Router-to-Router Dynamic LAN-to-LAN ×××
Dynamic LAN-to-LAN ××× 之 Router-to-Router
原创
©著作权归作者所有:来自51CTO博客作者henuxzy的原创作品,如需转载,请与作者联系,否则将追究法律责任
1.拓扑
2.步骤
2.1基本连通性配置:
R5:
interface FastEthernet0/0
ip address 15.15.15.5 255.255.255.0
ip route 0.0.0.0 0.0.0.0 15.15.15.1
R1:
interface FastEthernet0/0
ip address 15.15.15.1 255.255.255.0
interface FastEthernet1/0
ip address 16.16.16.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 16.16.16.6
R6:
ip dhcp excluded-address 36.36.36.6
ip dhcp pool net36
network 36.36.36.0 255.255.255.0
default-router 36.36.36.6
interface FastEthernet0/0
ip address 36.36.36.6 255.255.255.0
interface FastEthernet1/0
ip address 16.16.16.6 255.255.255.0
interface Serial2/0
ip address 26.26.26.6 255.255.255.0
R2:
interface FastEthernet0/0
ip address 27.27.27.2 255.255.255.0
interface Serial2/0
ip address 26.26.26.2 255.255.255.0
ip route 0.0.0.0 0.0.0.0 26.26.26.6
R7:
interface FastEthernet0/0
ip address 27.27.27.7 255.255.255.0
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
R3:
interface FastEthernet0/0
ip address dhcp
interface FastEthernet0/1
ip address 38.38.38.3 255.255.255.0
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
R8:
interface FastEthernet1/0
ip address 38.38.38.8 255.255.255.0
ip route 0.0.0.0 0.0.0.0 FastEthernet1/0
2.2测试连通性:
R1到R2和R3的连通性:
R1#ping 36.36.36.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 36.36.36.1, timeout is 2 seconds:
.!!!.
Success rate is 60 percent (3/5), round-trip min/avg/max = 76/120/200 ms
R1#ping 26.26.26.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 26.26.26.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/66/100 ms
R1#
测试R1到北京内网和广州内网的连通性:
R1#ping 27.27.27.7
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 27.27.27.7, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R1#ping 38.38.38.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R1#
说明:虽然R1有指向R6的默认路由,但R6只有公网路由26.26.26.0、36.36.36.0和16.16.16.0,
只能保证R1、R2、R3之间的通信,所以R1无法与北京和广州的分公司内网通信。
同理:R5不能到达北京和广州内网:
R5# ping 27.27.27.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 27.27.27.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5#ping 38.38.38.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5#
查看R6的路由表:
R6# show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
16.0.0.0/24 is subnetted, 1 subnets
C 16.16.16.0 is directly connected, FastEthernet1/0
36.0.0.0/24 is subnetted, 1 subnets
C 36.36.36.0 is directly connected, FastEthernet0/0
26.0.0.0/24 is subnetted, 1 subnets
C 26.26.26.0 is directly connected, Serial2/0
R6#
2.3配置Dynamic LAN-to-LAN ×××:
1.在R1上配置IKE策略:
R1(config)#crypto isakmp policy 1
R1(config-isakmp)#encryption 3des
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#hash sha
R1(config-isakmp)#group 2
R1(config-isakmp)#ex
2.在R1上配置通配符认证方法:
R1(config)#crypto keyring abc
R1(conf-keyring)#pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123
R1(config)#crypto isakmp profile ppp
% A profile is deemed incomplete until it has match identity statements
R1(conf-isa-prof)#keyring abc
R1(conf-isa-prof)#match identity address 0.0.0.0
R1(conf-isa-prof)#ex
3.在R1上配置IPSec transform:
R1(config)#crypto ipsec transform-set myset esp-3des esp-sha-hmac
R1(cfg-crypto-trans)#ex
4.在R1上定义Dynamic map:
R1(config)#crypto dynamic-map mydyn 5
R1(config-crypto-map)#set transform-set myset
R1(config-crypto-map)#set isakmp-profile ppp
R1(config-crypto-map)#ex
R1(config)#
5.在R1上创建crypto map:
R1(config)#crypto map mymap 10 ipsec-isakmp dynamic mydyn
R1(config)#
6.在R1上将crypto map应用到出接口:
R1(config)#int f1/0
R1(config-if)#crypto map mymap
R1(config-if)#
