liuzheng.pro的博客

DMVPN

热12已有 597 次阅读 2010-04-16 16:30 标签: DMVPN

呵呵多谢小雅贝贝兄还惦记着我，温暖~

前段一个DMVPN，现成配置摘下来分享下吧

没有其他特殊需求，就是正常的DMVPN+remote VPN

aaa认证里，AAA这个是给remote VPN的，将来添加radius用。

客户的私网地址有点乱，大致是总部从10.100.0.0到10.100.19.0，每个分支都有20个/24的网段，192.168.100.0是tunnel地址。相关公网地址隐掉了，分支只写了一个，其他的基本一样变变地址就好了

总部

CentreRouter#sh run
Building configuration...

Current configuration : 3525 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CentreRouter
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$BobG$77XBLWV8UgpDURdqwJKlb1
!
aaa new-model
!
!
aaa authentication login AAA local
aaa authentication login GSSNET local
aaa authorization network AUTHOR local
!
!
aaa session-id common
!
!
dot11 syslog
!
!
ip cef
!
!
no ip domain lookup
ip domain name cisco.com
!
multilink bundle-name authenticated
!
voice-card 0
no dspfarm
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
username cisco secret 5 $1$6tpj$H73Pb96jLiPlrc6DLGJ2F/

!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key * address 0.0.0.0 0.0.0.0
!
crypto isakmp client configuration group VPNGROUP
key *
pool POOL
acl vpn
netmask 255.255.255.0
crypto isakmp profile remote
   match identity group VPNGROUP
   client authentication list AAA
   isakmp authorization list AUTHOR
   client configuration address respond
!
!
crypto ipsec transform-set tran esp-des esp-md5-hmac
!
crypto ipsec profile PROFILE
set transform-set tran
!
!
crypto dynamic-map dy 10
set transform-set tran
set isakmp-profile remote
reverse-route
!
!
crypto map map 10 ipsec-isakmp dynamic dy
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Tunnel0
ip address 192.168.100.254 255.255.255.0
no ip redirects
ip mtu 1440
no ip next-hop-self eigrp 10
ip nhrp map multicast dynamic
ip nhrp network-id 10
no ip split-horizon eigrp 10
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel protection ipsec profile PROFILE
!
interface GigabitEthernet0/0
ip address * 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
crypto map map
!
interface GigabitEthernet0/1
ip address 10.100.0.3 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
!
router eigrp 10
redistribute static metric 10000 100 255 1 1440
network 10.100.0.0 0.0.0.255

network 192.168.100.0
no auto-summary
!
ip local pool POOL 10.100.240.1 10.100.240.254
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 *
ip route 10.100.0.0 255.255.240.0 10.100.0.1
ip route 10.100.16.0 255.255.252.0 10.100.0.1
!
!
ip http server
no ip http secure-server
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip nat inside source static 10.100.0.40 *
ip nat inside source static 10.100.0.41 *
ip nat inside source static 10.100.0.42 *
ip nat inside source static 10.100.0.43 *
ip nat inside source static 10.100.0.44 *
ip nat inside source static 10.100.0.45 *
ip nat inside source static 10.100.0.31 *
!
ip access-list extended NAT
permit ip 10.100.0.0 0.0.15.255 any
permit ip 10.100.16.0 0.0.3.255 any
ip access-list extended vpn
permit ip 10.100.0.0 0.0.15.255 10.100.240.0 0.0.0.255
permit ip 10.100.16.0 0.0.3.255 10.100.240.0 0.0.0.255
!
!
!
!
!
!

!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
login authentication GSSNET
transport input ssh
!
scheduler allocate 20000 1000
!
end

分支1

BranchRouter1(config-line)#do wri
Building configuration...

[OK]
BranchRouter1(config-line)# do sh run
Building configuration...

Current configuration : 2044 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname BranchRouter1
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$UUcO$7tbqgrJZPqeTArRF3fEmU.
!
no aaa new-model
!
!
dot11 syslog
!
!
ip cef
!
!
no ip domain lookup
ip domain name cisco.com
!
multilink bundle-name authenticated
!
!
voice-card 0
no dspfarm
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
username cisco password *
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key * address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set tran esp-des esp-md5-hmac
!
crypto ipsec profile PROFILE
set transform-set tran
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Tunnel0
ip address 192.168.100.20 255.255.255.0
no ip redirects
ip mtu 1440
ip nhrp map multicast dynamic
ip nhrp map 192.168.100.254（总部TUNNEL地址） *（总部公网地址）
ip nhrp map multicast *（总部公网地址）
ip nhrp network-id 10
ip nhrp nhs 192.168.100.254
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel protection ipsec profile PROFILE
!
interface FastEthernet0/0
ip address * 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 10.100.20.1 255.255.255.128
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
router eigrp 10
redistribute static metric 10000 100 255 1 1440
network 10.100.20.0 0.0.0.127
network 192.168.100.0
no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 *
ip route 10.100.20.0 255.255.252.0 10.100.20.2
ip route 10.100.24.0 255.255.248.0 10.100.20.2
ip route 10.100.32.0 255.255.248.0 10.100.20.2
!
!
ip http server
no ip http secure-server
ip nat inside source list NAT interface FastEthernet0/0 overload
!
ip access-list extended NAT
permit ip 10.100.20.0 0.0.3.255 any
permit ip 10.100.24.0 0.0.7.255 any
permit ip 10.100.32.0 0.0.7.255 any
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end

分享举报