IOS EzVPN沒有隧道分割從總部訪問公網測試

.測試拓撲：

參考連結：http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a008073b06b.shtml

總的思路：在EzVPN Server上設定一個loopback口，並在外網口配置route-map，將用戶端去往公網的流量打到loopback口並進行NAT出公網，配置route-map時需要注意下一跳地址為loopback口任意直連地址，而不是loopback口的地址。

2.基本配置：

A.Private路由：

interface E0/0

ip address 172.16.1.10 255.255.255.0

no shut

ip route 0.0.0.0 0.0.0.0 172.16.1.1

B.Branch路由器：

interface Ethernet0/0

ip address 172.16.1.1 255.255.255.0

no shut

interface Ethernet0/1

 ip address 202.100.1.1 255.255.255.0

 no shut

ip route 0.0.0.0 0.0.0.0 202.100.1.10

C.Internet路由器：

interface E0/0

ip address 202.100.1.10 255.255.255.0

no shut

interface E0/1

ip address 202.100.2.10 255.255.255.0

no shut

D.Center路由器：

interface FastEthernet0/0

ip address 10.1.1.1 255.255.255.0

ip nat inside

no shut

interface FastEthernet0/1

ip address 202.100.2.1 255.255.255.0

ip nat outside

no shut

ip route 0.0.0.0 0.0.0.0 202.100.2.10

ip access-list extended pat

deny   ip 10.1.1.0 0.0.0.255 123.1.1.0 0.0.0.255

permit ip any any

ip nat inside source list pat interface FastEthernet0/1 overload