一 网络拓扑1.总部和分支都是单链路连接互联网通过nat和gre over ipsec vpn实现内网互通二 设备配置2.1 R11设备配置hostname R11!interface GigabitEthernet 0/0ip address 1.1.1.1 255.255.255.0!interface Loopback 0ip address 192.168.1.1 255.255.255.255!ip route 0.0.0.0 0.0.0.0 1.1.1.2!2.2 R12设备配置-NAT和GREIPSEC配置hostname R12!ip access-list extended 100//IPSEC感兴趣流5 permit ip host 202.1.1.1 host 203.1.1.2!ip access-list extended 110//NAT配置10 deny ip host 192.168.1.1 host 192.168.10.115 permit ip host 192.168.1.1 any!ip nat inside source list 110 interface GigabitEthernet 0/1 overload!crypto isakmp policy 1encryption 3desauthentication pre-sharehash md5group 2!crypto isakmp keepalive 5 periodic!crypto isakmp key 7 151b5f72 address 203.1.1.2crypto ipsec transform-set 1 esp-3des esp-md5-hmac!crypto map 1 1 ipsec-isakmpset peer 203.1.1.2set transform-set 1match address 100!interface GigabitEthernet 0/0ip address 1.1.1.2 255.255.255.0ip nat inside!interface GigabitEthernet 0/1ip address 202.1.1.1 255.255.255.0crypto map 1ip nat outside!interface Tunnel 1ip address 10.1.1.1 255.255.255.0tunnel source 202.1.1.1tunnel destination 203.1.1.2!ip route 0.0.0.0 0.0.0.0 202.1.1.2ip route 192.168.1.1 255.255.255.255 1.1.1.1!2.3 ISP设备配置hostname ISP!interface GigabitEthernet 0/0ip address 203.1.1.1 255.255.255.0!interface GigabitEthernet 0/1ip address 202.1.1.2 255.255.255.0!interface Loopback 0ip address 8.8.8.8 255.255.255.255!2.4 R14设备配置-NAT和GREIPSEC配置hostname R14!ip access-list extended 100//IPSEC感兴趣流10 permit ip host 192.168.10.1 host 192.168.1.1!ip access-list extended 110//NAT10 deny ip host 192.168.10.1 host 192.168.1.115 permit ip host 192.168.10.1 any!ip nat inside source list 110 interface GigabitEthernet 0/0 overload!crypto isakmp policy 1encryption 3desauthentication pre-sharegroup 2!crypto isakmp keepalive 5 periodic!crypto isakmp key 7 06576c50 address 202.1.1.1crypto ipsec transform-set 1 esp-3des esp-md5-hmac!crypto map 1 1 ipsec-isakmpset peer 202.1.1.1set transform-set 1match address 100!interface GigabitEthernet 0/0ip address 203.1.1.2 255.255.255.0crypto map 1ip nat outside!interface GigabitEthernet 0/1ip address 2.2.2.2 255.255.255.0ip nat inside!interface Tunnel 1ip address 10.1.1.2 255.255.255.0tunnel source 203.1.1.2tunnel destination 202.1.1.1!ip route 0.0.0.0 0.0.0.0 203.1.1.1ip route 192.168.10.1 255.255.255.255 2.2.2.1!2.5 R15设备配置hostname R15!interface GigabitEthernet 0/0!interface GigabitEthernet 0/1ip address 2.2.2.1 255.255.255.0!interface Loopback 0ip address 192.168.10.1 255.255.255.255!ip route 0.0.0.0 0.0.0.0 2.2.2.2!