[cisco] Tunel ipsec ridicat intre un Cisco si un Allied Telesyn.

Pentru cei care au nevoie de asa ceva;
s-a ales pentru test:
1. router Cisco 1720, imagine: c1700-k9sy7-mz.122-11.T11.bin
2. router Allied Telesyn, seria AR720 (soft: 2.6.1-03).



CISCO 1720 configuratie
Current configuration : 1610 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname  cisco
!
enable secret 5 <deleted>
!
memory-size iomem 15
ip subnet-zero
!
!
ip telnet source-interface Loopback0
no ip domain lookup
!
!
!
crypto isakmp policy 10
 authentication pre-share
 lifetime 600
!
crypto isakmp policy 20
 authentication pre-share
 lifetime 600
crypto isakmp key "cheie" address 172.16.1.7
!
!
crypto ipsec transform-set ts-vpn esp-des esp-sha-hmac
 mode transport

!
crypto map vpn 10 ipsec-isakmp
 description --- TEST ---
 set peer 172.16.1.7
 set transform-set ts-vpn
 match address 115
!

!
interface Ethernet 0
 ip address 192.168.2.1 255.255.255.0
!
!
interface FastEthernet0
 ip address 172.17.1.2 255.255.255.0
 ip route-cache flow
 speed auto
 crypto map vpn
!
ip classless
no ip http server
!
!
access-list 115 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

!
ip route 0.0.0.0 0.0.0.0 172.17.1.1
!
line con 0
 password 7 <deleted>
 login
line aux 0
line vty 0 4
 password 7 <deleted>
 login

!
no scheduler allocate
end



AR720 configuratie:

set system name="allied"

set user  securedelay=600
set user=manager pass=<deleted> priv=manager  lo=yes
set user=manager telnet=yes desc="Manager Account"
add user=secoff pass=<deleted>  priv=securityOfficer lo=yes
set user=secoff telnet=yes netmask=255.255.255.255
enable user rso
add user rso ip=0.0.0.0 mask=0.0.0.0

add alias="en" string="sh enco key"
add alias="wr m" string="create conf=ar.cfg"
add alias="wr t" string="sh conf dyn"

enable ip
add ip int=bay0.eth0 ip=172.16.1.7 mask=255.255.255.0
set ip int=bay0.eth0 pro=off
add ip int=eth0 ip=192.168.1.190
set ip int=eth0 pro=off
add ip rou=0.0.0.0 mask=0.0.0.0 int=eth0 next=192.168.1.1
add ip rou=192.168.2.0 mask=255.255.255.0 int=bay0.eth0 next=172.16.1.2

create ipsec sas=1 key=isakmp prot=esp enc=des hasha=sha
create ipsec bund=1 key=isakmp string="1"
create ipsec pol="isakmp1" int=bay0.eth0 ac=permit
set ipsec pol="isakmp1" lp=500 rp=500
create ipsec pol="test1" int=bay0.eth0 ac=ipsec key=isakmp bund=1  
peer=172.16.1.7
set ipsec pol="test1" lad=192.168.1.0 lma=255.255.255.0 rad=192.168.2.0  
rma=255.255.255.0
create ipsec pol="internet" int=bay0.eth0 ac=permit
enable ipsec

create isakmp pol="test1" pe=172.17.1.2 key=1
set isakmp pol="test1" expirys=600
enable isakmp


-- 
Acest mesaj a fost verificat impotriva virusilor si a mesajelor
de tip spam de catre BitDefender pentru servere de mail Linux.
Pentru informatii suplimentare, vizitati http://www.bitdefender.ro/