链路备份高可用VPN

R1(config)#interface f0/0
R1(config-if)#ip add 200.1.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config)#interface loopback 0
R1(config-if)#ip add 1.1.1.1 255.255.255.0
R1(config-if)#
R1(config)#ip route 0.0.0.0 0.0.0.0 200.1.1.2
R2
R2#conf t
R2(config)#interface f0/0
R2(config-if)#ip add 200.1.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#interface f0/1
R2(config-if)#ip add 200.1.2.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#interface f1/0
R2(config-if)#ip add 200.1.3.2 255.255.255.0
R2(config-if)#no shutdown
R3
R3#
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z. R3(config)#in
R3(config)#interface f0/0
R3(config-if)#ip add 200.1.2.3 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#ip add 200.1.2.3 255.255.255.0
R3(config-if)#interface f0/1
R3(config-if)#ip add 10.1.1.10 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#ip route 0.0.0.0 0.0.0.0 200.1.2.2
R3(config)#router ospf 1
R3(config-router)#network 10.1.1.0 0.0.0.255 area 0 R3(config-router)#
R4
R4#
R4#conf t
R4(config)#interface f0/0
R4(config-if)#ip add 200.1.3.4 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#interface f0/1
R4(config-if)#ip add 10.1.1.20 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#exit
R4(config)#ip route 0.0.0.0 0.0.0.0 200.1.3.2
R4(config)#router ospf 1
R4(config-router)#network 10.1.1.0 0.0.0.255 area 0
R5
R5#conf t
R5(config)#interface loopback 1
R5(config-if)#ip add 2.2.2.2 255.255.255.0
R5(config-if)#exit
R5(config)#interface f0/0
R5(config-if)#ip add 10.1.1.1 255.255.255.0
R5(config-if)#no shutdown
R5(config-if)#exit
R5(config)#router ospf 1
R5(config-router)#network 10.1.1.0 0.0.0.255 area 0 R5(config-router)#network 2.2.2.0 0.0.0.255 area 0 R5(config-router)#
fengongsi#
fengongsi#conf t
fengongsi(config)#
fengongsi(config)#crypto isakmp policy 10
fengongsi(config-isakmp)#authentication pre-share fengongsi(config-isakmp)#exit
fengongsi(config)#crypto isakmp key 0 cisco address 200.1.2.3 fengongsi(config)#crypto isakmp key 0 cisco address 200.1.3.4
fengongsi(config)#crypto isakmp keepalive 10 periodic
fengongsi(config)#ip access-list extended vpn
fengongsi(config-ext-nacl)#permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 fengongsi(config-ext-nacl)#exit
fengongsi(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmac fengongsi(cfg-crypto-trans)#exit
fengongsi(config)#crypto map cisco 10 ipsec-isakmp
fengongsi(config-crypto-map)#match address vpn
fengongsi(config-crypto-map)#set transform-set cisco
fengongsi(config-crypto-map)#set peer 200.1.2.3
fengongsi(config-crypto-map)#set peer 200.1.3.4
fengongsi(config-crypto-map)#exit
fengongsi(config)#interface f0/0
fengongsi(config-if)#crypto map cisco
fengongsi(config-if)#
*Mar 1 00:34:04.787: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R3#cry
R3#conf t
R3(config)#crypto isakmp policy 10
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#exi
R3(config-isakmp)#exit
R3(config)#crypto isakmp key 0 cisco address 200.1.1.1
R3(config)#crypto isakmp keepalive 10 periodic
R3(config)#ip access-list extended vpn
R3(config-ext-nacl)#permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
R3(config-ext-nacl)#exit
R3(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmac
R3(cfg-crypto-trans)#exit
R3(config)#crypto map cisco 10 ipsec-isakmp
R3(config-crypto-map)#match address vpn
R3(config-crypto-map)#set transform-set cisco
R3(config-crypto-map)#set peer 200.1.1.1
R3(config-crypto-map)#reverse-route
R3(config-crypto-map)#set reverse-route tag 10
R3(config-crypto-map)#exit
R3(config)#interface f0/0
R3(config-if)#crypto map cisco
R3(config-if)#exit
R3(config)#route-map Rtof
R3(config-route-map)#match tag 10
R3(config-route-map)#exit
R3(config)#router ospf 1
R3(config-router)#redistribute static route-map Rtof subnets
R4#cry
R4#conf t
R4(config)#crypto isakmp policy 10
R4(config-isakmp)#authentication pre-share
R4(config-isakmp)#exi
R4(config-isakmp)#exit
R4(config)#crypto isakmp key 0 cisco address 200.1.1.1
R4(config)#crypto isakmp keepalive 10 periodic
R4(config)#ip access-list extended vpn
R4(config-ext-nacl)#permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
R4(config-ext-nacl)#exit
R4(config)#crypto ipsec transform-set cisco esp-des esp-md5-hmac R4(cfg-crypto-trans)#exit
R4(config)#crypto map cisco 10 ipsec-isakmp
R4(config-crypto-map)#match address vpn
R4(config-crypto-map)#set transform-set cisco
R4(config-crypto-map)#set peer 200.1.1.1
R4(config-crypto-map)#reverse-route
R4(config-crypto-map)#set reverse-route tag 10
R4(config-crypto-map)#exit
R4(config)#interface f0/0
R4(config-if)#crypto map cisco
R4(config-if)#exit
R4(config)#route-map Rtof
R4(config-route-map)#match tag 10
R4(config-route-map)#exit
R4(config)#router ospf 1
R4(config-router)#redistribute static route-map Rtof subnets
流量可以看到走R3
手工制造故障在R2连接R3的接口后，有丢包现象，但是很快链路正常，说明链路进行了自动切换。

实验就成功了！
上面链路正常是，静态路由在R3上产生，故障后安全安全关联删除，静态路由删除。

R4和分公司建立安全关联后注入静态路由。

R5上通过路由重发布进入的路由条目正常。