*Mar 1 01:36:23.111: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1(config-if)#ex
R1(config)#
7.使用常规LAN-to-LAN ×××的方式配置R2:
R2(config)#crypto isakmp policy 1
R2(config-isakmp)#en 3
R2(config-isakmp)#ha s
R2(config-isakmp)#au p
R2(config-isakmp)#gr 2
R2(config-isakmp)#ex
R2(config)#crypto isakmp key 0 cisco123 address 16.16.16.1
R2(config)#crypto ipsec transform-set myset esp-3des esp-sha-hmac
R2(cfg-crypto-trans)#ex
R2(config)#access-list 100 permit ip 27.27.27.0 0.0.0.255 15.15.15.0 0.0.0.255
R2(config)#crypto map l2l 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
R2(config-crypto-map)#set peer 16.16.16.1
R2(config-crypto-map)#set transform-set myset
R2(config-crypto-map)#match address 100
R2(config-crypto-map)#ex
R2(config)#int s2/0
R2(config-if)#crypto map l2l
R2(config-if)#
*Mar 1 01:56:13.811: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R2(config-if)#
8.广州供公司路由器R3(动态IP)的×××配置:
R3(config)#crypto isakmp policy 1
R3(config-isakmp)#en 3
R3(config-isakmp)#au p
R3(config-isakmp)#ha s
R3(config-isakmp)#gr 2
R3(config-isakmp)#ex
R3(config)#crypto isakmp key 0 cisco123 add 16.16.16.1
R3(config)#crypto ipsec trans myset esp-3 esp-sha-h
R3(cfg-crypto-trans)#ex
R3(config)#access-list 100 per ip 38.38.38.0 0.0.0.255 15.15.15.0 0.0.0.255
R3(config)#crypto map l2l 1 ipsec-isakmp
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
R3(config-crypto-map)#set peer 16.16.16.1
R3(config-crypto-map)#set trans myset
R3(config-crypto-map)#match add 100
R3(config-crypto-map)#ex
R3(config)#int f0/0
R3(config-if)#cry map l2l
R3(config-if)#
*Oct 18 19:30:46.219: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R3(config-if)#
3.验证
3.1首先验证北京和上海公司的×××连通性:
1.从Hub端上海公司R5向spoke端北京公司27.27.27.0发送流量:
R5#ping 27.27.27.7
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 27.27.27.7, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5#
说明:Dynamic LAN-to-LAN ×××中,hub端是不能事先向spoke端发起流量来触发自己的SA建立的,所以上海到北京的流量不能通过。Hub端的SA只能有spoke端发送流量来触发。
2.从spoke端北京公司27.27.27.0向hub端上海公司R5发送流量:
R7#ping 15.15.15.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 132/174/248 ms
R7#
说明:spoke端向hub端发送的流量成功穿越×××隧道。
3.再次从hub端R5向spoke端27.27.27.0发送流量:
R5#ping 27.27.27.7
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 27.27.27.7, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/119/244 ms
R5#
说明:当从spoke端向hub端发送流量初始化后,hub端到spoke端的流量才能正常通过×××。
4.查看R1上的IKE SA的peers:
R1(config)#do show crypto isakmp peer
Peer: 26.26.26.2 Port: 500 Local: 16.16.16.1
Phase1 id: 26.26.26.2
R1(config)#
5.查看R1上的IKE SA:
R1(config)#do show crypto isakmp sa
dst src state conn-id slot status
16.16.16.1 26.26.26.2 QM_IDLE 1 0 ACTIVE
R1(config)#
6.查看R1上的IPSec SA:
R1(config)#do show crypto ipsec sa
interface: FastEthernet1/0
Crypto map tag: mymap, local addr 16.16.16.1
protected vrf: (none)
local ident (addr/mask/prot/port): (15.15.15.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (27.27.27.0/255.255.255.0/0/0)
current_peer 26.26.26.2 port 500
PERMIT, flags={}
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 16.16.16.1, remote crypto endpt.: 26.26.26.2
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x41F65F0(69166576)
inbound esp sas:
spi: 0xAC742101(2893291777)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4395614/2615)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x41F65F0(69166576)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4395614/2612)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R1(config)#
7.查看R1上的dynamic map相关参数:
R1(config)#do show crypto dynamic-map
Crypto Map Template"mydyn" 5
ISAKMP Profile: ppp
No matching address list set.
