URL: https://www.opennet.me/cgi-bin/openforum/vsluhboard.cgi
Форум: vsluhforumID6
Нить номер: 17874
[ Назад ]
Исходное сообщение
"lan-2-lan ipsec vpn gre"
Отправлено Riddle , 19-Дек-08 01:02 
всем привет. нужно настроит VPN по GRE IPSec. создал вот такой конфиг. но не заработало. что я делаю не так????


Router_A#show run
Building configuration...

Current configuration : 1720 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router_A
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$F0Gu$oh7B0lhKfpZ/l.pXRBpn1/
enable password cisco
!
aaa new-model
!
aaa session-id common
!
resource policy
!
ip cef
!
username cisco password 0 cisco
!
crypto isakmp policy 200
encr aes 256
authentication pre-share
group 2
lifetime 7200
crypto isakmp key sUpeRkEy address 10.10.10.2
!
crypto ipsec transform-set ts-aes-sha esp-aes 256 esp-sha-hmac
!
crypto map cr_outside 10 ipsec-isakmp
set peer 10.10.10.2
set transform-set ts-aes-sha
match address 110
!
interface Tunnel10
ip unnumbered FastEthernet0/0
tunnel source FastEthernet0/0
tunnel destination 10.10.10.2
!
interface FastEthernet0/0
ip address 10.10.11.2 255.255.255.0
shutdown
duplex half
crypto map cr_outside
!
interface Ethernet1/0
no ip address
shutdown
duplex half
!
interface Ethernet1/1
no ip address
shutdown
duplex half
!
interface Ethernet1/2
no ip address
shutdown
duplex half
!
interface Ethernet1/3
no ip address
shutdown
duplex half
!
interface Ethernet1/4
no ip address
shutdown
duplex half
!
interface Ethernet1/5
no ip address
shutdown
duplex half
!
interface Ethernet1/6
no ip address
shutdown
duplex half
!
interface Ethernet1/7
no ip address
shutdown
duplex half
!
ip route 192.168.2.0 255.255.255.0 Tunnel10
!
no ip http server
no ip http secure-server
!
access-list 110 permit gre host 10.10.11.2 host 10.10.10.2
!
control-plane
!
gatekeeper
shutdown
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
!
!
end

Router_A#


Router_B#sh run
Building configuration...

Current configuration : 1380 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router_B
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$W0W9$2iZ.O7haoFwJdZo4ro6YU/
enable password cisco
!
aaa new-model
!
aaa session-id common
!
resource policy
!
ip cef
!
username cisco password 0 cisco
!
crypto isakmp policy 200
encr aes 256
authentication pre-share
group 2
lifetime 7200
crypto isakmp key sUpeRkEy address 10.10.11.2
!
!
crypto ipsec transform-set ts-aes-sha esp-aes 256 esp-sha-hmac
!
crypto map cr_outside 10 ipsec-isakmp
set peer 10.10.11.2
set transform-set ts-aes-sha
match address 110
!
!
!
!
interface Tunnel10
ip unnumbered FastEthernet0/0
tunnel source FastEthernet0/0
tunnel destination 10.10.11.2
!
interface FastEthernet0/0
ip address 10.10.10.2 255.255.255.0
shutdown
duplex half
crypto map cr_outside
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/1
no ip address
shutdown
duplex auto
speed auto
!
ip route 192.168.1.0 255.255.255.0 Tunnel10
!
no ip http server
no ip http secure-server
!
!
access-list 110 permit gre host 10.10.10.2 host 10.10.11.2
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
!
!
end

Router_B#

Содержание
Сообщения в этом обсуждении
"lan-2-lan ipsec vpn gre"
Отправлено altuhov , 19-Дек-08 06:45 
А я вот так VPN-сервер сделал:
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
  protocol pptp
  virtual-template 1
!
interface Virtual-Template1
ip unnumbered Ethernet0
ip mroute-cache
peer default ip address pool DIAL-IN
ppp encrypt mppe auto
ppp authentication pap chap dialik
!
ip local pool DIAL-IN 192.168.1.100 192.168.1.110
"lan-2-lan ipsec vpn gre"
Отправлено Riddle , 19-Дек-08 10:16 
>[оверквотинг удален]
>  virtual-template 1
>!
>interface Virtual-Template1
> ip unnumbered Ethernet0
> ip mroute-cache
> peer default ip address pool DIAL-IN
> ppp encrypt mppe auto
> ppp authentication pap chap dialik
>!
>ip local pool DIAL-IN 192.168.1.100 192.168.1.110

a mne nujno mejdu dvumya cisco sdelat VPN po IPSec. ((((

"lan-2-lan ipsec vpn gre"
Отправлено Murzik , 19-Дек-08 12:49 
>[оверквотинг удален]
>Router_A#show run
>Building configuration...
>interface Tunnel10
>ip unnumbered FastEthernet0/0
>tunnel source FastEthernet0/0
>tunnel destination 10.10.10.2
>!
>interface FastEthernet0/0
>ip address 10.10.11.2 255.255.255.0
>shutdown

^^^^^^^^^^^^^
Это так и есть или просто описка!!!