三 业务测试3.1 R11业务测试R11#R11#ping 192.168.10.1 source 192.168.1.1Sending 5, 100-byte ICMP Echoes to 192.168.10.1, timeout is 2 seconds: press CtrlC to break !!!!!Success rate is 100 percent (5/5), round-trip min/avg/max 4/5/8 ms.R11#3.2 R15业务测试R15#ping 192.168.1.1 source 192.168.10.1Sending 5, 100-byte ICMP Echoes to 192.168.1.1, timeout is 2 seconds: press CtrlC to break !!!!!Success rate is 100 percent (5/5), round-trip min/avg/max 4/7/11 ms.R15#四 设备状态4.1 R12-NAT和IPSEC状态查看R12#show crypto isakmp sadestination source state conn-id lifetime(second)203.1.1.2 202.1.1.1 IKE_IDLE 1 86101R12#show crypto ipsec saCrypto map tag:1local ipv4 addr 202.1.1.1media mtu 1500sub_map type:static, seqno:1, id1local ident (addr/mask/prot/port): (202.1.1.1/0.0.0.0/0/0))remote ident (addr/mask/prot/port): (203.1.1.2/0.0.0.0/0/0))PERMIT#pkts encaps: 2490, #pkts encrypt: 2490, #pkts digest 2490#pkts decaps: 2490, #pkts decrypt: 2490, #pkts verify 2490#send errors 0, #recv errors 0pkts encaps errors:#negoitate pkt drop: 0, #sab useless: 0, encap data fail: 0, compute hash fail: 0pkts decypto errors:#check reply wind fail: 0, #compute hash fail: 0, verify hash fail: 0#pkts detect send req: 0, recv reply: 0, recv req: 0, send reply: 0Inbound esp sas:spi:0x7046a103 (1883676931)transform: esp-3des esp-md5-hmacin use settings{Tunnel Encaps,}crypto map 1 1sa timing: remaining key lifetime (k/sec): (4605988/3301)IV size: 0 bytesReplay detection support:YOutbound esp sas:spi:0xed941edf (3985907423)transform: esp-3des esp-md5-hmacin use settings{Tunnel Encaps,}crypto map 1 1sa timing: remaining key lifetime (k/sec): (4605988/3301)IV size: 0 bytesReplay detection support:YR12#show crypto isakmp policyProtection suite of priority 1encryption algorithm: Three key triple DES.hash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 secondsDefault protection suiteencryption algorithm: DES - Data Encryption Standard (56 bit keys).hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #1 (768 bit)lifetime: 86400 secondsR12#4.2 R14-NAT和IPSEC状态查看R14#show crypto isakmp sadestination source state conn-id lifetime(second)202.1.1.1 203.1.1.2 IKE_IDLE 1 86019R14#show crypto ipsec saCrypto map tag:1local ipv4 addr 203.1.1.2media mtu 1500sub_map type:static, seqno:1, id1local ident (addr/mask/prot/port): (203.1.1.2/0.0.0.0/0/0))remote ident (addr/mask/prot/port): (202.1.1.1/0.0.0.0/0/0))PERMIT#pkts encaps: 3239, #pkts encrypt: 3239, #pkts digest 3239#pkts decaps: 3239, #pkts decrypt: 3239, #pkts verify 3239#send errors 0, #recv errors 0pkts encaps errors:#negoitate pkt drop: 0, #sab useless: 0, encap data fail: 0, compute hash fail: 0pkts decypto errors:#check reply wind fail: 0, #compute hash fail: 0, verify hash fail: 0#pkts detect send req: 0, recv reply: 0, recv req: 0, send reply: 0Inbound esp sas:spi:0xed941edf (3985907423)transform: esp-3des esp-md5-hmacin use settings{Tunnel Encaps,}crypto map 1 1sa timing: remaining key lifetime (k/sec): (4606684/3220)IV size: 0 bytesReplay detection support:YOutbound esp sas:spi:0x7046a103 (1883676931)transform: esp-3des esp-md5-hmacin use settings{Tunnel Encaps,}crypto map 1 1sa timing: remaining key lifetime (k/sec): (4606684/3220)IV size: 0 bytesReplay detection support:YR14#show crypto isakmp policyProtection suite of priority 1encryption algorithm: Three key triple DES.hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 secondsDefault protection suiteencryption algorithm: DES - Data Encryption Standard (56 bit keys).hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #1 (768 bit)lifetime: 86400 secondsR14#
企业数字化 ERP 产品动态
相关推荐
C语言宽字符数值转换全解析：从wcstol到wcstod的进阶实战 1. 项目概述：为什么宽字符转换是C语言进阶的必修课？如果你写过C语言程序，处理过用户输入、配置文件或者网络数据，肯定没少跟atoi、atof这些函数打交道。它们简单直接，把"123"变成整数123，把"… · 2026/9/22 14:35:21
AI落地的两大核心：问题定义与执行嵌入 1. 项目概述：这不是“AI风口”，而是一场结构性分工的悄然重构 “ The Two-Part Opportunity in AI ”——这个标题初看像一句行业口号，但在我过去十年跟踪AI落地项目的实操经验里，它精准戳中了当前最被低估、也最容易踩坑的核心… · 2026/9/24 12:50:37
安卓APP逆向分析实战：从APK拆解到签名算法还原 1. 项目概述：从“看”到“解”的逆向之旅 最近在技术圈里，和几位老朋友聊起移动应用安全，话题自然就落到了“逆向分析”上。这活儿听起来挺神秘，好像总跟破解、安全漏洞挂钩，但其实它更像是一把精密的“手术刀”&#… · 2026/9/24 23:27:35
wp-calypso Jetpack Connect 连接流程全解析：从授权信号到插件感知式接入 前端CMS 【免费下载链接】wp-calypso The JavaScript and API powered WordPress.com 项目地址： https://gitcode.com/gh_mirrors/wp/wp-calypso 点击查看 免费下载 本文以 client/jetpack-connect/AGENTS.md 及其关联的 connection-content/README.md 为主体&… · 2026/9/25 21:12:05
从推理到构建：腾讯云ES如何让企业Agent从「能用」走向「好用」 导读：当 16% 的企业已把 Agentic AI 推进生产环境、而真正拥有 AI-Ready 数据的企业只有 4% 时，热度与落地之间的这道缺口，并不是大模型能力的缺口，而是上下文供给的缺口。在 腾讯云 x Elastic AI 搜索技术大会上，腾讯… · 2026/9/25 21:11:27
链表从入门到精通：单链表操作、逆序与面试考点全解析 聊链表之前，我先说个观察：数据结构课上，链表几乎是所有人的第一道坎，但也是性价比最高的一道坎。学会了链表，指针、内存、递归这些概念会跟着通掉一半；学不会，后面二叉树、图、哈希表全都会受影… · 2026/9/25 21:11:02
Servlet+JSP手写登录注册：从环境搭建到Session会话管理 1. 为什么还要写ServletJSP的登录注册：先弄清楚这个项目解决什么问题登录注册系统，几乎是每个JavaWeb学习者绕不开的第一个完整项目。哪怕现在Spring Boot大行其道，我还是建议你耐着性子把它用原生Servlet和JSP写一遍。原因很简单：… · 2026/9/25 21:11:02
Atlas 300V 24G上部署YOLO：模型转换与推理调优实战 1. Atlas 300V 24G：先把这个"是不是加速卡"的问题彻底讲清楚1.1 为什么大家会对这张卡产生身份疑问最近后台收到好几条类似的私信，都是关于"Atlas 300V 24G"，上来第一句就问：这玩意儿是运算加速卡吗ÿ… · 2026/9/25 21:10:18
* LangChain 模型统一接入：ChatOpenAI 兼容用法与 init_chat_model 详解 本章对应的官网文档出处：
英文文档：https://docs.langchain.com/oss/python/langchain/models
中文文档：https://docs.langchain.org.cn/oss/python/langchain/models
一、ChatOpenAI 兼容用法
1.1 兼容接口的使用背景
一方面࿰… · 2026/9/25 21:10:12
创维E900V22D刷机全攻略：S905L3SB芯片兼容性解析与救砖实战 /* MD / 富文本中的 .toc（含博客园搬家等嵌套结构）；.toc-box 在侧栏，不受影响 */#content_views .toc,/* 编辑器常在目录前后插入空 p（:empty 仍占 20px），一并去掉避免顶空隙 */#content_views.markdown_views > p:empty:has(+ .toc),#content_views.markdown_views … · 2026/9/25 1:00:31
MQTT协议原理与Broker服务器搭建实战：从Mosquitto到EMQX /* MD / 富文本中的 .toc（含博客园搬家等嵌套结构）；.toc-box 在侧栏，不受影响 */#content_views .toc,/* 编辑器常在目录前后插入空 p（:empty 仍占 20px），一并去掉避免顶空隙 */#content_views.markdown_views > p:empty:has(+ .toc),#content_views.markdown_views … · 2026/9/25 1:00:37
