在实际网络运用中我们时常跑GRE+IPSEC来实现我们中心到分支的远程访问回话，这样以来容易配置，而来可用性高，我们知道L2L无论是链路备份还是设备备份，都不是状态备份，当一个点断掉后，用经过几十秒甚至1分多种的时间收敛，才能切换到另一条线路上，重新构建ipsec回话。我们用GRE+IPSEC则可以用更少的时间来切换线路。

要求：

1.实现ipsec高可用性切换

2.在中心站点部署两台vpn网管，跑gre

R1:

crypto isakmp policy 10

 authentication pre-share

 group 2

crypto isakmp key cisco address 69.1.10.5 no-xauth

crypto isakmp key cisco address 88.88.8.4 no-xauth

crypto ipsec transform-set liang esp-des esp-md5-hmac 

 mode transport

crypto map mymap local-address Ethernet0/0

crypto map mymap 10 ipsec-isakmp 

 set peer 69.1.10.5

 set transform-set liang 

 match address 101

crypto map mymap 20 ipsec-isakmp 

 set peer 88.88.8.4

 set transform-set liang 

 match address 102

!interface Loopback0

 ip address 192.168.1.1 255.255.255.0

interface Loopback1

 ip address 1.1.1.1 255.255.255.255

interface Tunnel0

 bandwidth 1000

 ip address 10.1.15.1 255.255.255.0

 ip mtu 1438

 keepalive 10 3

 tunnel source Ethernet0/0

 tunnel destination 69.1.10.5

interface Tunnel1

 ip address 10.1.14.1 255.255.255.0

 ip mtu 1438

 keepalive 10 3

 tunnel source Ethernet0/0

 tunnel destination 88.88.8.4

interface Ethernet0/0

 ip address 191.1.1.1 255.255.255.0

 half-duplex

 crypto map mymap

router ospf 10

 router-id 1.1.1.1

 log-adjacency-changes

 network 1.1.1.1 0.0.0.0 area 0

 network 10.1.15.0 0.0.0.255 area 1

network 10.1.14.0 0.0.0.255 area 1

 network 192.168.1.0 0.0.0.255 area 0

ip route 0.0.0.0 0.0.0.0 191.1.1.3

access-list 101 permit gre host 191.1.1.1 host 69.1.10.5

access-list 102 permit gre host 191.1.1.1 host 88.88.8.4

R2:

