R1(S1/1:12.12.12.1)-----------(S1/0:12.12.12.2)R2(S1/1:23.23.23.2)----------(S1/0:23.23.23.2)R3(S1/1:34.34.34.3)-------------------(S1/0:34.34.43.4)R4(S1/1:45.45.45.4)----------------(S1/0:45.45.45.5)R5
说明：1.R1是INSIDE R2是SITE1 R3是INTERNET R4是
SITE2 R5是PRIVATE
2.R1和R4建立×××
试验：
1：inside启用telnet，并且限制只允许45.45.45.0/24网络访问
12.12.12.0/24网络的telnet服务
R1：inside(config)#line vty 0 4
inside(config-line)#password cisco
2.private启用http，并且限制只允许12.12.12.0/24访问 45.45.45.0/24
R5：private(config)#ip http server
inside#sh running-config
!
interface Serial1/1
ip address 12.12.12.1 255.255.255.0
serial restart-delay 0
!
ip classless
ip route 0.0.0.0 0.0.0.0 12.12.12.2
!
line vty 0 4
password cisco
login
site1#sh run
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 34.34.34.4
!
crypto ipsec transform-set wk esp-des esp-md5-hmac
!
crypto map *** 10 ipsec-isakmp
set peer 34.34.34.4
set ip access-group crypto.inbound.acl in
set ip access-group crypto.outbound.acl out
set transform-set wk
match address 101
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface Serial1/0
ip address 12.12.12.2 255.255.255.0
serial restart-delay 0
!
interface Serial1/1
ip address 23.23.23.2 255.255.255.0
ip access-group inbound in
ip access-group outbound out
serial restart-delay 0
crypto map ***
!
ip route 0.0.0.0 0.0.0.0 23.23.23.3
!
ip access-list extended crypto.inbound.acl
permit tcp 45.45.45.0 0.0.0.255 12.12.12.0 0.0.0.255 eq telnet
permit tcp 45.45.45.0 0.0.0.255 eq www 12.12.12.0 0.0.0.255
ip access-list extended cryto.outbound.acl
permit tcp 12.12.12.0 0.0.0.255 45.45.45.0 0.0.0.255 eq www
permit tcp 12.12.12.0 0.0.0.255 eq telnet 45.45.45.0 0.0.0.255
ip access-list extended inbound
permit udp host 34.34.34.4 eq isakmp host 23.23.23.2 eq isakmp
permit esp host 34.34.34.4 host 23.23.23.2
ip access-list extended outbound
permit esp host 23.23.23.2 host 34.34.34.4
!
access-list 101 permit ip 12.12.12.0 0.0.0.255 45.45.45.0 0.0.0.255
!
internet#sh running-config
!
interface Serial1/0
ip address 23.23.23.3 255.255.255.0
serial restart-delay 0
!
interface Serial1/1
ip address 34.34.34.3 255.255.255.0
site2#sh run
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 23.23.23.2
!
!
crypto ipsec transform-set wk esp-des esp-md5-hmac
!
crypto map *** 10 ipsec-isakmp
set peer 23.23.23.2
set ip access-group cryto.inbound.acl in
set ip access-group crypto.outbound.acl out
set transform-set wk
match address 101
!
interface Loopback0
ip address 4.4.4.4 255.255.255.0
!
interface Serial1/0
ip address 34.34.34.4 255.255.255.0
ip access-group inbound in
ip access-group outbound out
serial restart-delay 0
crypto map ***
!
interface Serial1/1
ip address 45.45.45.4 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 34.34.34.3
!
ip access-list extended crypto.outbound.acl
permit tcp 45.45.45.0 0.0.0.255 eq www 12.12.12.0 0.0.0.255
permit tcp 45.45.45.0 0.0.0.255 12.12.12.0 0.0.0.255 eq telnet
ip access-list extended cryto.inbound.acl
permit tcp 12.12.12.0 0.0.0.255 eq telnet 45.45.45.0 0.0.0.255
permit tcp 12.12.12.0 0.0.0.255 45.45.45.0 0.0.0.255 eq www
ip access-list extended inbound
permit udp host 23.23.23.2 eq isakmp host 34.34.34.4 eq isakmp
permit esp host 23.23.23.2 host 34.34.34.4
ip access-list extended outbound
permit esp host 34.34.34.4 host 23.23.23.2
!
access-list 101 permit ip 45.45.45.0 0.0.0.255 12.12.12.0 0.0.0.255
!
private#sh run
!
interface Serial1/0
ip address 45.45.45.5 255.255.255.0
serial restart-delay 0
!
ip route 0.0.0.0 0.0.0.0 45.45.45.4
ip http server