Security association lifetime: 4608000 kilobytes/3600 seconds
PFS (Y/N): N
Transform sets={
myset,
}
R1(config)#
3.2查看R2上的相关参数(参照R1):
R2#show cry isakmp peers
Peer: 16.16.16.1 Port: 500 Local: 26.26.26.2
Phase1 id: 16.16.16.1
R2#show cry isakmp sa
dst src state conn-id slot status
16.16.16.1 26.26.26.2 QM_IDLE 1 0 ACTIVE
R2#show cry ipsec sa
interface: Serial2/0
Crypto map tag: l2l, local addr 26.26.26.2
protected vrf: (none)
local ident (addr/mask/prot/port): (27.27.27.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (15.15.15.0/255.255.255.0/0/0)
current_peer 16.16.16.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 26.26.26.2, remote crypto endpt.: 16.16.16.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial2/0
current outbound spi: 0xAC742101(2893291777)
inbound esp sas:
spi: 0x41F65F0(69166576)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: l2l
sa timing: remaining key lifetime (k/sec): (4432449/2370)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xAC742101(2893291777)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: l2l
sa timing: remaining key lifetime (k/sec): (4432449/2368)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R2#
3.3下面是广州公司路由器R3与上海路由器R1之间×××连通性的验证:
1.从hub端(上海公司路由器R5)向spoke端(广州公司38.38.38.0)发流量:
R5#ping 38.38.38.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5#
说明:和预期的一样,hub端不能事先向spoke端发起流量建立SA。
2.从spoke端(广州公司38.38.38.0)向hub端(上海公司R5)发送×××触发流量:
R8#ping 15.15.15.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
...!.
Success rate is 20 percent (1/5), round-trip min/avg/max = 204/204/204 ms
R8#
R8#ping 15.15.15.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 128/186/240 ms
R8#ping 15.15.15.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
!.!..
Success rate is 40 percent (2/5), round-trip min/avg/max = 164/196/228 ms
R8#
说明:从spoke端(广州公司38.38.38.0)的流量成功穿越×××到达hub端。
3.再次从hub端(上海公司路由器R5)向spoke端(广州公司38.38.38.0)发流量:
R5#ping 38.38.38.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 204/217/228 ms
R5#ping 38.38.38.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 148/220/272 ms
R5#
说明:当从spoke端向hub端触发流量后,hub端与spoke端的流量才能通过×××。
4.查看R1上的相关参数:
R1#show cry isakmp peer
Peer: 26.26.26.2 Port: 500 Local: 16.16.16.1
Phase1 id: 26.26.26.2
Peer: 36.36.36.1 Port: 500 Local: 16.16.16.1
Phase1 id: 36.36.36.1
R1#show cry isakmp sa
dst src state conn-id slot status
16.16.16.1 26.26.26.2 QM_IDLE 1 0 ACTIVE
16.16.16.1 36.36.36.1 QM_IDLE 2 0 ACTIVE
R1#show cry ipsec sa
interface: FastEthernet1/0
Crypto map tag: mymap, local addr 16.16.16.1
protected vrf: (none)
local ident (addr/mask/prot/port): (15.15.15.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (27.27.27.0/255.255.255.0/0/0)
current_peer 26.26.26.2 port 500
PERMIT, flags={}
#pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14
#pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 16.16.16.1, remote crypto endpt.: 26.26.26.2
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x41F65F0(69166576)
inbound esp sas:
spi: 0xAC742101(2893291777)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4395613/1046)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x41F65F0(69166576)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4395613/1043)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (15.15.15.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (38.38.38.0/255.255.255.0/0/0)
current_peer 36.36.36.1 port 500
PERMIT, flags={}
#pkts encaps: 16, #pkts encrypt: 16, #pkts digest: 16
#pkts decaps: 12, #pkts decrypt: 12, #pkts verify: 12
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 16.16.16.1, remote crypto endpt.: 36.36.36.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x23231BC(36843964)
inbound esp sas:
spi: 0xDA7CCED8(3665612504)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2003, flow_id: SW:3, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4419243/3185)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x23231BC(36843964)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2004, flow_id: SW:4, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4419242/3181)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R1#
5.查看广州路由器R3上的相关参数:
R3#show cry isakmp peers
Peer: 16.16.16.1 Port: 500 Local: 36.36.36.1
Phase1 id: 16.16.16.1
R3#show cry isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
16.16.16.1 36.36.36.1 QM_IDLE 1001 0 ACTIVE
IPv6 Crypto ISAKMP SA
