• If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.
Xin chào ! Nếu đây là lần đầu tiên bạn đến với diễn đàn, xin vui lòng danh ra một phút bấm vào đây để đăng kí và tham gia thảo luận cùng VnPro.

Announcement

Collapse
No announcement yet.

router 1841 có hỗ trợ multivpn không?

Collapse
X
Collapse
 
  • Page of 1
  • Filter
  • Time
  • Show
Clear All
new posts
Previous template Next
  • #1

    router 1841 có hỗ trợ multivpn không?

    em có mô hình như hình trên
    https://lh3.googleusercontent.com/zE...E=w711-h420-no


    thông tin cấu hình router saigon
    !
    version 12.4
    service timestamps log datetime msec
    service timestamps debug datetime msec
    no service password-encryption
    !
    hostname HCM-R
    !
    !
    !
    enable secret 5 $1$8Fwe$I.fE7fBzTMhqf6sr/Jx8g/
    !
    !
    !
    ip dhcp pool vlan10
    network 192.168.1.0 255.255.255.192
    default-router 192.168.1.62
    ip dhcp pool vlan20
    network 192.168.1.64 255.255.255.192
    default-router 192.168.1.126
    ip dhcp pool vlan30
    network 192.168.1.128 255.255.255.224
    default-router 192.168.1.158
    ip dhcp pool vlan40
    network 192.168.1.160 255.255.255.224
    default-router 192.168.1.190
    ip dhcp pool vlan50
    network 192.168.1.192 255.255.255.240
    default-router 192.168.1.206
    !
    ip cef
    no ipv6 cef
    !
    !
    !
    username admin secret 5 $1$NZyN$NL5zMBfHeZXWu09g8za7Z.
    !
    !
    crypto isakmp policy 10
    hash md5
    authentication pre-share
    group 2
    !
    crypto isakmp key saigonhanoi address 200.0.0.6
    crypto isakmp key saigonnhamay address 200.0.0.10
    !
    !
    crypto ipsec security-association lifetime seconds 1800
    !
    crypto ipsec transform-set vpnset esp-des esp-md5-hmac
    !
    crypto map vpnmap 10 ipsec-isakmp
    set peer 200.0.0.6
    set security-association lifetime seconds 1800
    set transform-set vpnset
    match address 100
    !
    crypto map vpnmap 20 ipsec-isakmp
    set peer 200.0.0.10
    set security-association lifetime seconds 1800
    set transform-set vpnset
    match address 100
    !
    !
    !
    !
    !
    !
    spanning-tree mode pvst
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    no ip address
    duplex auto
    speed auto
    !
    interface FastEthernet0/0.10
    encapsulation dot1Q 10
    ip address 192.168.1.62 255.255.255.192
    !
    interface FastEthernet0/0.20
    encapsulation dot1Q 20
    ip address 192.168.1.126 255.255.255.192
    !
    interface FastEthernet0/0.30
    encapsulation dot1Q 30
    ip address 192.168.1.158 255.255.255.224
    !
    interface FastEthernet0/0.40
    encapsulation dot1Q 40
    ip address 192.168.1.190 255.255.255.224
    !
    interface FastEthernet0/0.50
    encapsulation dot1Q 50
    ip address 192.168.1.206 255.255.255.240
    !
    interface FastEthernet0/1
    description "ket noi toi ISP"
    ip address 200.0.0.2 255.255.255.252
    duplex auto
    speed auto
    crypto map vpnmap
    !
    interface Vlan1
    no ip address
    !
    ip classless
    ip route 0.0.0.0 0.0.0.0 200.0.0.1
    !
    ip flow-export version 9
    !
    !
    access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255
    !
    !
    !
    !
    !
    line con 0
    login local
    !
    line aux 0
    !
    line vty 0 4
    login local
    !
    !
    !
    end



    ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++
    thông tin cấu hình trên router hanoi

