1.拓扑图：

2.基本接口配置：

A.R1:

R1(config)#int f0/0

R1(config-if)#ip add 202.100.12.1 255.255.255.0R1(config-if)#no shR1(config-if)#int l0R1(config-if)#ip add 172.16.1.1 255.255.255.0R1(config-if)#int l1R1(config-if)#ip add 192.168.1.1 255.255.255.0

B.R2:

R2(config)#int f0/0

R2(config-if)#ip add 202.100.12.2 255.255.255.0R2(config-if)#no shR2(config-if)#int f0/1R2(config-if)#ip add 202.100.23.2 255.255.255.0R2(config-if)#no shR2(config-if)#int f1/0R2(config-if)#ip add 202.100.24.2 255.255.255.0R2(config-if)#no sh

C.R3:

R3(config)#int f0/0

R3(config-if)#ip add 202.100.23.3 255.255.255.0R3(config-if)#no shR3(config-if)#int l0R3(config-if)#ip add 172.16.1.3 255.255.255.0R3(config-if)#int l1R3(config-if)#ip add 192.168.3.3 255.255.255.0

D.R4:

R4(config)#int f1/0

R4(config-if)#ip add 202.100.24.4 255.255.255.0 R4(config-if)#no shR4(config-if)#int l0R4(config-if)#ip add 172.16.1.4 255.255.255.0R4(config-if)#int l1R4(config-if)#ip add 192.168.4.4 255.255.255.0

3.静态路由配置

R1(config)#ip route 0.0.0.0 0.0.0.0 202.100.12.2

R3(config)#ip route 0.0.0.0 0.0.0.0 202.100.23.2

R4(config)#ip route 0.0.0.0 0.0.0.0 202.100.24.2

4.动态VTI配置：

A.HUB:

①第一阶段：

R1(config)#crypto isakmp policy 10

R1(config-isakmp)#au preR1(config-isakmp)#ha mdR1(config-isakmp)#en 3desR1(config-isakmp)#gr 2R1(config-isakmp)#exit

R1(config)#crypto keyring R1

R1(conf-keyring)#pre-shared-key address 202.100.23.3 key ciscoR1(conf-keyring)#pre-shared-key address 202.100.24.4 key cisco

R1(config)#crypto isakmp profile isakmppro

R1(conf-isa-prof)#keyring R1R1(conf-isa-prof)#match identity address 202.100.23.3 R1(conf-isa-prof)#match identity address 202.100.24.4R1(conf-isa-prof)#virtual-template 1

②第二阶段：

R1(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac

③ipsec profile关联第一阶段和第二阶段策略：

R1(config)#crypto ipsec profile ipsecpro  

R1(ipsec-profile)#set isakmp-profile isakmpproR1(ipsec-profile)#set transform-set transet

④VTI配置

R1(config)#int virtual-template 1 type tunnel

R1(config-if)#ip unnumbered loopback 0R1(config-if)#tunnel mode ipsec ipv4

R1(config-if)#tunnel protection ipsec profile ipsecpro

B.Spoke1:

①第一阶段：

R3(config)#crypto isakmp policy 10

R3(config-isakmp)#au prR3(config-isakmp)#en 3desR3(config-isakmp)#gr 2R3(config-isakmp)#ha mdR3(config-isakmp)#exitR3(config)#crypto isakmp key 0 cisco address 202.100.12.1

②第二阶段：

R3(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac

③ipsec profile关联第二阶段策略：

R3(config)#crypto ipsec profile ipsecpro

R3(ipsec-profile)#set transform-set transet

R3(ipsec-profile)#exit

④VTI配置

R3(config)#int tunnel 0

R3(config-if)#ip unnumbered loopback 0R3(config-if)#tunnel source f0/0

R3(config-if)#tunnel destination 202.100.1.1

R3(config-if)#tunnel mode ipsec ipv4

R3(config-if)#tunnel protection ipsec profile ipsecpro

R3(config-if)#exit

C.Spoke2:

①第一阶段：

R4(config)#crypto isakmp policy 10

R4(config-isakmp)#au prR4(config-isakmp)#au pre-share R4(config-isakmp)#ha mdR4(config-isakmp)#en 3deR4(config-isakmp)#gr 2R4(config-isakmp)#exitR4(config)#crypto isakmp key 0 cisco address 202.100.12.1

