Здравствуйте,
настроил ipsec vpn между 2811 и 1841 по доке:
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
clock timezone EST 0
ip subnet-zero
no ip domain lookup
!
!
crypto isakmp policy 10
authentication pre-share
!
crypto isakmp key ciscokey address 200.1.1.1
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto map myvpn 10 ipsec-isakmp
set peer 200.1.1.1
set transform-set myset

!--- Include the private-network-to-private-network traffic
!--- in the encryption process:

match address 101
!
!
!
interface Ethernet0/0
ip address 172.16.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Ethernet1/0
ip address 100.1.1.1 255.255.255.0
ip nat outside
ip virtual-reassembly
crypto map myvpn
!
ip classless
ip route 0.0.0.0 0.0.0.0 100.1.1.254
!
ip http server
no ip http secure-server
!

!--- Except the private network from the NAT process:

ip nat inside source list 175 interface Ethernet1/0 overload
!

!--- Include the private-network-to-private-network traffic
!--- in the encryption process:

access-list 101 permit ip 172.16.1.0 0.0.0.255 10.1.1.0 0.0.0.255

!--- Except the private network from the NAT process:

access-list 175 deny   ip 172.16.1.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 175 permit ip 172.16.1.0 0.0.0.255 any
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
end

Тунель работает. Скажите пожалуйста, как теперь сюда добавить еще несколько тунелей с 1841?

• Ipsec с несколькими филиалами,karen, 11:50 , 17-Июн-10
  • Ipsec с несколькими филиалами,karen durinyan, 13:40 , 17-Июн-10
    • Ipsec с несколькими филиалами,walterwest7, 13:55 , 17-Июн-10

>[оверквотинг удален]
>line con 0
> exec-timeout 0 0
>line aux 0
>line vty 0 4
> login
>!
>end
>
>Тунель работает. Скажите пожалуйста, как теперь сюда добавить еще несколько тунелей с
>1841?

crypto isakmp key ciscokey address x.x.x.x
...
crypto isakmp key ciscokey address n.n.n.n
!
!
crypto map myvpn 10+x ipsec-isakmp
set peer x.x.x.x
set transform-set myset
!--- Include the private-network-to-private-network traffic
!--- in the encryption process:
match address 10x
!
!
crypto map myvpn 10+n ipsec-isakmp
set peer n.n.n.n
set transform-set myset
!--- Include the private-network-to-private-network traffic
!--- in the encryption process:
match address 10n
!
access-list 10x permit ip 172.16.1.0 0.0.0.255 10.x.1.0 0.0.0.255
...
access-list 10n permit ip 172.16.1.0 0.0.0.255 10.n.1.0 0.0.0.255

>[оверквотинг удален]
>crypto map myvpn 10+n ipsec-isakmp
> set peer n.n.n.n
> set transform-set myset
>!--- Include the private-network-to-private-network traffic
>!--- in the encryption process:
>match address 10n
>!
>access-list 10x permit ip 172.16.1.0 0.0.0.255 10.x.1.0 0.0.0.255
>...
>access-list 10n permit ip 172.16.1.0 0.0.0.255 10.n.1.0 0.0.0.255

and sure don't forget to exclude branch networks from the nat ACL
!
access-list 175 deny   ip 172.16.1.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 175 deny   ip 172.16.1.0 0.0.0.255 10.x.1.0 0.0.0.255
...
access-list 175 deny   ip 172.16.1.0 0.0.0.255 10.n.1.0 0.0.0.255
access-list 175 permit ip 172.16.1.0 0.0.0.255 any

Спасибo!