    !
    version 12.4
    service timestamps log datetime msec
    service timestamps debug datetime msec
    service password-encryption
    !
    hostname HANOI
    !
    !
    !
    enable secret 5 $1$dqE5$uY4NBhtPEiLdHECR2IrDv.
    !
    !
    !
    ip dhcp pool vlan10
    network 192.168.2.0 255.255.255.192
    default-router 192.168.2.62
    dns-server 192.168.2.161
    ip dhcp pool vlan20
    network 192.168.2.64 255.255.255.192
    default-router 192.168.2.126
    dns-server 192.168.2.161
    ip dhcp pool vlan30
    network 192.168.2.128 255.255.255.224
    default-router 192.168.2.158
    dns-server 192.168.2.161
    ip dhcp pool vlan40
    network 192.168.2.160 255.255.255.224
    default-router 192.168.2.190
    dns-server 192.168.2.161
    ip dhcp pool vlan50
    network 192.168.2.192 255.255.255.240
    default-router 192.168.2.206
    dns-server 192.168.2.161
    !
    ip cef
    no ipv6 cef
    !
    !
    !
    username admin secret 5 $1$Blqb$NPsUIq4PINtKjeJR8AraO0
    !
    !
    crypto isakmp policy 10
    hash md5
    authentication pre-share
    group 2
    !
    crypto isakmp key saigonhanoi address 200.0.0.2
    !
    !
    crypto ipsec security-association lifetime seconds 1800
    !
    crypto ipsec transform-set vpnset esp-des esp-md5-hmac
    !
    crypto map vpnmap 10 ipsec-isakmp
    set peer 200.0.0.2
    set security-association lifetime seconds 1800
    set transform-set vpnset
    match address 100
    !
    !
    !
    !
    !
    !
    spanning-tree mode pvst
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    description "ket noi toi ISP"
    ip address 200.0.0.6 255.255.255.252
    duplex auto
    speed auto
    crypto map vpnmap
    !
    interface FastEthernet0/1
    no ip address
    duplex auto
    speed auto
    !
    interface FastEthernet0/1.10
    encapsulation dot1Q 10
    ip address 192.168.2.62 255.255.255.192
    !
    interface FastEthernet0/1.20
    encapsulation dot1Q 20
    ip address 192.168.2.126 255.255.255.192
    !
    interface FastEthernet0/1.30
    encapsulation dot1Q 30
    ip address 192.168.2.158 255.255.255.224
    !
    interface FastEthernet0/1.40
    encapsulation dot1Q 40
    ip address 192.168.2.190 255.255.255.224
    !
    interface FastEthernet0/1.50
    encapsulation dot1Q 50
    ip address 192.168.2.206 255.255.255.240
    !
    interface Vlan1
    no ip address
    !
    ip classless
    ip route 0.0.0.0 0.0.0.0 200.0.0.9
    ip route 0.0.0.0 0.0.0.0 200.0.0.5
    !
    ip flow-export version 9
    !
    !
    access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
    !
    !
    !
    !
    !
    line con 0
    login local
    !
    line aux 0
    !
    line vty 0 4
    login local
    !
    !
    !
    end


    +++++++++++++++++++++++++++++++++++++++++++++++
    thông tin cấu hình trên router NH-HCM
    !
    version 12.4
    service timestamps log datetime msec
    service timestamps debug datetime msec
    service password-encryption
    !
    hostname NM-HCM
    !
    !
    !
    enable secret 5 $1$2Jwq$uMPQaFMmYb3yeqwhCs8Ut0
    !
    !
    !
    !
    ip cef
    no ipv6 cef
    !
    !
    !
    username admin secret 5 $1$f22E$3OqCWMxKJ9xBpwZv8db3r/
    !
    !
    crypto isakmp policy 10
    hash md5
    authentication pre-share
    group 2
    !
    crypto isakmp key saigonnhamay address 200.0.0.2
    !
    !
    crypto ipsec security-association lifetime seconds 1800
    !
    crypto ipsec transform-set vpnset esp-des esp-md5-hmac
    !
    crypto map vpnmap 10 ipsec-isakmp
    set peer 200.0.0.2
    set security-association lifetime seconds 1800
    set transform-set vpnset
    match address 100
    !
    !
    !
    !
    !
    !
    spanning-tree mode pvst
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    no ip address
    duplex auto
    speed auto
    shutdown
    !
    interface FastEthernet0/1
    description "ket noi toi Lan NM-HCM"
    ip address 192.168.4.254 255.255.255.0
    duplex auto
    speed auto
    !
    interface Serial0/0/0
    description "ket noi toi ISP"
    ip address 200.0.0.10 255.255.255.252
    clock rate 2000000
    crypto map vpnmap
    !
    interface Serial0/0/1
    no ip address
    clock rate 2000000
    shutdown
    !
    interface Vlan1
    no ip address
    !
    ip classless
    ip route 0.0.0.0 0.0.0.0 200.0.0.9
    !
    ip flow-export version 9
    !
    !
    access-list 100 permit ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255
    !
    !
    !
    !
    !
    line con 0
    login local
    !
    line aux 0
    !
    line vty 0 4
    login local
    !
    !
    !
    end





