点对多点的VPN配置体验（欢迎指教）
如图：自己画了拓扑，有些乱。

[ 本帖最后由 冰雪寒 于 2006-6-9 13:44 编辑 ]

 


access-list 101 permit ip host 111.111.111.1 255.255.255.0 222.222.222.1 255.255.255.0
access-list 102 permit ip host 100.100.100.1 255.255.255.0 222.222.222.1 255.255.255.0

sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map newmap 20 ipsec-isakmp
crypto map newmap 20 match address 101
crypto map newmap 20 set peer 111.111.111.1
crypto map newmap 20 set transform-set myset

crypto map newmap 30 ipsec-isakmp
crypto map newmap 30 match address 102
crypto map newmap 30 set peer 100.100.100.1
crypto map newmap 30 set transform-set myset
crypto map newmap interface outside
isakmp enable outside
isakmp key ******** address 111.111.111.1 netmask 255.255.255.255
no-xauth no-config-mode
isakmp key ******** address 100.100.100.1 netmask 255.255.255.255
no-xauth no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
access-list 110 permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map newmap 10 ipsec-isakmp
crypto map newmap 10 match address 110
crypto map newmap 10 set peer 222.222.222.1
crypto map newmap 10 set transform-set myset
crypto map newmap interface outside
isakmp enable outside
isakmp key ******** address 222.222.222.1 netmask 255.255.255.255
no-xauth no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000

access-list 110 permit ip 10.10.10.0 255.255.255.0 192.168.1.0 255.255.255.0
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map newmap 10 ipsec-isakmp
crypto map newmap 10 match address 110
crypto map newmap 10 set peer 222.222.222.1
crypto map newmap 10 set transform-set myset
crypto map newmap interface outside
isakmp enable outside
isakmp key ******** address 222.222.222.1  netmask 255.255.255.255
no-xauth no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000
转载自冰雪寒的文章http://bbs.51cto.com/thread-20620-1-1.html