一.测试拓扑：

222504399.jpg

二.基本配置：

A.R1
interface Loopback0
ip address 192.168.1.1 255.255.255.0
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.0
no shut
B.R2
interface Ethernet0/0
ip address 10.1.1.2 255.255.255.0
no shut  
interface Ethernet0/1
ip address 202.100.1.2 255.255.255.0
no shut
C.R3
interface FastEthernet0/0
ip address 202.100.1.3 255.255.255.0
no shut
interface FastEthernet0/1
ip address 202.100.2.3 255.255.255.0
no shut
D.R4
interface Ethernet0/0
ip address 20.1.1.4 255.255.255.0
no shut  

interface Ethernet0/2
ip address 30.1.1.4 255.255.255.0
no shut  
interface Ethernet0/1
ip address 202.100.2.4 255.255.255.0
no shut
E.R5
interface Loopback0
ip address 192.168.2.5 255.255.255.0
interface FastEthernet0/0
ip address 20.1.1.5 255.255.255.0
no shut

F.R6

interface Loopback0
ip address 192.168.3.6 255.255.255.0
interface FastEthernet0/0
ip address 30.1.1.6 255.255.255.0
no shut

三.静态路由和PAT配置：
A.静态路由配置：
①R1
 ip route 0.0.0.0 0.0.0.0 10.1.1.2
②R2
 ip route 0.0.0.0 0.0.0.0 202.100.1.3
 ip route 192.168.1.0 255.255.255.0 10.1.1.1
③R4
 ip route 0.0.0.0 0.0.0.0 202.100.2.3
 ip route 192.168.2.0 255.255.255.0 20.1.1.5

 ip route 192.168.3.0 255.255.255.0 30.1.1.6

④R5
 ip route 0.0.0.0 0.0.0.0 20.1.1.4

⑤R6
 ip route 0.0.0.0 0.0.0.0 30.1.1.4

B.动态PAT配置：
①R2
ip access-list extended 100
permit ip 192.168.1.0 0.0.0.255 any
permit ip 10.1.1.0 0.0.0.255 any
int e0/0
ip nat inside
int e0/1
ip nat outside
ip nat inside source list 100 interface e0/1
②R4
ip access-list extended 100
permit ip 192.168.2.0 0.0.0.255 any

permit ip 192.168.3.0 0.0.0.255 any
permit ip 20.1.1.0 0.0.0.255 any

permit ip 30.1.1.0 0.0.0.255 any

int e0/0
ip nat inside
int e0/1
ip nat outside
ip nat inside source list 100 interface e0/1
C.静态PAT配置：
R2
ip nat inside source static udp 10.1.1.1 500 interface e0/1 500
ip nat inside source static udp 10.1.1.1 4500 interface e0/1 4500

四.×××配置：
A.R1(HUB):
①第一阶段：
crypto keyring R4
pre-shared-key address 202.100.2.4 key cisco
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp profile isakmpprofile
  keyring R4
  match identity address 20.1.1.5

  match identity address 30.1.1.6

  virtual-template 1
---------isakmp profie中identity地址必须是真实地址，而不是NAT后地址
②第二阶段：
crypto ipsec transform-set transet esp-3des esp-sha-hmac
③ipsec profile关联第一阶段和第二阶段策略：
crypto ipsec profile ipsecprofile
set transform-set transet
set isakmp-profile isakmpprofile
④Dynamic VTI配置:
interface Loopback100
ip address 172.16.1.1 255.255.255.0
interface Virtual-Template1 type tunnel
ip unnumbered Loopback100
tunnel source FastEthernet0/0
tunnel mode ipsec ipv4
tunnel protection ipsec profile ipsecprofile
备注：不能在virtual-template接口直接配置IP地址。
B.R5(Spoke):
①第一阶段：
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 202.100.1.2
②第二阶段：
crypto ipsec transform-set transet esp-3des esp-sha-hmac
③ipsec profile关联第二阶段策略：
crypto ipsec profile ipsecprofile
set transform-set transet
④Static VTI配置:
interface Tunnel0
ip address 172.16.1.5 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 202.100.1.2
tunnel mode ipsec ipv4
tunnel protection ipsec profile ipsecprofile

C.R6(Spoke):
①第一阶段：
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 202.100.1.2
②第二阶段：
crypto ipsec transform-set transet esp-3des esp-sha-hmac
③ipsec profile关联第二阶段策略：
crypto ipsec profile ipsecprofile
set transform-set transet
④Static VTI配置:
interface Tunnel0
ip address 172.16.1.6 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 202.100.1.2
tunnel mode ipsec ipv4
tunnel protection ipsec profile ipsecprofile

C.动态路由配置：
①R1
router eigrp 10
network 172.16.1.0 0.0.0.255
network 192.168.1.0
no auto-summary
②R5
router eigrp 10
network 172.16.1.0 0.0.0.255
network 192.168.2.0
no auto-summary

③R6
router eigrp 10
network 172.16.1.0 0.0.0.255
network 192.168.3.0
no auto-summary

五.验证：

R1#show ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            10.1.1.1        YES manual up                    up      
FastEthernet0/1            unassigned      YES unset  administratively down down    
Virtual-Access1            unassigned      YES unset  down                  down    
Virtual-Template1          172.16.1.1      YES TFTP   down                  down    
Virtual-Access2            172.16.1.1      YES TFTP   up                    up      
Virtual-Access3            172.16.1.1      YES TFTP   up                    up      
Loopback0                  192.168.1.1     YES manual up                    up      
Loopback100                172.16.1.1      YES manual up                    up      
R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
10.1.1.1        202.100.2.4     QM_IDLE           1006    0 ACTIVE
10.1.1.1        202.100.2.4     QM_IDLE           1005    0 ACTIVE

R1#show crypto engine connections active
Crypto Engine Connections

  ID Interface  Type  Algorithm           Encrypt  Decrypt IP-Address
  11 Fa0/0      IPsec 3DES+SHA                  0      475 10.1.1.1
  12 Fa0/0      IPsec 3DES+SHA                491        0 10.1.1.1
  13 Fa0/0      IPsec 3DES+SHA                  0      242 10.1.1.1
  14 Fa0/0      IPsec 3DES+SHA                244        0 10.1.1.1
1005 Fa0/0      IKE   MD5+3DES                  0        0 10.1.1.1
1006 Fa0/0      IKE   MD5+3DES                  0        0 10.1.1.1