IPsec Site-to-Site VPN 實驗配置範例 (Cisco 路由器)

實驗拓撲

PC1 (192.168.10.0/24) -- R1 -- Internet -- R2 -- PC2 (172.16.0.0/16)
R1 WAN: 10.1.1.1/24
R2 WAN: 10.1.1.2/24

R1 配置

! IKE 階段 1
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco address 10.1.1.2

! IPsec 階段 2
crypto ipsec transform-set TEST000 esp-3des esp-md5-hmac

! IPsec 應用
crypto map SDM_CMAP_1 1 ipsec-isakmp
 description Tunnel to 10.1.1.2
 set peer 10.1.1.2
 set transform-set TEST000
 match address 100

! 介面綁定
interface FastEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 crypto map SDM_CMAP_1

interface FastEthernet1/0
 ip address 192.168.10.1 255.255.255.0

! 路由與 ACL
ip route 0.0.0.0 0.0.0.0 10.1.1.2
access-list 100 permit ip 192.168.10.0 0.0.0.255 172.16.0.0 0.0.255.255

! 可選 PAT
ip nat inside source list 102 interface FastEthernet0/0 overload

R2 配置 (鏡像對稱)

crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco address 10.1.1.1

crypto ipsec transform-set TEST000 esp-3des esp-md5-hmac

crypto map SDM_CMAP_1 1 ipsec-isakmp
 description Tunnel to 10.1.1.1
 set peer 10.1.1.1
 set transform-set TEST000
 match address 100

interface FastEthernet0/0
 ip address 10.1.1.2 255.255.255.0
 crypto map SDM_CMAP_1

interface FastEthernet1/0
 ip address 172.16.0.1 255.255.0.0

ip route 0.0.0.0 0.0.0.0 10.1.1.1
access-list 100 permit ip 172.16.0.0 0.0.255.255 192.168.10.0 0.0.0.255

關鍵點核對清單

• IKE 策略 (加密/哈希/DH 組/認證) 雙端完全一致
• Pre-shared key 字串一致
• Transform-set 協議 (ESP-3DES/MD5-HMAC) 一致
• ACL (match address) 為鏡像關係：R1 src=192.168.10.0 dst=172.16.0.0，R2 相反
• 介面綁定 crypto map 正確
• 路由確保雙向可達

驗證命令

show crypto isakmp sa      # IKE SA 狀態
show crypto ipsec sa       # IPsec SA 狀態
show crypto map            # 應用的 crypto map
ping 172.16.0.1 source 192.168.10.1  # 測試通訊