一.拓扑图:




二.基本接口配置:
A.
R1:

int e0/0
   ip add 10.1.1.1 255.255.2555.0
   no sh
int l0
   ip add 1.1.1.1 255.255.255.0
B.FW1:
int e0
   ip add 10.1.1.10 255.255.255.0
   nameif inside
   no sh
int e1
   ip add 202.100.1.100 255.255.255.0
   nameif outside
   no sh
C.R2:
INT E0/0
   ip add 202.100.1.2 255.255.255.0
   no sh
int e0/1
   ip add 202.100.2.2 255.255.255.0
   no sh
D.R3:
int e0/0
   ip add 202.100.2.3 255.255.255.0
   no sh
   ip add 3.3.3.3 255.255.255.0
   no sh
三.路由配置:
R1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.10
pixfirewall(config)# route outside 0.0.0.0 0.0.0.0 202.100.1.2
R3(config)#ip route 0.0.0.0 0.0.0.0 202.100.2.2
四.防火墙NAT及策略配置:
access-list 10 permit ip 10.1.1.0 255.255.255.0 any
nat (inside) 1 access-list 10
global (outside) 1 interface
static (inside,outside) 202.100.1.101 10.1.1.1

备注:NAT-T穿越pix防火墙时需要使用静态NAT,但如果穿越的路由器可以用PAT。
pixfirewall(config)# access-list outside extended permit icmp any any
pixfirewall(config)# access-list outside extended permit gre host 202.100.2.3 host 202.100.1.101
pixfirewall(config-if)# access-group outside in interface outside

备注:从内网出去的GRE数据流无法做状态监控,需要在外边接口放行GRE流量。

.GRE及动态路由配置
A.R1:
R1(config)#int tunnel 0
R1(config-if)#ip add 192.168.0.1 255.255.255.0
R1(config-if)#tunnel source ethernet 0/0
R1(config-if)#tunnel destination 202.100.2.3
R1(config)#router ospf 1
R1(config-router)#router-id 1.1.1.1
R1(config-router)#network 1.1.1.0 0.0.0.255 a 0
R1(config-router)#network 192.168.0.0 0.0.0.255 a 0
B.R3:
R3(config)#int tunnel 0
R3(config-if)#ip add 192.168.0.3 255.255.255.0
R3(config-if)#tunnel source ethernet 0/0
R3(config-if)#tunnel destination 202.100.1.101
R3(config)#router ospf 1
R3(config-router)#router-id 3.3.3.3
R3(config-router)#network 3.3.3.0 0.0.0.255 a 0
R3(config-router)#network 192.168.0.0 0.0.0.255 a 0
---如果没有问题的话,OSPF邻居能够成建立。
六.***配置
R1:

A.感兴趣流配置:
R1(config)#ip access-list extended ***
R1(config-ext-nacl)#permit ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255


B.第一阶段策略:
R1(config)#crypto isakmp policy 10
R1(config-isakmp)#gr
R1(config-isakmp)#group 2
R1(config-isakmp)#ha md
R1(config-isakmp)#en de
R1(config-isakmp)#au pr
R1(config-isakmp)#exit
R1(config)#crypto isakmp key 0 cisco address 202.100.2.3
C.第二阶段策略:
R1(config)#crypto ipsec transform-set transet esp-des esp-md5-hmac
Crypto MAP:
R1(config)#crypto map crymap 10 ipsec-isakmp
R1(config-crypto-map)#set peer 202.100.2.3
R1(config-crypto-map)#set transform-set transet
R1(config-crypto-map)#match address ***

D.tunnel接口应用MAP:
R1(config)#int tunnel 0
R1(config-if)#crypto map crymap
R3:

A.感兴趣流配置:

R3(config)#ip access-list extended ***
R3(config-ext-nacl)#permit ip 3.3.3.0 0.0.0.255 1.1.1.0 0.0.0.255

B.第一阶段策略:

R3(config)#crypto isakmp policy 10
R3(config-isakmp)#group 2
R3(config-isakmp)#ha md
R3(config-isakmp)#gr 2
R3(config-isakmp)#au pr
R3(config-isakmp)#exit
R3(config)#crypto isakmp key 0 cisco add 202.100.1.101

C.第二阶段策略:
R3(config)#crypto ipsec transform-set transet esp-des esp-md5-hmac

Crypto MAP:
R3(config)#crypto map crymap 10 ipsec-isakmp
R3(config-crypto-map)#set peer 202.100.1.101
R3(config-crypto-map)#set transform-set transet
R3(config-crypto-map)#match address ***

D.tunnel接口应用MAP:

R3(config)#int tunnel 0
R3(config-if)#crypto map crymap