![]()
如图所示，HUB1和HUB2互作IPSec failover。
注：目前仅有HSRP支持，VRRP暂不支持此功能。
配置如下：
Spoke路由器：
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 0.0.0.0 0.0.0.0
!
crypto sec transform-set ccsp esp-3des esp-sha-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 16.1.1.254
set transform-set ccsp
match address 101
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface FastEthernet0/0
ip address 173.16.1.2 255.255.255.0
crypto map cisco
!
ip route 10.2.2.0 255.255.255.0 173.16.1.1
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
HUB1路由器：
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set ccsp esp-3des esp-sha-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 173.1.1.2
set transform-set ccsp
match address 101
!
interface FastEthernet0/0
ip address 16.1.1.1 255.255.255.0
duplex half
standby 10 ip 16.1.1.254
standby 10 priority 101
standby 10 preempt
standby 10 name ipsec-public
standby 10 track FastEthernet1/0
crypto map cisco redundancy ipsec-public stateful
standby delay reload 120
!
interface FastEthernet1/0
ip address 10.2.2.1 255.255.255.0
duplex half
standby 20 ip 10.2.2.254
standby 20 priority 101
standby 20 preempt
standby 20 name ipsec-private
standby 20 track FastEthernet0/0
standby delay reload 120
!
ip route 0.0.0.0 0.0.0.0 16.1.1.3
!
access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
!
redundancy inter-device
scheme standby ipsec-private
!
ipc zone default
association 1
no shutdown
protocol sctp
local-port 5000
local-ip 10.2.2.1
remote-port 5000
remote-ip 10.2.2.2
HUB2路由器：
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set ccsp esp-3des esp-sha-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 173.1.1.2
set transform-set ccsp
match address 101
!
interface FastEthernet0/0
ip address 16.1.1.2 255.255.255.0
duplex half
standby 10 ip 16.1.1.254
standby 10 priority 101
standby 10 preempt
standby 10 name ipsec-public
standby 10 track FastEthernet1/0
crypto map cisco redundancy ipsec-public stateful
standby delay reload 120
!
interface FastEthernet1/0
ip address 10.2.2.2 255.255.255.0
duplex half
standby 20 ip 10.2.2.254
standby 20 priority 101
standby 20 preempt
standby 20 name ipsec-private
standby 20 track FastEthernet0/0
standby delay reload 120
!
ip route 0.0.0.0 0.0.0.0 16.1.1.3
!
access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
!
redundancy inter-device
scheme standby ipsec-private
!
ipc zone default
association 1
no shutdown
protocol sctp
local-port 5000
local-ip 10.2.2.2
remote-port 5000
remote-ip 10.2.2.1
阅读(324) | 评论(0) | 转发(0) |
