Vpn_ha _ Ha _ link backup

In this experiment, we need to combine RRI and keeplive to implement dual-line access.

 

Configuration:

Client:

 

!

Crypto isakmp policy 10

Authentication pre-share

Crypto isakmp key cisco address 202.100.1.2

Crypto isakmp key cisco address 61.128.128.3

Crypto isakmp keepalive 10 periodic

!

!

Crypto ipsec transform-set cisco esp-des esp-md5-hmac

!

Crypto map cisco 10 ipsec-isakmp

Set peer 202.100.1.2 master VPN

Set peer 61.128.128.3 backup VPN à one VPN two PEER

Set transform-set cisco

Match address 100

!

!

!

!

!

Interface Loopback0

Ip address 1.1.1.1 255.255.255.0

!

!

Interface Serial1/2

Ip address 10.1.1.1 255.255.255.0

Serial restart-delay 0

Crypto map cisco

!

Ip route 0.0.0.0 0.0.0.0 10.1.1.5

Access-list 100 permit ip host 1.1.1.1 host 2.2.2.4

 

 

 

 

 

The Active and standby configurations are the same.

Crypto isakmp policy 10

Authentication pre-share

Crypto isakmp key cisco address 0.0.0.0 0.0.0.0

Crypto isakmp keepalive 10 periodic

!

!

Crypto ipsec transform-set cisco esp-des esp-md5-hmac

!

Crypto dynamic-map dymap 10

Set transform-set cisco

Reverse-route tag 10

!

!

Crypto map cisco 10 ipsec-isakmp dynamic dymap à static map to call dynamic map

!

!

!

!

!

Interface FastEthernet0/0

Ip address 2.2.2.2 255.255.255.0

Duplex full

!

!

Interface Serial1/2

Ip address 202.100.1.2 255.255.255.0

Serial restart-delay 0

Crypto map cisco

!

!

Router ospf 1

Log-adjacency-changes

Redistribute static subnets route-map sto

Network 2.2.2.0 0.0.0.255 area 0

!

Ip route 0.0.0.0 0.0.0.0 202.100.1.5

 

!

Route-map sto permit 10

Match tag 10

!

 

Internet

 

!

Interface Serial1/0

Ip address 202.100.1.5 255.255.255.0

Serial restart-delay 0

!

Interface Serial1/1

Ip address 61.128.128.5 255.255.255.0

Shutdown

Serial restart-delay 0

!

Interface Serial1/2

Ip address 10.1.1.5 255.255.255.0

Serial restart-delay 0

!

 

Inside

 

!

Interface FastEthernet0/0

Ip address 2.2.2.4 255.255.255.0

Duplex auto

Speed auto

!

!

Router ospf 1

Log-adjacency-changes

Network 0.0.0.0 255.255.255.255 area 0

!

 

 

 

 

 

 

Client ping

 

Client # ping 2.2.2.4 source 1.1.1.1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.4, timeout is 2 seconds:

Packet sent with a source address of 1.1.1.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 436/568/668 MS

Client #

 

 

View inside route table

Inside # show ip route

Codes: C-connected, S-static, R-RIP, M-mobile, B-BGP

D-OSPF, EX-VPN external, O-OSPF, IA-OSPF inter area

N1-ospf nssa external type 1, N2-ospf nssa external type 2

E1-OSPF external type 1, E2-OSPF external type 2

I-IS, su-IS summary, L1-IS-level-1, L2-IS level-2

Ia-IS inter area, *-candidate default, U-per-user static route

O-ODR, P-periodic downloaded static route

 

Gateway of last resort is not set

 

1.0.0.0/32 is subnetted, 1 subnets

O E2 1.1.1.1 [110/20] via 2.2.2.2, 00:00:18, FastEthernet0/0

2.0.0.0/24 is subnetted, 1 subnets

C 2.2.2.0 is directly connected, FastEthernet0/0

Inside #

 

 

Sh intermediate router internet interface

 

Internet (config) # interface serial 1/0

Internet (config-if) # no sh

 

Sh, followed by inside route table

Gateway of last resort is not set

 

1.0.0.0/32 is subnetted, 1 subnets

O E2 1.1.1.1 [110/20] via 2.2.2.2, 00:01:32, FastEthernet0/0

2.0.0.0/24 is subnetted, 1 subnets

C 2.2.2.0 is directly connected, FastEthernet0/0

Inside # show ip route

Codes: C-connected, S-static, R-RIP, M-mobile, B-BGP

D-OSPF, EX-VPN external, O-OSPF, IA-OSPF inter area

N1-ospf nssa external type 1, N2-ospf nssa external type 2

E1-OSPF external type 1, E2-OSPF external type 2

I-IS, su-IS summary, L1-IS-level-1, L2-IS level-2

Ia-IS inter area, *-candidate default, U-per-user static route

O-ODR, P-periodic downloaded static route

 

Gateway of last resort is not set

 

1.0.0.0/32 is subnetted, 1 subnets

O E2 1.1.1.1 [110/20] via 2.2.2.3, 00:00:01, FastEthernet0/0

2.0.0.0/24 is subnetted, 1 subnets

C 2.2.2.0 is directly connected, FastEthernet0/0

Inside #

 

 

This article is from the blog "shangshanruoshui Weijia Hai ".