实验基本连通性:
Internet网配置:
enable
configure terminal
hostname Internet
line console 0
logg sy
exec-time 0 0
exit
no ip domain-lookup
interface fastethernet 0/1
ip add 100.1.1.1 255.255.255.0
no shut
exit
interface fastethernet 0/0
ip add 200.1.1.1 255.255.255.0
no shut
exit
interface ethernet 1/1
ip add 202.103.96.1 255.255.255.0
no shut
exit
interface ethernet 1/0
ip add 210.1.1.1 255.255.255.0
no shut
exit
ip dhcp excluded-address 210.1.1.1
ip dhcp pool wifi
network 210.1.1.0 255.255.255.0
default-router 210.1.1.1
dns-server 202.103.96.112
exit
总部配置:
enable
configure terminal
hostname Internet
line console 0
logg sy
exec-time 0 0
exit
no ip domain-lookup
interface fastethernet 0/1
ip add 100.1.1.2 255.255.255.0
no shut
ip nat outside
exit
interface fastethernet 0/0
ip add 192.168.1.254 255.255.255.0
no shut
ip nat inside
exit
ip route 0.0.0.0 0.0.0.0 100.1.1.1
ip dhcp excluded-address 192.168.1.254
ip dhcp pool zongbu
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
dns-server 202.103.96.112
exit
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
ip nat inside source list 100 interface FastEthernet0/1 overload
ip nat inside source static tcp 192.168.1.253 80 100.1.1.2 80
分部配置:
enable
configure terminal
hostname fenbu
line console 0
logg sy
exec-time 0 0
exit
no ip domain-lookup
interface fastethernet 0/0
ip add 200.1.1.2 255.255.255.0
no shut
ip nat outside
exit
interface fastethernet 0/1
ip add 192.168.2.254 255.255.255.0
no shut
ip nat inside
exit
ip route 0.0.0.0 0.0.0.0 200.1.1.1
ip dhcp excluded-address 192.168.2.254
ip dhcp pool zongbu
network 192.168.2.0 255.255.255.0
default-router 192.168.2.254
dns-server 202.103.96.112
exit
access-list 100 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 100 permit ip 192.168.2.0 0.0.0.255 any
ip nat inside source list 100 interface FastEthernet0/0 overload
但由于×××没有做,外网和分部的PC是Ping不通内部的PC和服务器的。
现在进行×××配置:
总部:
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key tom address 200.1.1.2
crypto ipsec transform-set tim esp-3des esp-md5-hmac
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
crypto map tom 11 ipsec-isakmp
set peer 200.1.1.2
set transform-set tim
match address 101
interface FastEthernet0/1
crypto map tom
aaa new-model
aaa authentication login eza local
aaa authorization network ezo local
username tang password 123
ip local pool ez 192.168.3.1 192.168.3.100
crypto isakmp client configuration group myez
key 123
pool ez
crypto dynamic-map ezmap 10
set transform-set tim
reverse-route
crypto map tom client authentication list eza
crypto map tom isakmp authorization list ezo
crypto map tom client configuration address respond
crypto map tom 10 ipsec-isakmp dynamic ezmap
(Easy ×××是IPSEC ×××的两个阶段之间的2.5阶段,固阶段一喝阶段二都可以条用一样的策略)
分部的配置:
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key tom address 100.1.1.2
crypto ipsec transform-set tim esp-3des esp-md5-hmac
crypto map tom 10 ipsec-isakmp
set peer 100.1.1.2
set transform-set tim
match address 101
access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
interface FastEthernet0/0
crypto map tom
测试:
Ipsec ×××就是分部的ping总部的PC,来检测连通性,Easy ×××的连接测试在《Cisco PacketTracer 5.2模拟器的Easy ×××实验指南》中有说明。
当×××都连通后,就能ping通内部的TFTP服务器了!
最后给大家留个问题,本实验中,我已经解决了,Ipsec ×××的×××和NAT上网问题。但我无线笔记Easy ×××接入总部后,只能访问用IP来访问内部Web服务器,而访问不了Internet的Web服务器。这是为什么,应该如何解决。