今天用DY做的GRE-VPN实验，根大家分享下

rocisky

R1-->R3-->R2


R1 ,R2做GRE和IPSEC，R3不做配置，假设是公网

route配置：
####R1
R1(config)#int s1/2
R1(config-if)#ip add 69.1.10.10 255.255.255.0
R1(config-if)#clock rate 64000
R1(config-if)#no shu
R1(config-if)#exit
R1(config)#int loopback 0
R1(config-if)#ip add 10.10.10.1 255.255.255.0
R1(config-if)#no shu
R1(config-if)#exit
R1(config)#router rip
R1(config-router)#ver 2
R1(config-router)#no auto
R1(config-router)#net 69.1.10.0
R1(config-router)#net 10.10.10.0
####R2
R2(config)#int s1/2
R2(config-if)#ip add 69.1.20.20 255.255.255.0
R2(config-if)#clock rate 64000
R2(config-if)#no shu
R2(config-if)#int loopback 0
R2(config-if)#ip add 10.10.20.1 255.255.255.0
R2(config-if)#no shu
R2(config-if)#exit
R2(config)#router rip
R2(config-router)#ver 2
R2(config-router)#no auto
R2(config-router)#net 69.1.20.0
R2(config-router)#net 10.10.20.0
####R3
R3(config)#int s1/0
R3(config-if)#ip add 69.1.10.11 255.255.255.0
R3(config-if)#clock rate 64000
R3(config-if)#no shu
R3(config-if)#exit
R3(config-if)#int loopback 0
R3(config-if)#ip add 10.10.30.1 255.255.255.0
R3(config-if)#exit
R3(config)#int s1/1
R3(config-if)#ip add 69.1.20.22 255.255.255.0
R3(config-if)#clock rate 64000
R3(config-if)#no shu
R3(config-if)#exit
R3(config)#router rip
R3(config-router)#ver 2
R3(config-router)#no auto
R3(config-router)#net 69.1.10.0
R3(config-router)#net 69.1.20.0
R3(config-router)#net 10.10.30.0
Gre配置：
####R1
R1(config)#int tunnel 0
R1(config-if)#ip add 12.12.12.1 255.255.255.0
R1(config-if)#tunnel source 69.1.10.10
R1(config-if)#tunnel desti 69.1.20.20
R1(config-if)#ip mtu 1400
R1(config-if)#no shu
R1(config-if)#exit
R1(config)#router rip
R1(config-router)#ver 2
R1(config-router)#no auto
R1(config-router)#net 12.12.12.0
R1(config-router)#exit
R1(config)#crypto isakmp ena
R1(config)#crypto isakmp policy 100
R1(config-isakmp)#authen pre-share
R1(config-isakmp)#encry 3des
R1(config-isakmp)#group 2
R1(config-isakmp)#hash md5
R1(config-isakmp)#lifetime 72000
R1(config-isakmp)#exit
R1(config)#crypto isakmp key cisco1234 address 69.1.20.20
R1(config)#crypto ipsec transform-set mine esp-3des
R1(cfg-crypto-trans)#mode tran
R1(cfg-crypto-trans)#exit
R1(config)#crypto ipsec secu life sec 72000
R1(config)#crypto map Map1 10 ipsec-isakmp
R1(config-crypto-map)#set peer 69.1.20.20
R1(config-crypto-map)#match address 101
R1(config-crypto-map)#set pfs group2
R1(config-crypto-map)#set secu life sec 72000
R1(config-crypto-map)#set transform-set mine
R1(config-crypto-map)#exit
R1(config-crypto-map)#int s1/2
R1(config-if)#crypto map Map1
R1(config-if)#exit
R1(config)#access-list 101  per gre host 69.1.10.10  host 69.1.20.20

####R2
R2(config)#int tunnel 0
R2(config-if)#ip add 12.12.12.2 255.255.255.0
R2(config-if)#no shu
R2(config-if)#ip mtu 1400
R2(config-if)#tunnel source 69.1.20.20
R2(config-if)#tunnel desti 69.1.10.10
R2(config-if)#router rip
R2(config-router)#ver 2
R2(config-router)#no auto
R2(config-router)#net 12.12.12.0
R2(config-router)#exit
R2(config)#crypto isakmp ena
R2(config)#crypto isakmp poli 100
R2(config-isakmp)#authen pre-share
R2(config-isakmp)#encryption 3des
R2(config-isakmp)#hash md5
R2(config-isakmp)#group 2
R2(config-isakmp)#lifetime 72000
R2(config)#crypto isakmp key cisco1234 address 69.1.10.10
R2(config)#crypto ipsec transform-set mine esp-3des
R2(cfg-crypto-trans)#mode tran
R2(cfg-crypto-trans)#exit
R2(config)#crypto ipsec secu life sec 72000
R2(config)#crypto map Map1 10 ipsec-isakmp
R2(config-crypto-map)#set peer 69.1.10.10
R2(config-crypto-map)#match address 102
R2(config-crypto-map)#set pfs group2
R2(config-crypto-map)#set secu life sec 72000
R2(config-crypto-map)#set transform-set mine
R2(config-crypto-map)#exit
R2(config)#int s1/2
R2(config-if)#crypto map Map1
R2(config-if)#exit
R2(config)#access-list 102  per gre host  69.1.20.20 host 69.1.10.10
============================================
R3#sh run
Building configuration...
Current configuration : 1095 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
ip address 10.10.30.1 255.255.255.0
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface Serial1/0
ip address 69.1.10.11 255.255.255.0
serial restart-delay 0
clock rate 64000
!
interface Serial1/1
ip address 69.1.20.22 255.255.255.0
serial restart-delay 0
clock rate 64000
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet2/0
no ip address
shutdown
duplex half
!
router rip
version 2
network 10.0.0.0
network 69.0.0.0
no auto-summary
!
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
R3#


