用Cisco DM***构建高扩展的网络（二）
本篇介绍hub和spoke全部为动态地址的情况，此种情形spoke间的所有***流量都会有hub中转，下面用两种方法来配置，一种是GRE over IPsec，另一种是GRE over Ez***，思路都是一样的，用隧道建立一个可以访问的NHRP服务器，让spoke来注册，如果只用一种方法来配置的话，spoke的配置是差不多的，hub也不用改配置。体现了较高的扩展性如图所示，只是将上篇的拓扑稍作修改，添加了一台PPPoE的服务器。其余配置跟上篇一样，这里只将三个站点的配置贴出来，其余配置，可以参考上篇。
Branch1 为ez***客户端
hostname Branch1
no aaa new-model
ip cef
!
ip name-server 202.106.0.20
!DDNS 配置
ip ddns update method cisco
HTTP
add http://jackyan1:passwd@members.3322.org/dyndns/update?system=dyndns&hostname=<h>&myip=<a>&wildcard=ON&backmx=NO&offline=NO
remove http://jackyan1:passwd@members.3322.org/dyndns/update?system=dyndns&hostname=<h>&myip=<a>&wildcard=ON&backmx=NO&offline=NO
!
! crypto isakmp key 后面支持域名
crypto isakmp key cisco hostname jackyansite3.f3322.org
!Ez***client配置
crypto ipsec client ez*** hwxd
connect auto 定义连接方法，有自动，有手动
group ez***group key cisco 第一阶段认证用的组和秘钥
mode network-extension 模式用NEM
peer jackyansite3.f3322.org 对端的域名或IP
username aaauser password cisco 1.5阶段认证用的用户名和密码
xauth userid mode local xauth认证方法用本地用户名
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
crypto ipsec client ez*** hwxd inside Ez***的内网，定义可以访问服务器端网络的本地网络
!
interface Loopback100
description Inside.network
ip address 192.168.1.1 255.255.255.0
ip ospf network point-to-point
!
interface Tunnel0
ip address 172.16.1.1 255.255.255.0
ip mtu 1400
ip nhrp authentication cisco 认证可选
ip nhrp map multicast 5.5.5.5 组播映射
ip nhrp map 172.16.1.5 5.5.5.5 nhrp注册
ip nhrp network-id 30599 > ip nhrp nhs 172.16.1.5 nhrp服务器
ip nhrp cache non-authoritative
ip ospf network broadcast
ip ospf priority 0
tunnel source Loopback0
tunnel destination 5.5.5.5 tunnel mode 为点到点的GRE
tunnel key 123
!
interface FastEthernet0/0
no ip address
pppoe enable group global PPPoE配置
pppoe-client dial-pool-number 1
!
interface Dialer1
ip ddns update hostname jackyansite1.f3322.org 把接口地址映射到jackyansite1.f3322.org
ip ddns update cisco
ip address negotiated
ip mtu 1490
encapsulation ppp
dialer pool 1
ppp authentication pap callin
ppp pap sent-username user1 password 0 cisco
crypto ipsec client ez*** hwxd Ez***的外部接口
!
router ospf 1
log-adjacency-changes
network 172.16.1.0 0.0.0.255 area 0
network 192.168.1.0 0.0.0.255 area 0
!
ip route 0.0.0.0 0.0.0.0 Dialer1 permanent
############################################################################
hostname Branch2
ip cef
!
ip name-server 202.106.0.20
ip ddns update method cisco
HTTP
add http://jackyan2:passwd@members.3322.org/dyndns/update?system=dyndns&hostname=<h>&myip=<a>&wildcard=ON&backmx=NO&offline=NO
remove http://jackyan2:passwd@members.3322.org/dyndns/update?system=dyndns&hostname=<h>&myip=<a>&wildcard=ON&backmx=NO&offline=NO
!
!
crypto isakmp policy 10 第一阶段策略
authentication pre-share 认证方式为预共享秘钥
crypto isakmp key cisco hostname jackyansite3.f3322.org 对端为这个域名时的进行认证的秘钥
!
crypto ipsec transform-set myset esp-des esp-md5-hmac 转换集，第二阶段加密和认证策略
crypto map mymap 10 ipsec-isakmp 用crypto map来关联第一二阶段的策略
set peer jackyansite3.f3322.org dynamic
set transform-set myset
match address *** 感兴趣流
!
interface Loopback0
ip address 3.3.3.3 255.255.255.0
!
interface Loopback100
description Inside.network
ip address 192.168.3.1 255.255.255.0
ip ospf network point-to-point
!
interface Tunnel0
ip address 172.16.1.3 255.255.255.0
ip mtu 1400
ip nhrp authentication cisco
ip nhrp map multicast 5.5.5.5
ip nhrp map 172.16.1.5 5.5.5.5
ip nhrp network-id 30599
ip nhrp nhs 172.16.1.5
ip nhrp cache non-authoritative
ip ospf network broadcast
ip ospf priority 0
tunnel source Loopback0
tunnel destination 5.5.5.5 tunnel mode 为点到点GRE
tunnel key 123
!