R3#show cry ipsec sa
interface: FastEthernet0/0
Crypto map tag: l2l, local addr 36.36.36.1
protected vrf: (none)
local ident (addr/mask/prot/port): (38.38.38.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (15.15.15.0/255.255.255.0/0/0)
current_peer 16.16.16.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 13, #pkts encrypt: 13, #pkts digest: 13
#pkts decaps: 16, #pkts decrypt: 16, #pkts verify: 16
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 36.36.36.1, remote crypto endpt.: 16.16.16.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0xDA7CCED8(3665612504)
inbound esp sas:
spi: 0x23231BC(36843964)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, crypto map: l2l
sa timing: remaining key lifetime (k/sec): (4576678/3065)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xDA7CCED8(3665612504)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, crypto map: l2l
sa timing: remaining key lifetime (k/sec): (4576679/3065)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R3#
4.测试NAT对Dynamic LAN-to-LAN ×××的影响:
4.1在R3上配置NAT:
R3(config)#int f0/0
R3(config-if)#ip nat outside
*Oct 18 20:19:27.023: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up
R3(config-if)#int f0/1
R3(config-if)#ip nat inside
R3(config-if)#ex
R3(config)#access-list 110 permit ip any any
R3(config)#ip nat inside source list 110 interface f0/0 overload
4.2测试hub端R5发往北京公司(没有NAT)和广州公司(有NAT)的流量情况:
R5#ping 27.27.27.7
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 27.27.27.7, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 136/157/208 ms
R5#ping 38.38.38.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R5#
4.3查看广州路由器R3上的NAT转换情况:
R3#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 36.36.36.1:5 38.38.38.8:5 15.15.15.5:5 15.15.15.5:5
R3#
说明:可以看到广州公司38.38.38.0去往上海15.15.15.0的流量呗NAT转换了,所以最后没能通过IPSec。
4.4在R3上配置ACL使感兴趣流量绕过NAT:
R3(config)#no access-list 110
R3(config)#access-list 110 deny ip 38.38.38.0 0.0.0.255 15.15.15.0 0.0.0.255
R3(config)#access-list 110 permit ip any any
R3(config)#exit
R3#clear ip nat translation *
R3#
4.5再次从上海15.15.15.0向广州38.38.38.0和北京27.27.27.0发送流量:
R5#ping 38.38.38.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 212/261/340 ms
R5#
R5#ping 27.27.27.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 27.27.27.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 100/137/216 ms
R5#
说明:配置ACL绕过NAT,上海公司到北京和广州的流量再次通过IPsec ×××隧道穿越了Internet。因此在IPSec ×××中,保证需要被IPSec保护的流量绕过NAT转换,否则×××连通失败。
5.发现一个疑问,请求高手指点。
为什么上海公司15.15.15.0和广州公司R8 38.38.38.8之间互相ping的结果都是!.!.! ?上海和R3的38.38.38.3之间ping的结果却正常。
请看:
R1#ping 38.38.38.8 so 15.15.15.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
Packet sent with a source address of 15.15.15.1
.!...
Success rate is 20 percent (1/5), round-trip min/avg/max = 156/156/156 ms
R1#
R5#ping 38.38.38.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.8, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 212/261/340 ms
R5#
R8#ping 15.15.15.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.1, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 172/184/196 ms
R8#
R8#ping 15.15.15.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
!.!.!
Success rate is 60 percent (3/5), round-trip min/avg/max = 160/197/260 ms
R8#
R3的38.38.38.3与上海15.15.15.0之间ping正常:
R3#ping 15.15.15.5 so 38.38.38.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
Packet sent with a source address of 38.38.38.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 128/235/340 ms
R3#
R3#ping 15.15.15.5 so 38.38.38.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.15.15.5, timeout is 2 seconds:
Packet sent with a source address of 38.38.38.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 76/126/172 ms
R3#
R5#ping 38.38.38.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 100/155/212 ms
R5#
R1#ping 38.38.38.3 so 15.15.15.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 38.38.38.3, timeout is 2 seconds:
Packet sent with a source address of 15.15.15.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 88/110/144 ms
R1#
R3和R2的唯一区别就是R3的外部接口配置的IP是DHCP。
![](https://ucenter.51cto.com/images/noavatar_middle.gif)
提问和评论都可以,用心的回复会被更多人看到
评论
发布评论
相关文章
-
IPsec LAN-to-LAN ×××(LAN-to-LAN ×××)
IPsec LAN-to-LAN VPN(LAN-to-LAN VPN)
职场 VPN IPsec 休闲 IPsec VPN -
router_to_route_lan_to_lan_×××
1. 实验目的:总公司内网通过Internet安全访问分公司内网。在R1和R2上起VPN,此实验为点到点,被保护流量必须用acl手动定义出来。2. 实验拓扑:
vpn ipsec 休闲 isakmp site_to_site