例。

omar5002#show vpn statistic verbose
Current  In       High     Running  Tunnel   Tunnel   Tunnel
Active   Negot    Water    Total    Starts   OK       Error
--------------------------------------------------------------
Users     0        0        0        0        0        0        0
Partners  1        0        1        1        0        0        0
Total     1        0        1        1        0        0        0
Stats             VPN0:1
Wrapped              697
Unwrapped            697
BadEncap               0
BadAuth                0
BadEncrypt             0
rx IP                718
rx IPX                 0
rx Other               0
tx IP                734
tx IPX                 0
tx Other               0
IKE rekey              0
Input VPN pkts dropped due to no SA: 0
Input VPN pkts dropped due to no free queue entries: 0
ISAKMP Negotiation stats
Admin packets in        0
Fastswitch packets in   0
No cookie found         0
Can't insert cookie     0
Inserted cookie(L)      0
Inserted cookie(R)      0
Cookie not inserted(L)  0
Cookie not inserted(R)  0
Cookie conn changed     0
Cookie already inserted  0
Deleted cookie(L)       0
Deleted cookie(R)       0
Cookie not deleted(L)   0
Cookie not deleted(R)   0
Forwarded to RP         0
Forwarded to IOP        0
Bad UDP checksum        0
Not fastswitched        0

這是從路由器取得的show interface命令的命令輸出示例。

Router#show interface tunnel 0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Interface is unnumbered. Using address of Ethernet1 (20.20.20.1)
MTU 1476 bytes, BW 9 Kbit, DLY 500000 usec,
reliability 255/255, txload 55/255, rxload 113/255
Encapsulation TUNNEL, loopback not set
Keepalive set (10 sec)
Tunnel source 100.1.1.1, destination 200.1.1.1
Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled
Checksumming of packets disabled,  fast tunneling enabled
Last input 00:00:15, output 00:00:15, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/0, 1 drops; input queue 0/75, 0 drops
5 minute input rate 4000 bits/sec, 5 packets/sec
5 minute output rate 11000 bits/sec, 5 packets/sec
1309 packets input, 129264 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
1348 packets output, 316468 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out 
Router#

疑難排解

目前尚無適用於此組態的具體疑難排解資訊。

相關資訊

• Cisco VPN 5000系列集中器支援頁
• Cisco VPN 5000使用者端支援頁面
• IPSec（IP 安全通訊協定）支援頁面
• 技術支援 - Cisco Systems