1、總部分支分別穿越NAT的配置一、組網(wǎng)需求：某組織有總部與分支，出口分別架設防火墻，使用NAT訪問internet,要求實現(xiàn)防火墻后MSR設備使用GRE over IPsec實現(xiàn)分支與總部間互訪。設備清單：MSR 4臺二、組網(wǎng)圖：三、配置步驟：總部配置#ike local-name center#ike peer branch1exchange-mode aggressivepre-shared-key cipher idMpp5iWCCFLJl9Di45pHOnfPzrylEgHid-type nameremote-name branch1nat traversal#ipsec proposa

2、l default#ipsec policy branch1 1 isakmpsecurity acl 3001ike-peer branch1proposal default#/用于匹配GRE Over IPSec的ACLacl number 3001rule 0 permit ip source 100.0.0.2 0 destination 100.0.0.1 0#/用于建立GRE隧道的環(huán)回接口interface LoopBack0#interface Ethernet0/0port link-mode routeipsec policy branch1/綁定IPSec策略#interf

3、ace Ethernet0/1port link-mode route#/連接到分支的GRE接口interface Tunnel0#分支配置#ike local-name branch1#ike peer centerexchange-mode aggressivepre-shared-key cipher idMpp5iWCCFLJl9Di45pHOnfPzrylEgHid-type nameremote-name centernat traversal#ipsec proposal default#ipsec policy center 1 isakmpsecurity acl 3000i

4、ke-peer centerproposal default#/用于匹配GRE Over IPSec的ACLacl number 3000rule 0 permit ip source 100.0.0.1 0 destination 100.0.0.2 0#/用于創(chuàng)建GRE隧道的環(huán)回接口interface LoopBack0#interface Ethernet0/0port link-mode routeipsec policy center/綁定IPSec策略#interface Ethernet0/1port link-mode route#/連接總部的GRE接口interface Tunnel0#總部防火墻配置interface Ethernet0/1port link-mode routenat server protocol udp global 1.1.1.2 500 inside 192.168.1.1 500分支防火墻配置interface Ethernet0/0port link-mode routenat server protocol udp global 1.1.1.1 500 inside 10.0.0.1 500四