②第二阶段：

R4(config)#crypto ipsec transform-set transet esp-3des esp-sha-hmac

R4(cfg-crypto-trans)#exit

③ipsec profile关联第二阶段策略：

R4(config)#crypto ipsec profile ipsecpro

R4(ipsec-profile)#set transform-set transet

R4(ipsec-profile)#exit

④VTI配置

R4(config-if)#int tun 0

R4(config-if)#ip unnumbered loopback 0R4(config-if)#tunnel source f1/0

R4(config-if)#tunnel destination 202.100.12.1

R4(config-if)#tunnel mode ipsec ipv4

R4(config-if)#tunnel protection ipsec profile ipsecpro

5.动态路由配置：

R1(config)#router eigrp 10

R1(config-router)#no auto-summary R1(config-router)#net 172.16.1.0 0.0.0.255R1(config-router)#net 192.168.1.0 0.0.0.255

R3(config)#router eigrp 10

R3(config-router)#no auto-summary R3(config-router)#net 172.16.1.0 0.0.0.255R3(config-router)#net 192.168.3.0 0.0.0.255

R4(config)#router eigrp 10

R4(config-router)#no auto-summary

R4(config-router)#net 172.16.1.0 0.0.0.255

R4(config-router)#net 192.168.4.0 0.0.0.255

6.验证：

R1#show ip int brief

Interface                  IP-Address      OK? Method Status                ProtocolFastEthernet0/0            202.100.12.1    YES NVRAM  up                    up      FastEthernet0/1            unassigned      YES NVRAM  administratively down down    Virtual-Access1            unassigned      YES unset  down                  down    Virtual-Template1          172.16.1.1      YES TFTP   down                  down    Virtual-Access2            172.16.1.1      YES TFTP   up                    up      Virtual-Access3            172.16.1.1      YES TFTP   up                    up      Loopback0                  172.16.1.1      YES manual up                    up      Loopback1                  192.168.1.1     YES manual up                    up  

R1#show crypto isakmp sa

IPv4 Crypto ISAKMP SAdst             src             state          conn-id slot status202.100.12.1    202.100.23.3    QM_IDLE           1001    0 ACTIVE202.100.12.1    202.100.24.4    QM_IDLE           1002    0 ACTIVE

R1#show crypto engine connections active

Crypto Engine Connections   ID Interface  Type  Algorithm           Encrypt  Decrypt IP-Address    1 Fa0/0      IPsec 3DES+SHA                  0      422 202.100.12.1    2 Fa0/0      IPsec 3DES+SHA                426        0 202.100.12.1    5 Fa0/0      IPsec 3DES+SHA                  0      103 202.100.12.1    6 Fa0/0      IPsec 3DES+SHA                205        0 202.100.12.1 1001 Fa0/0      IKE   MD5+3DES                  0        0 202.100.12.1 1002 Fa0/0      IKE   MD5+3DES                  0        0 202.100.12.1

R1#ping 192.168.3.3 source 192.168.1.1

Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.3.3, timeout is 2 seconds:Packet sent with a source address of 192.168.1.1 !!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 84/116/136 ms

R1#ping 192.168.4.4 source 192.168.1.1

Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.4.4, timeout is 2 seconds:Packet sent with a source address of 192.168.1.1 !!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 88/105/128 ms

R1#show ip route eigrp

D    192.168.4.0/24 [90/297372416] via 172.16.1.4, 00:13:59, Virtual-Access3D    192.168.3.0/24 [90/297372416] via 172.16.1.3, 00:14:50, Virtual-Access2

R3#show ip route eigrp

D    192.168.4.0/24 [90/310172416] via 172.16.1.1, 00:13:46, Tunnel0D    192.168.1.0/24 [90/297372416] via 172.16.1.1, 00:14:55, Tunnel0

R4#show ip route eigrp

D    192.168.1.0/24 [90/297372416] via 172.16.1.1, 00:01:14, Tunnel0D    192.168.3.0/24 [90/310172416] via 172.16.1.1, 00:00:55, Tunnel0