>[оверквотинг удален]
>!
>!
>interface Tunnel10
>ip unnumbered FastEthernet0/0
>tunnel source FastEthernet0/0
>tunnel destination 10.10.11.2
>!
>interface FastEthernet0/0
>ip address 10.10.10.2 255.255.255.0
>shutdown

^^^^^^^^^^^^^
А Это?!!!!!
>[оверквотинг удален]
>line con 0
>stopbits 1
>line aux 0
>stopbits 1
>line vty 0 4
>!
>!
>end
>
>Router_B#

"lan-2-lan ipsec vpn gre"
Отправлено Riddle , 19-Дек-08 13:37 
>[оверквотинг удален]
>>line con 0
>>stopbits 1
>>line aux 0
>>stopbits 1
>>line vty 0 4
>>!
>>!
>>end
>>
>>Router_B#

Router_A#show run
Building configuration...

Current configuration : 1720 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router_A
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$F0Gu$oh7B0lhKfpZ/l.pXRBpn1/
enable password cisco
!
aaa new-model
!
aaa session-id common
!
resource policy
!
ip cef
!
username cisco password 0 cisco
!
crypto isakmp policy 200
encr aes 256
authentication pre-share
group 2
lifetime 7200
crypto isakmp key sUpeRkEy address 10.10.10.2
!
crypto ipsec transform-set ts-aes-sha esp-aes 256 esp-sha-hmac
!
crypto map cr_outside 10 ipsec-isakmp
set peer 10.10.10.2
set transform-set ts-aes-sha
match address 110
!
interface Tunnel10
ip unnumbered FastEthernet0/0
tunnel source FastEthernet0/0
tunnel destination 10.10.10.2
!
interface FastEthernet0/0
ip address 10.10.11.2 255.255.255.0
duplex half
crypto map cr_outside
!
interface Ethernet1/0
no ip address
duplex half
!
ip route 192.168.2.0 255.255.255.0 Tunnel10
!
no ip http server
no ip http secure-server
!
access-list 110 permit gre host 10.10.11.2 host 10.10.10.2
!
control-plane
!
gatekeeper
shutdown
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
!
!
end

Router_A#


Router_B#sh run
Building configuration...

Current configuration : 1380 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router_B
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$W0W9$2iZ.O7haoFwJdZo4ro6YU/
enable password cisco
!
aaa new-model
!
aaa session-id common
!
resource policy
!
ip cef
!
username cisco password 0 cisco
!
crypto isakmp policy 200
encr aes 256
authentication pre-share
group 2
lifetime 7200
crypto isakmp key sUpeRkEy address 10.10.11.2
!
crypto ipsec transform-set ts-aes-sha esp-aes 256 esp-sha-hmac
!
crypto map cr_outside 10 ipsec-isakmp
set peer 10.10.11.2
set transform-set ts-aes-sha
match address 110
!
interface Tunnel10
ip unnumbered FastEthernet0/0
tunnel source FastEthernet0/0
tunnel destination 10.10.11.2
!
interface FastEthernet0/0
ip address 10.10.10.2 255.255.255.0
duplex half
crypto map cr_outside
!
interface FastEthernet1/0
no ip address
duplex auto
speed auto
!
ip route 192.168.1.0 255.255.255.0 Tunnel10
!
no ip http server
no ip http secure-server
!
access-list 110 permit gre host 10.10.10.2 host 10.10.11.2
!
control-plane
!
gatekeeper
shutdown
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
!
end

Router_B#

а так правельно?
а что за проблема вот тут

line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
!
!

"lan-2-lan ipsec vpn gre"
Отправлено nm , 19-Дек-08 13:21 
советую прочитать и сделать по этой статье, в разы легче и масштабируемей, в будущем
http://www.cisco.com/en/US/technologies/tk583/tk372/technolo...
>[оверквотинг удален]
>line con 0
>stopbits 1
>line aux 0
>stopbits 1
>line vty 0 4
>!
>!
>end
>
>Router_B#