首先要打通GRE通道：
具體見本人文章：[eNSP]建立GRE通道
然后：
2、創建IKE提議
[AR 1]ike proposal 1 # 創建IKE提議
[AR 1-ike-proposal-1]encryption-algorithm 3des-cbc # 指定加密演算法
[AR 1-ike-proposal-1]authentication-algorithm md5 # 認證演算法
[AR 3]ike proposal 1 # 創建IKE提議
[AR 3-ike-proposal-1]encryption-algorithm 3des-cbc # 指定加密演算法
[AR 3-ike-proposal-1]authentication-algorithm md5 # 認證演算法
3、配置IKE對等體
[AR 1]ike peer number v2 # 創建number的對等體
[AR 1-ike-peer-numberone]pre-shared-key simple 5201314 # 共享密鑰
[AR 1-ike-peer-numberone]ike-proposal 1
[AR 3]ike peer number v2 # 創建number的對等體
[AR 3-ike-peer-numberone]pre-shared-key simple 5201314 # 共享密鑰
[AR 3-ike-peer-numberone]ike-proposal 1
4、配置IPSec提議
[AR 1]ipsec proposal 1
[AR 1-ipsec-proposal-1]esp encryption-algorithm 3des # esp的加密演算法
[AR 3]ipsec proposal 1
[AR 3-ipsec-proposal-1]esp encryption-algorithm 3des # esp的加密演算法
5、配置IPSec檔案
[AR 1]ipsec profile gre
[AR 1-ipsec-profile-gre]ike-peer number
[AR 1-ipsec-profile-gre]proposal 1
[AR 3]ipsec profile gre
[AR 3-ipsec-profile-gre]ike-peer number
[AR 3-ipsec-profile-gre]proposal 1
6、對GRE隧道進行保護
[AR 1]interface Tunnel 0/0/0
[AR 1-Tunnel0/0/0]description XXXXX # XXXXX可以自定義
[AR 1-Tunnel0/0/0]tunnel-protocol gre
[AR 1-Tunnel0/0/0]source 200.1.1.1
[AR 1-Tunnel0/0/0]destination 200.2.2.2
[AR 1-Tunnel0/0/0]ipsec profile gre # 對GRE隧道進行保護
[AR 3]interface Tunnel 0/0/0
[AR 3-Tunnel0/0/0]description XXXXX
[AR 3-Tunnel0/0/0]tunnel-protocol gre
[AR 3-Tunnel0/0/0]source 200.2.2.2
[AR 3-Tunnel0/0/0]destination 200.1.1.1
[AR 3-Tunnel0/0/0]ipsec profile gre # 對GRE隧道進行保護
最后用PC1去pingPC2的抓包效果圖：
但是PC1的命令列顯示時這樣的：
命令列顯示的是“Request timeout !”是正常現象，抓包可以抓到ISAKMP
轉載請註明出處，本文鏈接：https://www.uj5u.com/qukuanlian/273788.html
標籤：區塊鏈