1. 实验目的：
总公司内网通过Internet安全访问分公司内网。在R1和R2上起×××，此实验为点到点，被保护流量必须用acl手动定义出来。
2. 实验拓扑：
3. 实验配置要点：
R5和R3配置简单只需要配置接口ip地址，加上一条静态路由即可。
R6只需要配置接口ip地址即可，不需要知道内网ip只需保证R1和R2的联通。
主要参考配置：
R1的配置：
crypto isakmp policy 1 //定义阶段一的加密策略
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key meng address 26.26.26.2 //定义预共享密钥
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac //定义转换集
!
crypto map mymap 1 ipsec-isakmp //定义ipsec策略
set peer 26.26.26.2 //设置对端ip
set transform-set myset //调用转换集
match address 100 //调用感兴趣流量（受保护的流量）
!
interface Serial1/0
ip address 15.15.15.1 255.255.255.0
serial restart-delay 0
clock rate 64000
!
interface Serial1/1
ip address 16.16.16.1 255.255.255.0
clock rate 64000
crypto map mymap //接口下应用ipsec安全策略
ip route 0.0.0.0 0.0.0.0 16.16.16.6
access-list 100 permit ip 15.15.15.0 0.0.0.255 23.23.23.0 0.0.0.255
R3配置与R1完全类似，唯一不同的是感兴趣流量和对端ip。
4. 实验验证：
r1#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
16.16.16.1 26.26.26.2 QM_IDLE 1001 0 ACTIVE
--------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------
r1#sh crypto ipsec sa
interface: Serial1/1
Crypto map tag: mymap, local addr 16.16.16.1
protected vrf: (none)
local ident (addr/mask/prot/port): (15.15.15.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (23.23.23.0/255.255.255.0/0/0)
current_peer 26.26.26.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 16.16.16.1, remote crypto endpt.: 26.26.26.2
path mtu 1500, ip mtu 1500, ip mtu idb Serial1/1
current outbound spi: 0x35378C54(892832852)
inbound esp sas:
spi: 0x590CD1C1(1494012353)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: 1, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4575936/1782)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x35378C54(892832852)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: 2, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4575936/1781)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
