>>есть два провайдера. на cisco 2851 реализовано два DMVPN туннеля к филиалам.
>>требуется добавить на какой то из внешних интерфейсов vpn server.
>>может быть кто то сталкивался с такой же проблемой?
>
>cisco 2851 - сконфигурирована как hub или как spoke ?
>если как hub - то как удалось получить 2-а DMVPN туннеля ?
>2851 - hub. делалось так:
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname c
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$tSzn$C73QmfkVzq1kaQqF17EiS/
!
no aaa new-model
!
resource policy
!
ip subnet-zero
!
!
ip cef
ip inspect max-incomplete high 2000
ip inspect max-incomplete low 1000
ip inspect one-minute high 600
ip inspect name IPFW tcp
ip inspect name IPFW udp
!
!
ip ips signature 2000 0 disable
ip ips signature 2001 0 disable
ip ips signature 2004 0 disable
ip ips signature 2005 0 disable
ip ips signature 4050 0 disable
ip ips name AUDIT
ip domain name domain.ru
ip sla monitor 1
type pathEcho protocol ipIcmpEcho x.x.x.33 source-ipaddr x.x.x.44
frequency 20
ip sla monitor schedule 1 life forever start-time now
ip sla monitor 2
type pathEcho protocol ipIcmpEcho y.y.y.169 source-ipaddr y.y.y.171
frequency 20
ip sla monitor schedule 2 life forever start-time now
!
!
!
!
username xxx secret 5 $1$nXTb$e5GH.xqpKcod6pBEgUbIw.
!
!
track 1 rtr 1 reachability
!
track 2 rtr 2 reachability
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key ************* address 0.0.0.0 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set AES_SHA esp-aes 256 esp-sha-hmac
mode transport
!
crypto ipsec profile FILIAL
set transform-set AES_SHA
!
!
!
!
interface Tunnel0
description TO_FILIAL_CORBINA
bandwidth 8000
ip address 172.30.255.254 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication MyGRE
ip nhrp map multicast dynamic
ip nhrp network-id 1
ip nhrp holdtime 300
ip nhrp cache non-authoritative
ip tcp adjust-mss 1360
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
tunnel key zzz
tunnel protection ipsec profile FILIAL
!
interface Tunnel1
description TO_FILIAL_COMSTAR
bandwidth 256
ip address 172.31.255.254 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp map multicast dynamic
ip nhrp network-id 2
ip nhrp cache non-authoritative
ip tcp adjust-mss 1360
no ip split-horizon eigrp 65534
tunnel source Vlan2
tunnel mode gre multipoint
tunnel key aaa
tunnel protection ipsec profile FILIAL
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
description INTERNET_Corbina
ip address x.x.x.44 255.255.255.240
ip access-group FROM_INET in
ip inspect IPFW out
ip ips AUDIT in
ip ips AUDIT out
ip tcp adjust-mss 1380
duplex auto
speed auto
no cdp enable
!
interface FastEthernet0/1/0
description INTERNET_Comstar
switchport access vlan 2
no cdp enable
!
interface FastEthernet0/1/1
description LAN
!
interface FastEthernet0/1/2
!
interface FastEthernet0/1/3
!
interface Vlan1
description LAN
ip address z.z.z.32 255.255.0.0
ip policy route-map RM
!
interface Vlan2
description INTERNET_Comstar
ip address y.y.y.171 255.255.255.248
ip access-group FROM_INET_2 in
ip tcp adjust-mss 1380
!
router eigrp 65534
variance 2
passive-interface Vlan1
network z.z.0.0
network 172.30.255.0 0.0.0.255
network 172.31.255.0 0.0.0.255
no auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 x.x.x.33 track 1
ip route 0.0.0.0 0.0.0.0 y.y.y.169 2 track 2
!
ip http server
no ip http secure-server
!
ip access-list extended FROM_INET
permit icmp any host x.x.x.44
permit gre any host x.x.x.44
permit esp any host x.x.x.44
permit udp any host x.x.x..44 eq isakmp
permit udp any host x.x.x.44 eq non500-isakmp
permit tcp any host x.x.x.44 eq 22
permit tcp any host x.x.x.44 established
deny ip any any log
ip access-list extended FROM_INET_2
permit icmp any host y.y.y.171
permit gre any host y.y.y.171
permit esp any host y.y.y.171
permit udp any host y.y.y.171 eq isakmp
permit tcp any host y.y.y.171 eq 22
permit tcp any host y.y.y.171 established
deny ip any any log
ip access-list extended TO_FILIAL
permit ip z.z.0.0 0.0.255.255 192.168.0.0 0.0.255.255
ip access-list extended TO_INET
deny ip z.z.0.0 0.0.255.255 192.168.0.0 0.0.255.255
permit ip z.z.0.0 0.0.255.255 any
!
route-map RM permit 10
match ip address TO_FILIAL
!
route-map RM permit 20
match ip address TO_INET
set ip next-hop verify-availability z.z.z.111 1 track 1
set ip next-hop verify-availability z.z.z.11 2 track 2
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
login local
!
scheduler allocate 20000 1000
!
end
Вариант для распечатки
Маршрутизаторы CISCO и др. оборудование. (Public)
(??) on 11-Сен-07, 16:54 
