1.基础IP配置
R1
int f0/1
ip add 12.1.1.1 255.255.255.0
no sh
int f0/0
ip add 13.1.1.1 255.255.255.0
no sh
int loo 0
ip add 1.1.1.1 255.255.255.255
R2：
int f0/1
ip add 12.1.1.2 255.255.255.0
no sh
int f0/0
ip add 192.168.1.254 255.255.255.0
no sh
ip access-list 100 deny ip per 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
ip access-list 100 permit ip any any
int f0/1
ip nat outside
int f0/0
ip nat inside
ip nat inside list 100 int f0/1 over
R3:
int f0/0
ip add 13.1.1.3 255.255.255.0
no sh
int f0/1
ip add 192.168.2.254 255.255.255.0
no sh
ip access-list 100 deny ip per 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
ip access-list 100 permit ip any any
int f0/0
ip nat outside
int f0/1
ip nat inside
ip nat inside list 100 inside int f0/0 over
R4:
int f0/0
ip add 192.168.1.1 255.255.255.0
no sh
no ip routing
ip default gateway 192.168.1.254
R5:
int f0/1
ip add 192.168.2.1 255.255.255.0
no sh
no ip routing
ip default gateway 192.168.2.254
2.ipsec配置
R3:
第一阶段
show crypto isakmp policy
crypto isakmp policy 10
encryption aes
hash md5
authentication per-share
group 2
lifetime 3600
show crypto isakmp policy
(config)#crypto isakmp key 6 CCIE55 address 12.1.1.2
第二阶段：
crypto ipsec transform-set CCIE55 esp-aes esp-md5-hmac
mode tunnel
crypto map CCIE55MAP 10 ipsec-isakmp
=======================================
access-list 101 per ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
=======================================
set peer 12.1.1.2
set transform-set CCIE55
match address 101
在R2上做类似配置：
R2配置如下：
access-list 101 per ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
crypto isakmp policy 10
encryption aes
hash md5
authentication per-share
group 2
lifetime 3600
crypto isakmp key 6 CCIE55 address 13.1.1.3
crypto ipsec transform-set CCIE55 esp-aes esp-md5-hmac
mode tunnel
crypto map CCIE55MAP 10 ipsec-isakmp
set peer 13.1.1.3
set transform-set CCIE55
match address 101
在R3上调用：
R3:
int f0/0
crypto map CCIE55MAP
R2:
int f0/1
crypto map CCIE55MAP
验证ipsec ：
第一阶段：show crypto isakmp sa(如果没有表项，可以ping一下，流量触发）
show crypto isakmp key
第二阶段：show crypto ipsec sa
R2:show crypto ipsec sa
R3:show crypto ipsec sa