==================================
R2#sh run
Building configuration...
Current configuration : 1667 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 100
encr 3des
hash md5
authentication pre-share
group 2
lifetime 72000
crypto isakmp key cisco1234 address 69.1.10.10
!
crypto ipsec security-association lifetime seconds 72000
!
crypto ipsec transform-set mine esp-3des
mode transport
!
crypto map Map1 10 ipsec-isakmp
set peer 69.1.10.10
set transform-set mine
set pfs group2
match address 102
!
!
!
!
!
interface Loopback0
ip address 10.10.20.1 255.255.255.0
!
interface Tunnel0
ip address 12.12.12.2 255.255.255.0
ip mtu 1400
tunnel source 69.1.20.20
tunnel destination 69.1.10.10
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
ip address 69.1.20.20 255.255.255.0
serial restart-delay 0
clock rate 64000
crypto map Map1
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
interface FastEthernet2/0
no ip address
shutdown
duplex half
!
router rip
version 2
network 10.0.0.0
network 12.0.0.0
network 69.0.0.0
no auto-summary
!
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
access-list 102 permit gre host 69.1.20.20 host 69.1.10.10
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!
!
end
R2#
================================
check   R1 :
R1#sh crypto ipsec sa
interface: Serial1/2
    Crypto map tag: Map1, local addr 69.1.10.10
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (69.1.10.10/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (69.1.20.20/255.255.255.255/47/0)
   current_peer 69.1.20.20 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 7, #pkts encrypt: 7, #pkts digest: 7
    #pkts decaps: 28, #pkts decrypt: 28, #pkts verify: 28
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 27, #recv errors 0
     local crypto endpt.: 69.1.10.10, remote crypto endpt.: 69.1.20.20
     path mtu 1500, ip mtu 1500, ip mtu idb Serial1/2
     current outbound spi: 0x6DC3D8CE(1841551566)
     inbound esp sas:
      spi: 0xAC3E1D94(2889751956)
        transform: esp-3des ,
        in use settings ={Transport, }
        conn id: 1, flow_id: 1, crypto map: Map1
        sa timing: remaining key lifetime (k/sec): (4516065/71395)
        IV size: 8 bytes
        replay detection support: N
        Status: ACTIVE
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0x6DC3D8CE(1841551566)
        transform: esp-3des ,
        in use settings ={Transport, }
        conn id: 2, flow_id: 2, crypto map: Map1
        sa timing: remaining key lifetime (k/sec): (4516069/71393)
        IV size: 8 bytes
        replay detection support: N
        Status: ACTIVE
     outbound ah sas:
     outbound pcp sas:

R1#
R1#ping 10.10
*May 27 22:34:25.687: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#ping 10.10.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds:
.
*May 27 22:34:54.687: %TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing
*May 27 22:34:55.687: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down....
Success rate is 0 percent (0/5)
R1#
*May 27 22:35:55.687: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
R1#ping 10.10.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#
R1#
R1#
R1#
*May 27 22:36:24.687: %TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing
*May 27 22:36:25.687: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
R1#
R1#ping 10.10.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 16/55/108 ms
R1#ping 10.10.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 48/64/88 ms
R1#ping 10.10.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 44/71/96 ms
R1#
R1#
============================================
check R2:

R2#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
69.1.20.20      69.1.10.10      QM_IDLE           1001    0 ACTIVE
IPv6 Crypto ISAKMP SA
R2#show crypto ipsec sa
interface: Serial1/2
    Crypto map tag: Map1, local addr 69.1.20.20
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (69.1.20.20/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (69.1.10.10/255.255.255.255/47/0)
   current_peer 69.1.10.10 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 24, #pkts encrypt: 24, #pkts digest: 24
    #pkts decaps: 6, #pkts decrypt: 6, #pkts verify: 6
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
     local crypto endpt.: 69.1.20.20, remote crypto endpt.: 69.1.10.10
     path mtu 1500, ip mtu 1500, ip mtu idb Serial1/2
     current outbound spi: 0xAC3E1D94(2889751956)
     inbound esp sas:
      spi: 0x6DC3D8CE(1841551566)
        transform: esp-3des ,
        in use settings ={Transport, }
        conn id: 1, flow_id: 1, crypto map: Map1
        sa timing: remaining key lifetime (k/sec): (4452443/71495)
        IV size: 8 bytes
        replay detection support: N
        Status: ACTIVE
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0xAC3E1D94(2889751956)
        transform: esp-3des ,
        in use settings ={Transport, }
        conn id: 2, flow_id: 2, crypto map: Map1
        sa timing: remaining key lifetime (k/sec): (4452439/71492)
        IV size: 8 bytes
        replay detection support: N
        Status: ACTIVE
     outbound ah sas:
     outbound pcp sas:
R2#
======================================

[ 本帖最后由 rocisky 于 2007-5-27 23:03 编辑 ]

rocisky

模拟器做完后要等会等R1收敛了，不然PING不通，还有就好似遇到PING r1时有时不通丢包的问题

zaopeng

^_^，学习一下，该天我也做一下！

hss326

好啊,非常值得较针的知识点啊!一定顶一下!

bluesky

虽然是刚刚学Cisco，但是好东西还是要顶一下

jixiang8309

虽然一部分看不懂还是顶一下下

mian1982

呵呵
不错！！！1
顶顶～········

da_wuya

先把帖子顶上去，看到就先顶！

chi198199

rip 都全起来了.内网也广播出去了..当然能啦.
应该内网不广播做实验通了.才能证明VPN启动了.

houyf

thank you!

zxb51876159

你为什么要在R1,R2的2个串口上都配置速率,只有DCE设备才需要配置速率,DTE不需要