网络建设与运维神州数码DCN gre over ipsec路由与防火墙

配置步骤

1、底层互通
2、Tunnel口互通
3、配置IPsec
 

题目：
FW1与RT2之间用Internet互联地址建立GRE Over IPSec VPN，实现loopback2之间的加密访问。

FW1:

tunnel gre "GRE"
source 200.200.200.2
destination 200.200.200.6
interface ethernet0/3
interface tunnel1
tunnel gre "GRE"
ip route 0.0.0.0/0 200.200.200.1  (一般做完路由题是全网通的)

策略：

p1：

p2：

vpn对端：

ipsec：

interface tunnel1
next-tunnel ipsec ipsec

ip route 10.10.255.6/32 "tunnel1"

RT2:

crypto isakmp key 0 123456 address 200.200.200.2 255.255.255.255
crypto isakmp policy 1
authentication pre-share
encryption 3des
group 2
hash md5
lifetime 86400
!
crypto ipsec transform-set p2 esp-3des esp-md5-hmac
mode transport
!
crypto map vpn 1 ipsec-isakmp
match address vpn
set peer 200.200.200.2
set transform-set p2
!
interface Tunnel1
ip address 10.10.255.50 255.255.255.252
tunnel source 200.200.200.6
tunnel destination 200.200.200.2
!
interface GigaEthernet0/3
ip address 200.200.200.6 255.255.255.252
crypto map vpn
!
ip route default 200.200.200.5
ip route 10.10.255.7 255.255.255.255 Tunnel1
!
ip access-list extended vpn
permit gre 200.200.200.6 255.255.255.255 200.200.200.2 255.255.255.255