Cisco 2821 配置拔号*** 和NA

永不落伍

　　Cisco 2821 配置拔号*** 和NAT

http://blog.51cto.com/attachment/201010/085820614.jpg

注本文中的IP：60.190.135.75为公网网关。Router>enRouter#conf tRouter(config)#username test password  testRouter(config)#aaa new-modelRouter(config)# aaa authentication login ***-en localRouter(config)# aaa authorization network ***-or localRouter(config)# ip local pool ***-pool 192.168.11.1 192.168.11.254 //分配给客户机的IPRouter(config)# crypto isakmp policy 10Router(config-isakmp)# authentication pre-shareRouter(config-isakmp)# encryption 3desRouter(config-isakmp)# hash shaRouter(config-isakmp)# group 2Router(config-isakmp)# exitRouter(config)# access-list 101 permit ip 192.168.200.0 0.0.0.255 192.168.11.0 0.0.0.255Router(config)# crypto isakmp client configuration group my***   //客户端软件要输入Router(config-isakmp-group)# key cisco1234     //客户端软件要输入的密码Router(config-isakmp-group)#pool   ***-poolRouter(config-isakmp-group)#acl 101Router(config-isakmp-group)#exitRouter(config)# crypto ipsec transform-set ccnp esp-3des esp-sha-hmacRouter(cfg-crypto-trans)# mode tunnelRouter(cfg-crypto-trans)#exitRouter(config)# crypto dynamic-map edm 10Router(config-crypto-map)# set transform-set ccnpRouter(config-crypto-map)# reverse-routeRouter(config-crypto-map)#exitRouter(config)# crypto map cisco client authentication list ***-enRouter(config)# crypto map cisco isakmp authorization list ***-orRouter(config)# crypto map cisco client configuration address respondRouter(config)# crypto map cisco 10 ipsec-isakmp dynamic edmRouter(config)# int g0/0Router(config-if)# ip address 192.168.200.1 255.255.255.0 Router(config-if)# ip nat insideRouter(config-if)# no shutdowRouter(config-if)#exit Router(config)#int g0/1Router(config-if)# ip address 60.190.135.76 255.255.255.248Router(config-if)# ip nat outsideRouter(config-if)# crypto map ciscoRouter(config-if)# no shutdownRouter(config-if)#exitRouter(config)# ip route 0.0.0.0 0.0.0.0 60.190.135.75Router(config)#access-list   102  deny ip 192.168.200.0 0.0.0.255 192.168.11.0 0.0.0.255Router(config)# access-list 102 permit ip 192.168.200.0 0.0.0.255 anyRouter(config)# route-map nat permit 10Router(config-route-map)#match ip address 102Router(config)#exitRouter(config)# ip nat inside source route-map nat interface g0/1 overload Building configuration...Current configuration : 1766 bytesversion 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryptionhostname Routerboot-start-markerboot-end-markerenable secret 5 $1$XU/z$ZcEi8Ip60lqYJIJuYO7Or.aaa new-modelaaa authentication login ***-en localaaa authorization network ***-or localaaa session-id commonip cefusername young password 0 youngcrypto isakmp policy 10 encr 3des authentication pre-share group 2crypto isakmp client configuration group zy*** key cisco1234 pool ***-pool acl 101crypto ipsec transform-set ccnp esp-3des esp-sha-hmaccrypto dynamic-map edm 10 set transform-set ccnp reverse-routecrypto map cisco client authentication list ***-encrypto map cisco isakmp authorization list ***-orcrypto map cisco client configuration address respondcrypto map cisco 10 ipsec-isakmp dynamic edminterface GigabitEthernet0/0 ip address 192.168.200.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed autointerface GigabitEthernet0/1 ip address 60.190.135.76 255.255.255.248 ip nat outside ip virtual-reassembly duplex auto speed auto crypto map ciscoip local pool ***-pool 192.168.11.1 192.168.11.254ip route 0.0.0.0 0.0.0.0 60.190.135.75ip http serverno ip http secure-serverip nat inside source route-map nat interface GigabitEthernet0/1 overloadaccess-list 101 permit ip 192.168.200.0 0.0.0.255 192.168.11.0 0.0.0.255access-list 102 deny   ip 192.168.200.0 0.0.0.255 192.168.11.0 0.0.0.255access-list 102 permit ip 192.168.200.0 0.0.0.255 anyroute-map nat permit 10 match ip address 102!control-planeline con 0line aux 0line vty 0 4 password 123456scheduler allocate 20000 1000end