Build an L2L VPN between a vrodvdvti and a vro with the same PAT Device

I. Test topology:

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/0100563F4-0.jpg "title =" tuopu. JPG "/>

Ii. Basic Configuration:

A. R1
Interface Loopback0
Ip address 192.168.1.1 255.255.255.0
Interface FastEthernet0/0
Ip address 10.1.1.1 255.255.255.0
No shut
B. R2
Interface Ethernet0/0
Ip address 10.1.1.2 255.255.255.0
No shut
Interface Ethernet0/1
Ip address 202.100.1.2 255.255.255.0
No shut
C. R3
Interface FastEthernet0/0
Ip address 202.100.1.3 255.255.255.0
No shut
Interface FastEthernet0/1
Ip address 202.100.2.3 255.255.255.0
No shut
D. R4
Interface Ethernet0/0
Ip address 255.1.1.4 255.255.255.0
No shut

Interface Ethernet0/2
Ip address 30.1.1.4 255.255.255.0
No shut
Interface Ethernet0/1
Ip address 202.100.2.4 255.255.255.0
No shut
E. R5
Interface Loopback0
Ip address 192.168.2.5 255.255.255.0
Interface FastEthernet0/0
Ip address 255.1.1.5 255.255.255.0
No shut

F. R6

Interface Loopback0
Ip address 192.168.3.6 255.255.255.0
Interface FastEthernet0/0
Ip address 30.1.1.6 255.255.255.0
No shut

Iii. Static Routing and PAT Configuration:
A. Static route Configuration:
① R1
Ip route 0.0.0.0 0.0.0.0 10.1.1.2
② R2
Ip route 0.0.0.0 0.0.0.0 202.100.1.3
Ip route 192.168.1.0 255.255.255.0 10.1.1.1
③ R4
Ip route 0.0.0.0 0.0.0.0 202.100.2.3
Ip route 192.168.2.0 255.255.255.255.0 255.1.1.5

Ip route 192.168.3.0 255.255.255.0 30.1.1.6

④ R5
Ip route 0.0.0.0 0.0.0.0 255.1.1.4

⑤ R6
Ip route 0.0.0.0 0.0.0.0 30.1.1.4

B. Dynamic PAT Configuration:
① R2
Ip access-list extended 100
Permit ip 192.168.1.0 0.0.255 any
Permit ip 10.1.1.0 0.0.255 any
Int e0/0
Ip nat inside
Int e0/1
Ip nat outside
Ip nat inside source list 100 interface e0/1
② R4
Ip access-list extended 100
Permit ip 192.168.2.0 0.0.255 any

Permit ip 192.168.3.0 0.0.0.255 any
Permit ip limit 1.1.0 0.0.255 any

Permit ip 30.1.1.0 0.0.255 any

Int e0/0
Ip nat inside
Int e0/1
Ip nat outside
Ip nat inside source list 100 interface e0/1
C. Static PAT Configuration:
R2
Ipnat inside source static udp 10.1.1.1 500 interface e0/1 500
Ipnat inside source static udp 10.1.1.1 4500 interface e0/1 4500

Iv. VPN configuration:
A. R1 (HUB ):
① Stage 1:
Crypto keyring R4
Pre-shared-key address 202.100.2.4 key cisco
Crypto isakmp policy 10
Encr 3des
Hash md5
Authentication pre-share
Group 2
Crypto isakmp profile isakmpprofile
Keyring R4
Match identity address 1.1.5

Match identity address 30.1.1.6

Virtual-template 1
--------- The identity address in isakmp profie must be a real address instead of a NAT address.
② Stage 2:
Crypto ipsec transform-set transet esp-3des (esp-sha-hmac)
③ Associate the ipsec profile with the first-and second-stage policies:
Crypto ipsec profile ipsecprofile
Set transform-set transet
Set isakmp-profile isakmpprofile
④ Dynamic VTI Configuration:
Interface Loopback100
Ip address 172.16.1.1 255.255.255.0
Interface Virtual-Template1 type tunnel
Ip unnumbered Loopback100
Tunnel source FastEthernet0/0
Tunnel mode ipsec ipv4
Tunnel protection ipsec profile ipsecprofile
Note: IP addresses cannot be directly configured on the virtual-template interface.
B. R5 (Spoke ):
① Stage 1:
Crypto isakmp policy 10
Encr 3des
Hash md5
Authentication pre-share
Group 2
Crypto isakmp key cisco address 202.100.1.2
② Stage 2:
Crypto ipsec transform-set transet esp-3des (esp-sha-hmac)
③ Associate the ipsec profile with the second-stage policy:
Crypto ipsec profile ipsecprofile
Set transform-set transet
④ Static VTI Configuration:
Interface Tunnel0
Ip address 172.16.1.5 255.255.255.0
Tunnel source FastEthernet0/0
Tunnel destination 202.100.1.2
Tunnel mode ipsec ipv4
Tunnel protection ipsec profile ipsecprofile

C. R6 (Spoke ):
① Stage 1:
Crypto isakmp policy 10
Encr 3des
Hash md5
Authentication pre-share
Group 2
Crypto isakmp key cisco address 202.100.1.2
② Stage 2:
Crypto ipsec transform-set transet esp-3des (esp-sha-hmac)
③ Associate the ipsec profile with the second-stage policy:
Crypto ipsec profile ipsecprofile
Set transform-set transet
④ Static VTI Configuration:
Interface Tunnel0
Ip address 172.16.1.6 255.255.255.0
Tunnel source FastEthernet0/0
Tunnel destination 202.100.1.2
Tunnel mode ipsec ipv4
Tunnel protection ipsec profile ipsecprofile

C. Dynamic Route Configuration:
① R1
Router VPN 10
Network 172.16.1.0 0.0.0.255
Network 192.168.1.0
No auto-summary
② R5
Router VPN 10
Network 172.16.1.0 0.0.0.255
Network 192.168.2.0
No auto-summary

③ R6
Router VPN 10
Network 172.16.1.0 0.0.0.255
Network 192.168.3.0
No auto-summary

5. Verification:

R1 # show ip int brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 10.1.1.1 YES manual up
FastEthernet0/1 unassigned YES unset administratively down
Virtual-Access1 unassigned YES unset down
Virtual-Template1 172.16.1.1 yes tftp down
Virtual-Access2 172.16.1.1 yes tftp up
Virtual-Access3 172.16.1.1 yes tftp up
Loopback0 192.168.1.1 YES manual up
Loopback100 172.16.1.1 YES manual up
R1 # show crypto isakmp sa
IPv4 Crypto ISAKMP SA
Dst src state conn-id slot status
10.1.1.1 202.100.2.4 QM_IDLE 1006 0 ACTIVE
10.1.1.1 202.100.2.4 QM_IDLE 1005 0 ACTIVE

R1 # show crypto engine connections active
Crypto Engine Connections

ID Interface Type Algorithm Encrypt Decrypt IP-Address
11 Fa0/0 IPsec 3DES + SHA 0 475 10.1.1.1
12 Fa0/0 IPsec 3DES + SHA 491 0 10.1.1.1
13 Fa0/0 IPsec 3DES + SHA 0 242 10.1.1.1
14 Fa0/0 IPsec 3DES + SHA 244 0 10.1.1.1
1005 Fa0/0 IKE MD5 + 3DES 0 0 10.1.1.1
1006 Fa0/0 IKE MD5 + 3DES 0 0 10.1.1.1

This article is from the "httpyuntianjxxll. spac..." blog, please be sure to keep this source http://333234.blog.51cto.com/323234/1229529