Cisco与H3C设备间的GRE over IPSec配置指南

hostname XXXXX  <<<<<<设备名称

service timestamps debug datetime localtime <<<<<<<<<<<<<<<<<设置log，系统时间等
service timestamps log datetime localtime show-timezone
logging buffered 409600
clock timezone GMT 8 0
ntp server 223.255.27.30
no ip domain lookup



username btteadmin privilege 15 secret btteipsec <<<<<<<<<<<<<<设置配置管理用户名和密码
!
line vty 0 4 <<<<<<<<<<<<设置登录vty
 logging synchronous
 login local
 transport input all
line vty 5 15
 logging synchronous
 login local
 transport input all
line con 0
 login local
!

crypto isakmp policy 1<<<<<配置ike策略
 encr 3des

 hash md5
 authentication pre-share
!
crypto isakmp keepalive 10 periodic<<<<<<配置DPD，周期发送保活包
crypto isakmp nat keepalive 60<<<<<<<设置保活nat会话，定时发送保活包，使nat会话存在
-----crypto ipsec nat-transparency udp-encapsulation<<<<开启NAT穿越，默认开启，不用配置

crypto isakmp peer address 122.144.134.98<<<<<<主网关ip地址
 set aggressive-mode password btte*5223*
 set aggressive-mode client-endpoint fqdn branch
crypto isakmp peer address 118.144.155.147<<<<<<备网关IP地址
 set aggressive-mode password btte*5223*
 set aggressive-mode client-endpoint fqdn branch 
!
!
crypto ipsec transform-set center esp-3des esp-md5-hmac<<<<<<配置ipsec转换集
 mode tunnel
!

access-list 100 permit ip host 172.16.3.1 host 172.16.0.2<<<<<<主网关感兴趣流
access-list 110 permit ip host 172.16.3.1 host 172.16.0.1<<<<<<被网关感兴趣流
!

crypto map ipsec 10 ipsec-isakmp<<<<<<配置主网关ipsec策略
 set peer 122.144.134.98
 set transform-set center 
 match address 100<<<<<<匹配主网关感兴趣流
crypto map ipsec 20 ipsec-isakmp<<<<<<配置备网关ipsec策略
 set peer 118.144.155.147
 set transform-set center