这是我第一次使用Cisco路由器。
下面提到的是我的configuration在哪里
Cisco Srv是Cisco 7200系列路由器XYZ是运行在Linux上的一个VPN服务器。 RAC是远程访问VPN客户端
| RAC | —–> | XYZ | ===== | 思科Srv |
The configuration for the Cisco Srv: no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption service internal ! hostname Cisco7200 ! aaa new-model ! ! aaa authorization network hw-client-groupname local aaa session-id common enable password cisco ! memory-size iomem 16 clock timezone - 0 6 ip subnet-zero no ip source-route ! ! ip domain-name cisco.com ! ip audit notify log ip audit po max-events 100 ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp client configuration address-pool local dynpool ! crypto isakmp client configuration group hw-client-groupname key hw-client-password dns 30.30.30.10 30.30.30.11 wins 30.30.30.12 30.30.30.13 domain cisco.com pool dynpool crypto isakm profile VPNclient description VPN clients profile match identity group hw-client-groupname isakmp authorization list hw-client-groupname client configuration address respond crypto ipsec transform-set transform-1 esp-3des esp-sha-hmac crypto dynamic-map vpnclient 1 set transform-set transform-1 set isakmp-profile VPNclient reverse-route ! crypto isakmp policy 10 encr aes 256 hash sha authentication pre-share group 2 crypto isakmp key somestrongkey address 0.0.0.0 0.0.0.0 crypto ipsec transform-set ts esp-aes 256 esp-sha-hmac ip access-list extended vpn deny ip 192.168.1.22 255.255.255.255 20.1.1.0 255.255.255.0 permit ip 192.168.1.22 255.255.255.225 any crypto dynamic-map vpndynamic 10 set transform-set ts match address vpn reverse-route crypto map dynmap 1 ipsec-isakmp dynamic vpnclient crypto map dynmap 10 ipsec-isakmp dynamic vpndynamic interface FastEthernet1/0 ip addr 192.168.1.22 255.255.255.0 no shutdown crypto map dynmap no cdp enable ! interface f1/1 description connected to HQ LAN ip address 30.30.30.1 255.255.255.0 no shutdown speed auto no cdp enable ! ip local pool dynpool 30.30.30.20 30.30.30.30 ip classless ip route 20.1.1.0 255.255.255.0 192.168.1.2 no ip http server ip pim bidir-enable ! ! no cdp run ! line con 0 line aux 0 line vty 0 4 password cisco ! end 我也可以在Cisco Srv和XYZ之间单独创buildCisco Srv和RAC之间的隧道。 但是，当思科Srv和XYZ之间的隧道build立后，我无法使用思科Srv的RAC创build隧道。
提前致谢。