通过使用两台物理主机，分别模拟公司及家庭端网络。两台物理主机都连接在一台TP-link家用宽带路由器上，模拟Internet环境。两块虚拟网卡分别绑定一台VMware虚拟机。目的是通过×××，实现两台VMware虚拟机之间的访问。
公司端网络拓扑
公司端路由器配置如下：
Building configuration...
Current configuration : 1716 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authorization network ***-client-user local
aaa session-id common
ip subnet-zero
!
!
!
!
no ip domain lookup
ip ssh break-string
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr aes
hash md5
authentication pre-share
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco address 192.168.0.50
!
crypto isakmp client configuration group ***-client-user
key cisco
pool ×××DHCP
!
!
crypto ipsec transform-set benet ah-md5-hmac esp-aes
crypto ipsec transform-set R1 esp-3des esp-sha-hmac
!
crypto dynamic-map dy*** 10
set transform-set R1
reverse-route
!
!
crypto map map1 1 ipsec-isakmp
set peer 192.168.0.50
set transform-set benet
match address 101
!
crypto map dy*** isakmp authorization list ***-client-user
crypto map dy*** client configuration address respond
crypto map dy*** 1 ipsec-isakmp dynamic dy***
!
!
!
!
!
interface FastEthernet0/0
ip address 192.168.0.254 255.255.255.0
duplex auto
speed auto
crypto map dy***
!
interface FastEthernet0/1
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
crypto map map1
!
ip local pool ×××DHCP 192.168.3.100 192.168.3.150
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.50
!
no ip http server
no ip http secure-server
!
!
access-list 101 permit ip host 192.168.3.200 host 172.16.0.200
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end
家庭端的网络拓扑
家庭端路由器配置如下：
Current configuration : 1010 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
!
no ip domain lookup
ip ssh break-string
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
no crypto isakmp enable
!
!
!
!
!
interface FastEthernet0/0
ip address 192.168.0.50 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 172.16.0.1 255.255.0.0
ip nat inside
duplex auto
speed auto
!
ip nat pool djy 192.168.0.200 192.168.0.220 netmask 255.255.255.0
ip nat inside source list 1 pool djy overload
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.254
!
no ip http server
no ip http secure-server
!
!
access-list 1 permit 172.16.0.0 0.0.0.255
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end
Cisco *** client的配置如下：
参考链接：