CiscoIPSEC –无固定IP 总部有固定IP—ID(分支机构ID—hostname 总部来区分

总部R5 : PC4-inside F0/1 NAT F0/0 outside
分部R4 : PC5- inside F0/1 NAT F0/0 outside
分部R6 : PC6- inside F0/1 NAT F0/0 outside

说明：
R4:pre-share key 123456 localid:CiscoA
R6:pre-share key 1234567 localid:CiscoC
R5 作为总部仅仅允许相应ID 对应相应的网络访问。
采用野蛮模式互通时，作为隧道发起方和响应方的配置是有区别的。
Cisco作为隧道发起方：
crypto isakmp peer address 10.1.1.2 //发起方必须配置
set aggressive-mode password 123456 (pre-share key)
set aggressive-mode client-endpoint fqdn CiscoA （发起方定义本地ID）
Cisco作为隧道响应方：
crypto isakmp key 123456 hostname CiscoA 作为响应方对应发起方配置（安全）
crypto isakmp identity hostname

二个分支没有固定IP方式测试
R4:配置
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Cisco
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!

!
archive
log config
hidekeys
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 28800
!
crypto isakmp peer address 10.1.1.2
set aggressive-mode password 123456
set aggressive-mode client-endpoint fqdn CiscoA
!
!
crypto ipsec transform-set set1 esp-3des esp-sha-hmac
!
crypto map mymap 1 ipsec-isakmp
set peer 10.1.1.2
set security-association lifetime seconds 28800
set transform-set set1
set pfs group2
match address 110
!
!ip tcp synwait-time 5
!
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map mymap
!
interface Serial0/0
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet0/1
ip address 172.99.99.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.1.1.254
!
!
no ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0 overload
!
access-list 100 deny ip 172.99.99.0 0.0.0.255 172.99.98.0 0.0.0.255
access-list 100 permit ip any any
access-list 110 permit ip 172.99.99.0 0.0.0.255 172.99.98.0 0.0.0.255
no cdp log mismatch duplex
!
control-plane
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
end

R6:配置
!
!version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CiscoC
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!!
no ip domain lookup
!
multilink bundle-name authenticated
!

archive
log config
hidekeys
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 28800
!
crypto isakmp peer address 10.1.1.2
set aggressive-mode password 1234567
set aggressive-mode client-endpoint fqdn CiscoC
!
!
crypto ipsec transform-set set1 esp-3des esp-sha-hmac
!
crypto map mymap 1 ipsec-isakmp
set peer 10.1.1.2
set security-association lifetime seconds 28800
set transform-set set1
set pfs group2
match address 110
!
ip tcp synwait-time 5
!

interface FastEthernet0/0
ip address 10.1.1.3 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map mymap
!
interface Serial0/0
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet0/1
ip address 172.99.97.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.1.1.254
!
!
no ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0 overload
!
access-list 100 deny ip 172.99.97.0 0.0.0.255 172.99.98.0 0.0.0.255
access-list 100 permit ip any any
access-list 110 permit ip 172.99.97.0 0.0.0.255 172.99.98.0 0.0.0.255
no cdp log mismatch duplex
control-plane
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end

R5:
!
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CiscoB
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
archive
log config
hidekeys
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key 123456 hostname CiscoA
crypto isakmp key 1234567 hostname CiscoC
crypto isakmp identity hostname
!
!
crypto ipsec transform-set set1 esp-3des esp-sha-hmac
!
crypto dynamic-map dyna 10
set transform-set set1
match address 110
crypto dynamic-map dyna 20
set transform-set set1
match address 120
!
!
crypto map mymap 10 ipsec-isakmp dynamic dyna
!
ip tcp synwait-time 5
!
interface FastEthernet0/0
ip address 10.1.1.2 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map mymap
!
interface Serial0/0
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet0/1
ip address 172.99.98.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.1.1.254
!
!
no ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0 overload
!
access-list 100 deny ip 172.99.98.0 0.0.0.255 172.99.99.0 0.0.0.255
access-list 100 deny ip 172.99.98.0 0.0.0.255 172.99.97.0 0.0.0.255
access-list 100 permit ip any any
access-list 110 permit ip 172.99.98.0 0.0.0.255 172.99.99.0 0.0.0.255
access-list 120 permit ip 172.99.98.0 0.0.0.255 172.99.97.0 0.0.0.255
no cdp log mismatch duplex
!
!
control-plane
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end

原文地址：http://blog.51cto.com/372560/2177836

时间： 2024-11-08 08:03:49

CiscoIPSEC –无固定IP 总部有固定IP—ID(分支机构ID—hostname 总部来区分的相关文章

ASA之间建立IPsec-VPN（Dynamic site-to-site static）【一边固定IP、一边动态IP】

ASA之间建立IPsec-VPN(Dynamic site-to-site static)[一边固定IP.一边动态IP]   网络拓扑: ASA动态端: 第一阶段:8.4(2)版本及以上的ASA支持2个版本的IKE,所以在定义密钥的交互形式的时候我们选择IKEV1,主要是路由器没有对应的IKEV2的版本:   crypto ikev1 policy 10  authentication pre-share  encryption 3des  hashmd5  group 2  lifetime