    ++++++++++++++++++++++++++++++++++++++

    hiện tại em đã cấu hình thành công trên mô hình ảo packet tracer rồi vpn từ saigon => hanoi, saigon => nh-hcm

    nhưng khi em triển khai thực tế thì chỉ được 1 site ping thấy nhau cùng một thời điểm nghĩa là saigon => hanoi hoặc saigon => nh-hcm

    hiện tại router em dùng phiên bản: c1841-adventerprisek9-mz.151-2.T.bin không biết có được không em thấy trên cisco packet tracer dùng pb: c1841-advipservicesk9-mz.124-15.T1.bin

    không biết là router 1841 có hỗ trợ multivpn không?

    mong anh em cho em ý kiến
    Last edited by tranvoluong; 06-07-2015, 07:05 PM.
    Tags: None
  • #2
    cấu hình mẫu giống yêu cầu của em:

    Multiple Site to Site VPN on single cisco Router.
    https://supportforums.cisco.com/discussion/11953996/multiple-site-site-vpn-single-cisco-router
    Hello Network Admins, I need your help here configuring additional Site to Site VPN on Cisco router. Note: Site-A = Head office          Site-B= Branch office -----------> Public IP : 87.101.54.74          Site-C= Branch office -----------> Public IP : 87.101.80.94 Site to Site VPN is configured ...


    Đặng Quang Minh, CCIEx2#11897 (Enterprise Infrastructure, Wireless), DEVNET, CCSI#31417

    Email : dangquangminh@vnpro.org
    https://www.facebook.com/groups/vietprofessional/

    Comment

    • #3
      Originally posted by dangquangminh View Post
      cấu hình mẫu giống yêu cầu của em:

      Multiple Site to Site VPN on single cisco Router.
      https://supportforums.cisco.com/discussion/11953996/multiple-site-site-vpn-single-cisco-router
      Hello Network Admins, I need your help here configuring additional Site to Site VPN on Cisco router. Note: Site-A = Head office          Site-B= Branch office -----------> Public IP : 87.101.54.74          Site-C= Branch office -----------> Public IP : 87.101.80.94 Site to Site VPN is configured ...

      Dạ em đã làm được rồi, em cám ơn anh nhiều ạ!

      Em làm theo bài này và nhờ có cái note nhỏ của họ mà được đấy.

      Configuring IPSec Router-to-Router Hub and Spoke with Communication Between the Spokes
      http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/7912-ios-hub-spoke2.html
      This sample configuration shows a hub and spoke IPsec design between three routers. This configuration differs from other hub and spoke configurations because in this example, communication is enabled between the spoke sites by going through the hub. In other words, there is not a direct IPsec tunnel between the two spoke routers. All packets are sent across the tunnel to the hub router where it redistributes them out the IPsec tunnel shared with the other spoke router. This configuration is possible as a result of the resolution to Cisco bug ID CSCdp09904. This fix was integrated into Cisco IOS? Software Release 12.2(5) and this release is the minimum requirement for this configuration.

      Comment

      Previous template Next
      Working...
      X