crypto isakmp policy 10

 authentication pre-share

 group 2

crypto isakmp key cisco address 88.88.8.4 no-xauth

crypto isakmp key cisco address 69.1.10.5 no-xauth

crypto ipsec transform-set liang esp-des esp-md5-hmac 

 mode transport

crypto map mymap local-address Ethernet0/1

crypto map mymap 10 ipsec-isakmp 

 set peer 88.88.8.4

 set transform-set liang 

 match address 101

crypto map mymap 20 ipsec-isakmp 

 set peer 69.1.10.5

 set transform-set liang 

 match address 102

interface Loopback0

 ip address 192.168.2.2 255.255.255.0

interface Loopback1

 ip address 2.2.2.2 255.255.255.255       

interface Tunnel0

 bandwidth 1000

 ip address 10.1.24.2 255.255.255.0

 ip mtu 1483

 keepalive 10 3

 tunnel source Ethernet0/1

 tunnel destination 88.88.8.4

interface Tunnel1

 ip address 10.1.25.2 255.255.255.0

 ip mtu 1438

 keepalive 10 3

 tunnel source Ethernet0/1

 tunnel destination 69.1.10.5

interface Ethernet0/1

 ip address 192.1.1.2 255.255.255.0

router ospf 10

 log-adjacency-changes

 network 10.1.24.0 0.0.0.255 area 1

 network 10.1.25.0 0.0.0.255 area 1

ip route 0.0.0.0 0.0.0.0 192.1.1.3      

access-list 101 permit gre host 192.1.1.2 host 88.88.8.4

access-list 102 permit gre host 192.1.1.2 host 69.1.10.5

R4

crypto isakmp policy 10

 authentication pre-share

 group 2

crypto isakmp key cisco address 192.1.1.2 no-xauth

crypto isakmp key cisco address 191.1.1.1 no-xauth

crypto ipsec transform-set liang esp-des esp-md5-hmac 

 mode transport

crypto map mymap local-address Ethernet0/2

crypto map mymap 10 ipsec-isakmp 

 set peer 192.1.1.2

 set transform-set liang 

 match address 101

crypto map mymap 20 ipsec-isakmp 

 set peer 191.1.1.1

 set transform-set liang 

 match address 102

interface Loopback0

 ip address 4.4.4.4 255.255.255.255

iterface Tunnel0

 bandwidth 1000

 ip address 10.1.24.4 255.255.255.0

 ip mtu 1483

 keepalive 10 3

 tunnel source Ethernet0/2

 tunnel destination 192.1.1.2

interface Tunnel1

 ip address 10.1.14.4 255.255.255.0

 ip mtu 1483

 keepalive 10 3

 tunnel source Ethernet0/2

 tunnel destination 191.1.1.1

interface Ethernet0/0

 ip address 192.168.3.4 255.255.255.0

 full-duplex

interface Ethernet0/2

 ip address 88.88.8.4 255.255.255.0

 crypto map mymap

router ospf 10

 router-id 4.4.4.4

 log-adjacency-changes

 network 4.4.4.4 0.0.0.0 area 0

 network 10.1.14.0 0.0.0.255 area 1

 network 10.1.24.0 0.0.0.255 area 1

 network 192.168.3.0 0.0.0.255 area 0

ip route 0.0.0.0 0.0.0.0 88.88.8.3

access-list 101 permit gre host 88.88.8.4 host 192.1.1.2

access-list 102 permit gre host 88.88.8.4 host 191.1.1.1

R5

crypto isakmp policy 10

 authentication pre-share

 group 2

crypto isakmp key cisco address 191.1.1.1 no-xauth       两个peer 在上为主

crypto isakmp key cisco address 192.1.1.2 no-xauth

crypto ipsec transform-set liang esp-des esp-md5-hmac 

 mode transport

crypto map mymap local-address Ethernet1/3

crypto map mymap 10 ipsec-isakmp 

 set peer 191.1.1.1

 set transform-set liang 

 match address 101

crypto map mymap 20 ipsec-isakmp 

 set peer 192.1.1.2

 set transform-set liang 

 match address 102

interface Loopback0

 ip address 5.5.5.5 255.255.255.255

interface Tunnel0

 bandwidth 1000                             GRE默认带宽是9我们指定1000 使其优先级高成为主线路

 ip address 10.1.15.5 255.255.255.0

 ip mtu 1438

 keepalive 10 3

 tunnel source Ethernet1/3

 tunnel destination 191.1.1.1

interface Tunnel1

 ip address 10.1.25.5 255.255.255.0

 ip mtu 1438                                              指定mtu

 keepalive 10 3

 tunnel source Ethernet1/3

 tunnel destination 192.1.1.2

interface Ethernet1/3

 ip address 69.1.10.5 255.255.255.0

 half-duplex

 crypto map mymap

interface Vlan1

 no ip address     

router ospf 10

 log-adjacency-changes

 network 5.5.5.5 0.0.0.0 area 0

 network 10.1.15.0 0.0.0.255 area 1

 network 10.1.25.0 0.0.0.255 area 1

 network 192.168.4.0 0.0.0.255 area 0

ip route 0.0.0.0 0.0.0.0 69.1.10.3

access-list 101 permit gre host 69.1.10.5 host 191.1.1.1

access-list 102 permit gre host 69.1.10.5 host 192.1.1.2

r2#show ip route 

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.1.1.3 to network 0.0.0.0

1.0.0.0/32 is subnetted, 1 subnets

O IA    1.1.1.1 [110/11212] via 10.1.25.5, 00:19:40, Tunnel1   通过主链路学到的路由

     2.0.0.0/32 is subnetted, 1 subnets

C       2.2.2.2 is directly connected, Loopback1

     4.0.0.0/32 is subnetted, 1 subnets

O IA    4.4.4.4 [110/11114] via 10.1.25.5, 00:19:40, Tunnel1

     5.0.0.0/32 is subnetted, 1 subnets

O IA    5.5.5.5 [110/11112] via 10.1.25.5, 00:19:40, Tunnel1

     6.0.0.0/32 is subnetted, 1 subnets

O IA    6.6.6.6 [110/11113] via 10.1.25.5, 00:19:40, Tunnel1

O IA 192.168.4.0/24 [110/11112] via 10.1.25.5, 00:19:40, Tunnel1

     10.0.0.0/24 is subnetted, 4 subnets

O       10.1.15.0 [110/11211] via 10.1.25.5, 00:19:40, Tunnel1

O IA    10.1.14.0 [110/22224] via 10.1.25.5, 00:00:09, Tunnel1

C       10.1.25.0 is directly connected, Tunnel1

C       10.1.24.0 is directly connected, Tunnel0

C    192.1.1.0/24 is directly connected, Ethernet0/1

     192.168.1.0/32 is subnetted, 1 subnets

O IA    192.168.1.1 [110/11212] via 10.1.25.5, 00:19:40, Tunnel1

C    192.168.2.0/24 is directly connected, Loopback0

O IA 192.168.3.0/24 [110/11113] via 10.1.25.5, 00:19:40, Tunnel1

S*   0.0.0.0/0 [1/0] via 192.1.1.3

当r4出现线路故障，自动切换到r5

此图与L2L站点到站点vpn优势：

1.自动切换，时间短，

2.无须匹配加密数据流，可跑动态路由协议，自己协商，方便，我们只需配置GRE其他的让她们自己去协商

3.配置简单，方便配错，特别是对于多点配置，L2Lvpn配置起来超麻烦，站点多了要配DMVPN，在这我们只需起一条 tunnel 隧道就行了!

4.还有更加简单的配置  用ipsec pro 这个有时间我补在后面

5.等等 呵呵

本文转自q狼的诱惑 51CTO博客，原文链接：http://blog.51cto.com/liangrui/533202，如需转载请自行联系原作者