多IP整C固定IP对于直播平台人气有多少关系？

说的直播,现在大家都很熟悉 ,可以说家喻户晓 ,人人皆知 ,上到80 ,下的5-6岁的孩子都知道这些 ,比如某音 ,快手,YY.虎牙等各种平台 ,但是有很多 主播为了,吸引更多的 游客来给自己增加人气 ,说到这个点上 ,也就是以咱们的标题有点关联了 ,独立独享固定IP,对于直播间有什么作用呢 ,其实大家都很明白 ,IP就代表一个人 ,也就人气增加一个,现在很多都是以流量为主 ,流量就是IP ,所以 ,每个IP对于主播来说都是不小的收益,有可能就会碰到一个刷客 ,这就成为了直接收益了 ,在很多直播

浮动IP地址（Float IP）与 ARP欺骗技术

浮动IP地址: 一个网卡是可以添加多个IP的. 就是多个主机工作在 同一个集群中,即两台主机以上.每台机器除了自己的实IP外,会设置一个浮动IP,浮动IP与主机的服务(HTTP服务/邮箱服务)绑在一起的.即应用服务在哪台机器上启动,浮动IP也在这台机器上激活,这台机器看上去就有两个IP地址.对于客户端它只需访问浮动IP即可. 即使主机端的机器由于故障发生切换,客户端只要连接上浮动IP,就可以找到主机端的服务. 好处就是一旦其中一台机器不能工作了,可以很快的将服务切换到另外一台主机上.提高系统的冗

TCP/IP详解之IP分片

先介绍几个术语: MSS:最大段尺寸 1.   是应用层(TCP)与传输层之间的接口属性 2.   用于向对端TCP通告对端在每个TCP分节中能发送的最大TCP数据量. 3.   它经常设置成MTU减去IP和TCP首部的固定长度. 4.   它是一个16位的字段,限定最大值是65535, 5.   65535这个MSS值被视为表示"无限"的一个特殊值. MTU:即Maximum Transmission Unit(最大传输单元) 1.  网络层和链路层之间的接口属性: 2.  MTU是

Windows Azure Virtual Machine (28) 使用Azure实例级别IP，Instance-Level Public IP Address (PIP)

<Windows Azure Platform 系列文章目录> 本文介绍的是国内由世纪互联运维的Azure China 熟悉Azure平台的读者都知道,我们在使用Azure Virtual Machine,会有公用虚拟机IP(VIP)和内部IP(DIP).截图如下: 在Azure平台,关于IP有非常重要的概念 1.VIP (Virtual IP),这个是Azure负载均衡器(SLB)的IP地址.当2台Azure VM部署在同一个Cloud Service下,这2台Azure VM的VIP是相同

php利用淘宝IP库获取用户ip地理位置

利用淘宝IP库获取用户ip地理位置 我们查ip的时候都是利用ip138查询的,不过那个有时候是不准确的,还不如自己引用淘宝的ip库来查询,这样准确度还高一些.不多说了,介绍一下: 淘宝IP地址库 淘宝公布了他们的IP库http://ip.taobao.com/,还有REST API接口,不过每个用户的访问频率需小于10qps,访问方    式:http://ip.taobao.com/service/getIpInfo.php?ip=[ip地址字串],返回内容以json格式的.具有IP查询,IP

启动ip wizard时报the ip wizard does not support dhcp

启动ip wizard时报the ip wizard does not support dhcp 阅读:5502012-05-11 11:15 标签:loadrunner 打开ip wizard:开始 - loadrunner - tool - ip wizard,会提示 The IP wizard does not support DHCP- enabled network cards.Your cards are either DHCP-enabled or configured with

关于网络中的内网IP地址和公网IP地址

公网IP和内网IP    一.先来看一下IP地址划分: A类地址:0.0.0.0------127.255.255.255 其中127.255.255.255是广播地址,不能分配 B类地址:128.0.0.0------191.255.255.255 C类地址:192.0.0.0------223.255.255.255 D类地址:224.0.0.0-----239.255.255.255 E类地址:240.0.0.0------255.255.255         你要是想看你自己机子的IP

清除被隐藏网卡占用的IP地址,本机IP地址被占用

清除被隐藏网卡及占用的IP地址,本机IP地址被占用当主机中的网卡更换或换了一个插槽时,还要用到原来网卡的IP地址,但系统提示IP地址已经被本机中网卡占用,而主机里确实只有刚插入的网卡,这个原因就是以前插入的网卡占用了该IP地址,但它隐藏了,我们删不到它,在XP/2K3系统中解决方法如下: 方法一.在运行中输入regedit,打开注册表编辑器,找到"HKEY-LOCAL-MACHINE\System\ControlSet001\coontrol\sessionmanage\Environment,