Cisco配置举例
本例假设两端分别为广州和中山，两路由器之间简单用直接电缆连接，其地址分别假设如下表
广 州
中 山
内部网段网号
172．22．1．0
172．22．2．0
互连网段网号
168．1．1．0
167．1．1．0
路由器内部端口IP地址
172．22．1．100
172．22．2．100
路由器Internet端口IP地址
168．1．1．1
167．1．1．1
路由器串口IP地址
202．96．1．1
202．96．1．2
隧道端口IP地址
192．168．1．1
192．168．1．2
则两端路由器配置分别如下：
广州端路由器部分配置：
crypto isakmp policy 1 ;配置IKE 策略1
authentication pre-share ；IKE 策略1验证方法设为pre-share
group 2 ；1024-bit Diffie-Hellman，加密算法未设置则取缺省值：DES
crypto isakmp key test123 address 202.96.1.2 ；设置Pre-share密钥为test123,此值两端需一致
crypto ipsec transform-set VPNtag ah-md5-hmac esp-des ；设置AH散列算法为md5 ，
！ ESP加密算法为DES。
crypto map VPNdemo 10 ipsec-isakmp ；定义crypto map
set peer 202.96.1.2 ；设置隧道对端IP地址
set transform-set VPNtag ；设置隧道AH及ESP，
match address 101 ；
！
interface Tunnel0 ；定义隧道接口
ip address 192.168.1.1 255.255.255.0 ；隧道端口IP地址
no ip directed-broadcast
tunnel source 202.96.1.1 ;隧道源端地址
tunnel destination 202.96.1.2 ；隧道目的端地址
crypto map VPNdemo ；应用VPNdemo 于此接口
interface Serial0/0
ip address 202.96.1.1 255.255.255.252 ；串口的Internet IP地址
no ip directed-broadcast
crypto map VPNdemo ；应用VPNdemo 于串口
!
interface Ethernet0/1
ip address 168.1.1.1 255.255.255.0 ；外部端口IP地址
no ip directed-broadcast
interface Ethernet0/0
ip address 172.22.1.100 255.255.255.0 ； 内部端口IP地址
no ip directed-broadcast
!
ip classless
ip route 0.0.0.0 0.0.0.0 202.96.1.2 ；缺省路由
ip route 172.22.2.0 255.255.0.0 192.168.1.2 ；到中山端内网静态路由（经过隧道）
access-list 101 permit gre host 202.96.1.1 host 202.96.1.2 ；定义存取列表
中山端路由器部分配置：
crypto isakmp policy 1
authentication pre-share
group 2
crypto isakmp key test123 address 202.96.1.1
crypto ipsec transform-set VPNtag ah-md5-hmac esp-des
!
crypto map VPNdemo 10 ipsec-isakmp
set peer 202.96.1.1
set transform-set VPNtag
match address 101
！
interface Tunnel0
ip address 192.168.1.2 255.255.255.0
no ip directed-broadcast
tunnel source Serial0/0
tunnel destination 202.96.1.1
crypto map VPNdemo
interface Serial0/0
ip address 202.96.1.2 255.255.255.252
no ip directed-broadcast
crypto map VPNdemo
!
interface Ethernet0/1
ip address 167.1.1.1 255.255.255.0
no ip directed-broadcast
interface Ethernet0/0
ip address 172.22.2.100 255.255.255.0
no ip directed-broadcast
!
ip classless
ip route 0.0.0.0 0.0.0.0 202.96.1.1
ip route 172.22.1.0 255.255.0.0 192.168.1.1
access-list 101 permit gre host 202.96.1.2 host 202.96.1.1