主要是用在remote和site to site同时实施的情况,可以实现remote和site to site使用不同的密码.

R1

crypto isakmp policy 10

authentication pre-share

crypto keyring aaa

pre-shared-key address 202.102.1.2 key cisco

crypto isakmp profile bbb

keyring aaa

match identity address 202.102.1.2 255.255.255.255

!

!

crypto ipsec transform-set cisco esp-des esp-md5-hmac

!

!

crypto map cisco 10 ipsec-isakmp

set peer 202.102.1.2

set transform-set cisco

set isakmp-profile bbb

match address 100

!

!

interface Loopback0

ip address 1.1.1.1 255.255.255.0

!

!

!

interface Serial1/1

ip address 202.102.1.1 255.255.255.0

serial restart-delay 0

crypto map cisco

!

ip route 0.0.0.0 0.0.0.0 202.102.1.2

access-list 100 permit ip host 1.1.1.1 host 2.2.2.2

R2

crypto keyring aaa

pre-shared-key address 202.102.1.1 key cisco

!

crypto isakmp policy 1

authentication pre-share

crypto isakmp profile bbb

keyring aaa

match identity address 202.102.1.1 255.255.255.255

!

!

crypto ipsec transform-set cisco esp-des esp-md5-hmac

!

crypto map cisco 10 ipsec-isakmp

set peer 202.102.1.1

set transform-set cisco

set isakmp-profile bbb

match address 100

!

!

!

!

!

interface Loopback0

ip address 2.2.2.2 255.255.255.0

!

!

interface Serial1/0

ip address 202.102.1.2 255.255.255.0

serial restart-delay 0

crypto map cisco

!

ip route 0.0.0.0 0.0.0.0 202.102.1.1

access-list 100 permit ip host 2.2.2.2 host 1.1.1.1

只有这个版本支持:

r1#show version

Cisco IOS Software, 7200 Software (C7200-ADVSECURITYK9-M), Version 12.4(20)T1, R

ELEASE SOFTWARE (fc3)

r2#ping 1.1.1.1 source 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:

Packet sent with a source address of 2.2.2.2

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 108/126/160 m

r2#show crypto ipsec sa

interface: FastEthernet0/0

Crypto map tag: cisco, local addr 202.102.1.2

protected vrf: (none)

local  ident (addr/mask/prot/port): (2.2.2.2/255.255.255.255/0/0)

remote ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/0/0)

current_peer 202.102.1.1 port 500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9

#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 1, #recv errors 0

local crypto endpt.: 202.102.1.2, remote crypto endpt.: 202.102.1.1

path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

current outbound spi: 0x9C76746(164063046)