Current configuration:
!
Version 12.2
Service timestamps debug uptime
Service timestamps log up time
No service password-encryption
!
Hostname Sam-I-am
!
IP subnet-zero
! - the IKE
configuration
Sam-I-am (config) #crypto ISAKMP policy 1 / / define strategy 1
Sam-I-am (ISAKMP) #hash MD5 / / MD5 hash algorithm
Sam-I-am (ISAKMP) #authentication pre-share / / is defined as a pre shared key authentication
Sam-I-am (config) #crypto ISAKMP key cisco123 address 0.0.0 .0 0.0.0.0
! - configuration pre shared key for cisco123, a peer for all IP
The IPSec protocol configuration!
Sam-I-am (config) #crypto IPSec transform-set rtpset esp-des esp-md5-hmac
Create transform! - esp-des esp-md5-hmac
Sam-I-am (config) #crypto dynamic-map rtpmap 10 / / create secure rtpmap 10
San-i-am (crypto-map) #set transform-set rtpset / / using the above transformation set rtpset
San-i-am (crypto-map) #match address 115 / / quoted the access list to determine the protected
traffic
Sam-I-am (config) #crypto map rtptrans 10 ipsec-isakmp dynamic rtpmap
! - will secure atlas is added to the regular maps
!
Interface Ethernet0
IP address 10.2.2 .3 255.255.255.0
No IP directed-broadcast
IP NAT inside
No mop enabled
!
Interface Serial0
IP address 99.99.99.1 255.255.255.0
No IP directed-broadcast
IP NAT outside
Crypto map rtptrans / / confidential mapping is applied to the
S0 interface
!
IP NAT inside source route-map nonat interface Serial0 overload
! - the NAT configuration enables the routing strategy, content for the 10.2.2 .0 access to the 10.1.1.0 does not address translation
! -- to the other network
access are translated
into SO interface IP address IP classless
IP route 0.0.0 .0 0.0.0.0 Serial0 / / configure static routing protocol
No IP HTTP server
!
Access-list 115 permit IP 10.2.2 .0 0.0.0.255 10.1.1.0 0.0.0.255
Access-list 115 deny IP 10.2.2 .0 0.0.0.255 any
!
Access-list 120 deny IP 10.2.2 .0 0.0.0.255 10.1.1.0 0.0.0.255
Access-list 120 permit IP 10.2.2 .0 0.0.0.255 any
!
Sam-I-am (config) #route-map nonat permit 10 / / use the routing strategy
Sam-I-am (router-map) #match IP address 120
!
Line con 0
Transport input none
Line aux 0
Line vty 04
Password WW
Login
!
End
Router:dr_whoovie (VPN Client)
Current configuration:
!
Version 12.2
Service timestamps debug uptime
Service timestamps log uptime
No service password-encryption
!
Hostname dr_whoovie
!
IP subnet-zero
!
Dr_whoovie (config) #crypto ISAKMP policy 1 / / define strategy 1
Dr_whoovie (ISAKMP) #hash MD5 / / MD5 hash algorithm
Dr_whoovie (ISAKMP) #authentication pre-share / / is defined as a pre shared key authentication
Dr_whoovie (config) #crypto ISAKMP key cisco123 address 99.99.99.1
! - configuration pre shared key for cisco123, peer to server
IP99.99.99.1
The IPSec protocol configuration!
Dr_whoovie (config) #crypto IPSec transform-set rtpset esp-des esp-md5-hmac
Create transform! - esp-des esp-md5-hmac
Dr_whoovie (config) #crypto map RTP 1 ipsec-isakmp
Use IKE to create security! - RTP 1
Dr_whoovie (crypto-map) #set peer 99.99.99.1 / / determine the remote peer
Dr_whoovie (crypto-map) #set transform-set rtpset / / using the above transformation set rtpset
Dr_whoovie (crypto-map) #match address 115 / / quoted the access list to determine the protected
traffic
!
Interface Ethernet0
IP address 10.1.1 .1 255.255.255.0
No IP directed-broadcast
IP NAT inside
No mop enabled
!
Interface Serial0
Automatic IP address negotiated //IP address acquisition
No IP directed-broadcast
IP NAT outside
Encapsulation PPP //S0 PPP protocol interface package
No IP mroute-cache
No IP route-cache
Crypto map RTP / / confidential mapping is applied to the
S0 interface
!
IP NAT inside source route-map nonat interface Serial0 overload
! - the NAT configuration enables the routing strategy, content for the 10.1.1 .0 access to the 10.2.2.0 does not address translation
! -- to the other network
access are translated
into SO interface IP address
IP classless
IP route 0.0.0 .0 0.0.0.0 Serial0 / / configure static routing protocol
No IP HTTP server
!
Access-list 115 permit IP 10.1.1 .0 0.0.0.255 10.2.2.0 0.0.0.255
Access-list 115 deny IP 10.1.1 .0 0.0.0.255 any
Access-list 120 deny IP 10.1.1 .0 0.0.0.255 10.2.2.0 0.0.0.255
Access-list 120 permit IP 10.1.1 .0 0.0.0.255 any
!
Dialer-list 1 protocol IP permit
Dialer-list 1 protocol IPX permit
Route-map nonat permit 10 / / use the routing strategy
Match IP address 120
!
Line con 0
Transport input none
Line aux 0
Line vty 04
Password WW
Login ws-c3560x-48p-s
End
More information about switch and router, please view : http://ackol.over-blog.com/
没有评论:
发表评论