interface FastEthernet0/0
no ip address
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Dialer1
ip ddns update hostname jackyansite2.f3322.org
ip ddns update cisco
ip address negotiated
ip mtu 1490
encapsulation ppp
dialer pool 1
ppp authentication pap callin
ppp pap sent-username user2 password 0 cisco
crypto map mymap 运用crypto map到外部接口
!
router ospf 1
log-adjacency-changes
network 172.16.1.0 0.0.0.255 area 0
network 192.168.3.0 0.0.0.255 area 0
!
ip route 0.0.0.0 0.0.0.0 Dialer1 permanent
ip access-list extended ***
permit ip host 3.3.3.3 host 5.5.5.5
!
ip sla 1 用来触发IPsec，建立隧道
icmp-echo 5.5.5.5 source-ip 3.3.3.3
ip sla schedule 1 life forever start-time now
!
##########################################################################
hostname Center
!
aaa new-model 1.5阶段认证用aaa，这里用的是本地的AAA，可以用RADIUS
!
aaa authentication login noacs line none 线下保护（考场需要）
aaa authentication login ez*** local Ez***1.5阶段认证用的策略
aaa authorization network ez*** local Ez***的授权策略
!
!
aaa session-id common
ip cef
!
!
ip name-server 202.106.0.20
ip ddns update method cisco
HTTP
add http://jackyan3:passwd@members.3322.org/dyndns/update?system=dyndns&hostname=<h>&myip=<a>&wildcard=ON&backmx=NO&offline=NO
remove http://jackyan3:passwd@members.3322.org/dyndns/update?system=dyndns&hostname=<h>&myip=<a>&wildcard=ON&backmx=NO&offline=NO
!
! 本台设备有两种不同的***，建议使用isakmp profile来配置match > crypto keyring l2lkey
pre-shared-key address 0.0.0.0 0.0.0.0 key cisco 预共享秘钥，LAN-to-LAN需要
!
crypto isakmp policy 5 L2L的第一阶段策略
authentication pre-share
!
crypto isakmp policy 10 Ez***的第一阶段策略
authentication pre-share
group 2 必须group2
!
crypto isakmp client configuration group ez***group Ez*** 认证用的group
key cisco 和秘钥
pool pool1 认证成功后分配的地址
acl split.acl 隧道分割的acl，定义源自服务器端内网到客户内网的流量
save-password 用户可以保存密码，以便自动拨Ez***
crypto isakmp profile pro1 Ez***的认证和授权策略的profile
match> client authentication list ez***
isakmp authorization list ez***
client configuration address respond
crypto isakmp profile isapro1 LAN-to-LAN认证的profile
keyring l2lkey
match> !
crypto ipsec transform-set myset esp-des esp-md5-hmac 两种***共用一种加密策略，可以不同
!
crypto dynamic-map mymap 10 动态map来关联Ez***的策略
set transform-set myset
set isakmp-profile pro1
reverse-route
!
!
crypto map mymap 1 ipsec-isakmp 静态map关联LAN-to-LAN的策略，一般静态map优先
set peer jackyansite2.f3322.org dynamic
set transform-set myset
set isakmp-profile isapro1
match address ***
crypto map mymap 10 ipsec-isakmp dynamic mymap
!
username aaauser password 0 cisco 1.5阶段认证用的用户名和密码
!
interface Loopback0
ip address 5.5.5.5 255.255.255.0
!
interface Loopback100
ip address 192.168.5.1 255.255.255.0
ip ospf network point-to-point
!
interface Tunnel0
ip address 172.16.1.5 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp network-id 30599
ip nhrp cache non-authoritative
ip ospf network broadcast
ip ospf priority 100
tunnel source Loopback0
tunnel mode gre multipoint hub端的tunnel mode 为gre multipoint
tunnel key 123
!
interface FastEthernet0/0
no ip address
pppoe enable group global PPPoE配置
pppoe-client dial-pool-number 1
!
!
interface Dialer1 PPPoE配置
ip ddns update hostname jackyansite3.f3322.org
ip ddns update cisco
ip address negotiated
ip mtu 1490
encapsulation ppp
dialer pool 1
ppp authentication pap callin
ppp pap sent-username user3 password 0 cisco
crypto map mymap 运用map到接口
!
router ospf 1
log-adjacency-changes
network 172.16.1.0 0.0.0.255 area 0
network 192.168.5.0 0.0.0.255 area 0
!
ip local pool pool1 199.1.1.1 199.1.1.100 Ez***分配的地址
ip route 0.0.0.0 0.0.0.0 Dialer1 permanent
!
!
ip access-list extended split.acl 建立隧道用的地址
permit ip host 5.5.5.5 host 1.1.1.1
ip access-list extended ***
permit ip host 5.5.5.5 host 3.3.3.3
!
页:
[1]