Najprostsza konfiguracja site 2 site GRE IPSEC VPN.
Konfiguracja R1
hostname R1
!
no ip domain lookup
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 14
lifetime 10000
crypto isakmp key cisco address 10.2.3.2
!
crypto ipsec transform-set TS esp-aes esp-sha-hmac
mode transport
!
crypto map CMAP 10 ipsec-isakmp
set peer 10.2.3.2
set transform-set TS
match address ACL1
!
interface Loopback1
ip address 1.1.1.1 255.255.0.0
!
interface Tunnel0
ip address 10.1.3.1 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 10.2.3.2
!
interface FastEthernet0/0
ip address 10.1.2.1 255.255.255.0
duplex half
crypto map CMAP
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.1.2.2
ip route 3.3.3.3 255.255.255.255 Tunnel0 10.1.3.3
no ip http server
no ip http secure-server
!
ip access-list extended ACL1
permit gre host 10.1.2.1 host 10.2.3.2
!
end
Konfiguracja R2
hostname R2
!
no ip domain lookup
!
interface FastEthernet0/0
ip address 10.1.2.2 255.255.255.0
duplex half
!
interface FastEthernet1/0
ip address 10.2.3.1 255.255.255.0
duplex auto
speed auto
!
router rip
version 2
network 10.0.0.0
no auto-summary
end
Konfiguracja R3
hostname R3
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 14
lifetime 10000
crypto isakmp key cisco address 10.1.2.1
!
crypto ipsec transform-set TS esp-aes esp-sha-hmac
mode transport
!
crypto ipsec profile P1
set transform-set TS
!
interface Loopback1
ip address 3.3.3.3 255.255.0.0
!
interface Tunnel0
ip address 10.1.3.3 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 10.1.2.1
tunnel protection ipsec profile P1
!
interface FastEthernet0/0
ip address 10.2.3.2 255.255.255.0
duplex half
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.2.3.1
ip route 1.1.1.1 255.255.255.255 Tunnel0 10.1.3.1
no ip http server
no ip http secure-server
!
end
Na routerze R1 skonfigurowana jest odchodząca już technologia kryptomap, a na routerze R3 profili IPSEC, które są obecnie najlepszą technologią. Zaleceniem dla dh group jest wybieranie powyżej 14 grupy.
Dodatkowo interfejs FastEthernet 0/0 dla R3 ma ip 10.2.3.2/24 na co należy zwrócić przy kopiowaniu konfiguracji.