以下介绍了使用 Cisco IOS 执行的配置。

过程

  1. 配置界面和默认路由
    interface GigabitEthernet0/0
    ip address 10.24.120.90 255.255.252.0
    duplex auto
    speed auto
    crypto map MYVPN
    !
    interface GigabitEthernet0/1
    ip address 172.16.0.1 255.255.0.0
    duplex auto
    speed auto
    !
    ip route 0.0.0.0 0.0.0.0 10.24.123.253
  2. 配置 IKE 策略
    Router# config term
    Router(config)# crypto isakmp policy 1
    Router(config-isakmp)# encryption 3des
    Router(config-isakmp)# group 2
    Router(config-isakmp)# hash sha
    Router(config-isakmp)# lifetime 28800
    Router(config-isakmp)# authentication 
         pre-share
    Router(config-isakmp)# exit
  3. 将每个对等设备与其预共享密钥进行匹配
    Router# config term
    Router(config)# crypto isakmp key vshield 
        address 10.115.199.103
    Router(config-isakmp)# exit
  4. 定义 IPSEC 转换
    Router# config term
    Router(config)# crypto ipsec transform-set 
         myset esp-3des esp-sha-hmac
    Router(config-isakmp)# exit
  5. 创建 IPSEC 访问列表
    Router# config term
    Enter configuration commands, one per line.  
         End with CNTL/Z.
    Router(config)# access-list 101 permit ip 
         172.16.0.0 0.0.255.255 192.168.5.0 0.0.0.255
    Router(config)# exit
  6. 将策略与加密映射绑定并对其进行标记
    在下例中,该加密映射标记为 MYVPN
    Router# config term
    Router(config)# crypto map MYVPN 1 
          ipsec-isakmp
    % NOTE: This new crypto map will remain 
          disabled until a peer and a valid 
          access list have been configured.
    Router(config-crypto-map)# set transform-set 
          myset
    Router(config-crypto-map)# set pfs group1
    Router(config-crypto-map)# set peer 
          10.115.199.103
    Router(config-crypto-map)# match address 101
    Router(config-crypto-map)# exit

示例: 配置

router2821#show running-config output
Building configuration...

Current configuration : 1263 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router2821
!
boot-start-marker
boot-end-marker
!
! card type command needed for slot 0
! card type command needed for slot 1
enable password cisco
!
no aaa new-model
!
resource policy
!
ip subnet-zero
!
ip cef
!no ip dhcp use vrf connected
!
!
no ip ips deny-action ips-interface
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key vshield address 10.115.199.103
!
crypto ipsec transform-set myset esp-3des 
      esp-sha-hmac
!
crypto map MYVPN 1 ipsec-isakmp
set peer 10.115.199.103
set transform-set myset
set pfs group1
match address 101
!
interface GigabitEthernet0/0
ip address 10.24.120.90 255.255.252.0
duplex auto
speed auto
crypto map MYVPN
!
interface GigabitEthernet0/1
ip address 172.16.0.1 255.255.0.0
duplex auto
speed auto
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.24.123.253
!
ip http server
no ip http secure-server
!
access-list 101 permit ip 172.16.0.0 
       0.0.255.255 192.168.5.0 0.0.0.255
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password cisco
login
line vty 5 15
password cisco
login
!
scheduler allocate 20000 1000
!
end