Site-to-site IPSec VPN 設定範例 (pt-ipsec.pkt), Packet Tracer 5.2版

Packet Tracer 5.2版 Site-to-site IPSec VPN 設定範例檔 (pt-ipsec.pkt)



摘要步驟如下: (以圖中的 IPSec-A 設定為例子)

1. 定義 "封包保護套餐" (Transform Sets)

!
crypto ipsec transform-set MOSTSECURE esp-aes 256 esp-sha-hmac
!

2. 定義 "封包保護機制腳本" (IPSec Crypto Map)

!
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
!
crypto map PT-IPSEC 1000 ipsec-isakmp 
 description Packet Tracer IPSEC Test Crypto Map
 set peer 172.16.2.1
 set pfs group5
 set security-association lifetime seconds 120
 set transform-set MOSTSECURE 
 match address 100
!

3. 定義 "VPN閘道器間交談過程" 的保護加密機制 (ISAKMP policy)

!
crypto isakmp policy 100
 encr aes 256
 authentication pre-share
 group 5
 lifetime 60
!

4. 定義身分認證專用金鑰 (ISAKMP Pre-share key)

!
crypto isakmp key samekey address 172.16.2.1
!

5. 啟用 "封包保護機制腳本" 在網路卡上

!
interface Serial0/0/0
 ip address 172.16.1.1 255.255.255.252
 crypto map PT-IPSEC
!