网络工程 - 具有隐藏本地网络的 Cisco IPSEC 隧道 - 吾爱随笔录

我有一个 ipsec 隧道已启动并与 ATT 合作。他们要求第 2 阶段 IP 不是本地 LAN，而是公共 IP。

所以，我的第 1 阶段是 XXX132，我的第 2 阶段与 XXX133 在同一个子网中。如果我从 133 ping 远程路由器的环回，我会得到回复。如果我对我的 LAN ip 进行 0.133 的一对一 nat，我也可以 ping 他们的本地环回。

该隧道旨在隐藏我们的本地 LAN，它们只接受来自我本地 .133 地址的流量。我花了一整天的时间试图设置从我的本地 LAN 到我的第 2 阶段 IP、路由等的过载，但我无法让它工作。

有人有什么建议吗？如果您愿意，我可以发布配置。

编辑：IOS，如果需要，我可以放入一个 ASA。配置：

!
crypto isakmp policy 26
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key KEY_HERE address 1.0.0.132
!
crypto ipsec transform-set E_SET esp-3des esp-sha-hmac
!
crypto map EBIZ 26 ipsec-isakmp
 set peer 1.0.0.132
 set transform-set E_SET
 set pfs group2
 match address NONPROFIT_TO_ATT
!
interface GigabitEthernet0/0
 ip address 2.0.0.132 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip verify unicast source reachable-via rx allow-default 100
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no mop enabled
 crypto map EBIZ
!
interface GigabitEthernet0/1
 ip address 10.45.0.4 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no mop enabled
!
ip forward-protocol nd
!
ip route 0.0.0.0 0.0.0.0 2.0.0.129
!
ip access-list standard NAT-SOURCE-NETS
 permit 10.45.0.0 0.0.0.255
!
ip access-list extended E_SET
 permit ip host 2.0.0.133 host 1.0.0.131
ip access-list extended NONPROFIT_TO_ATT
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.7.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.8.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
!
logging trap debugging
logging facility local2
access-list 100 permit udp any any eq bootpc
access-list 111 permit ip any any
dialer-list 1 protocol ip permit
!
route-map NAT-SOURCE-NETS permit 20
 match ip address NAT-SOURCE-NETS
!
ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 32
ip nat source route-map NAT-SOURCE-NETS pool inside_pool overload
ip nat outside source route-map NAT-SOURCE-NETS pool inside_pool
!

以及许多其他项目，具有不同的路由。