网上找的不知可以用不:
PPPOE加NAT,里面还有静态 默认路由,IPSEC vpn等等,这个你出去调试还是经常会用到了,希望你喜欢!
RI
R1#sh run
Building configuration...
Current configuration : 1535 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
ip cef
!
!
no ip domain lookup
!
ip audit po max-events 100
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10 策略
hash md5
authentication pre-share 验证
group 2
crypto isakmp key cisco address 23.1.1.2 配置钥匙
!
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac ipsec组件 的设置
!
crypto map cisco 10 ipsec-isakmp map把上面的所有策略集合起来
set peer 23.1.1.2
set transform-set cisco
match address 100
!
!
!
!
interface Loopback0
description ---to vpn---
ip address 192.168.2.1 255.255.255.0
ip nat inside
!
interface Loopback1
description ---to internet---
ip address 192.168.4.1 255.255.255.0
ip nat inside
!
interface Ethernet0/0
no ip address
shutdown
half-duplex
!
interface Serial0/0
no ip address
shutdown
!
interface Ethernet0/1
ip address 12.1.1.1 255.255.255.0
ip nat outside
half-duplex
crypto map cisco 在接口上用MAP
!
interface Serial0/1
no ip address
shutdown
!
ip nat pool cisco 12.1.1.3 12.1.1.10 netmask 255.255.255.0
ip nat inside source list 101 pool cisco overload
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 12.1.1.2
!
!
access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 deny udp any eq isakmp any eq isakmp 拒绝所有源到目的含有isakmp 数据包
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255 拒绝所有2.0到3.0的ip数据包
access-list 101 permit ip any any
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
R2
R2#sh run
Building configuration...
Current configuration : 752 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
ip cef
!
!
no ip domain lookup
!
ip audit po max-events 100
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
description ----internet web---
ip address 202.1.1.1 255.255.255.0
!
interface Ethernet0/0
ip address 23.1.1.1 255.255.255.0
half-duplex
!
interface Serial0/0
no ip address
shutdown
!
interface Ethernet0/1
ip address 12.1.1.2 255.255.255.0
half-duplex
!
interface Serial0/1
no ip address
shutdown
!
no ip http server
no ip http secure-server
ip classless
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
R4
R4#sh run
Building configuration...
Current configuration : 1485 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
ip cef
!
!
!
ip audit po max-events 100
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 12.1.1.1
!
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 12.1.1.1
set transform-set cisco
match address 100
!
!
!
!
interface Loopback0
description ---to vpn---
ip address 192.168.3.1 255.255.255.0
ip nat inside
!
interface Loopback1
ip address 192.168.10.1 255.255.255.0
ip nat inside
!
interface Ethernet0/0
ip address 23.1.1.2 255.255.255.0
ip nat outside
half-duplex
crypto map cisco
!
interface Serial0/0
no ip address
shutdown
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Serial0/1
no ip address
shutdown
!
ip nat pool cisco 23.1.1.3 23.1.1.10 netmask 255.255.255.0
ip nat inside source list 101 pool cisco overload
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 23.1.1.1
!
!
access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny udp any eq isakmp any eq isakmp
access-list 101 deny ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 permit ip any any
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end
楼主的提问好像没有经过思考过,问了跟没问一样,呵呵