1、反向路由注入R 1 R 4R 3R 2S i t e AI n t e r n e tS i t e BI n s i d eR1 R2 R3 R4预配interface Loopback0ip address 1.1.1.1 255.255.255.255interface Serial1/1ip address 10.1.12.1 255.255.255.0serial restart-delay 0ip route 0.0.0.0 0.0.0.0 10.1.12.2预配interface Loopback0ip address 2.2.2.2 255.255.255.255interfa
2、ce Serial1/0ip address 10.1.12.2 255.255.255.0serial restart-delay 0interface Serial1/1ip address 10.1.23.2 255.255.255.0serial restart-delay 0预配interface Loopback0ip address 3.3.3.3 255.255.255.255interface Serial1/0ip address 10.1.23.3 255.255.255.0serial restart-delay 0interface Serial1/1ip addre
3、ss 10.1.34.3 255.255.255.0serial restart-delay 0router ospf 1log-adjacency-changesnetwork 10.1.34.3 0.0.0.0 area 0ip route 0.0.0.0 0.0.0.0 10.1.23.2预配interface Loopback0ip address 4.4.4.4 255.255.255.255interface Serial1/0ip address 10.1.34.4 255.255.255.0serial restart-delay 0router ospf 1log-adjac
4、ency-changesnetwork 0.0.0.0 255.255.255.255 area 0配置一个 L2L 的VPNaccess-list 100 permit ip host 1.1.1.1 host 4.4.4.4crypto isakmp policy 10authentication pre-sharecrypto isakmp key cisco address 10.1.23.3crypto ipsec transform-set cisco esp-3des esp-md5-hmac crypto map cisco 配置一个 L2L 的 VPNaccess-list
5、100 permit ip host 4.4.4.4 host 1.1.1.1crypto isakmp policy 10authentication pre-sharecrypto isakmp key cisco address 10.1.12.1crypto ipsec transform-set cisco esp-3des esp-md5-hmac crypto map cisco 10 ipsec-isakmp set peer 10.1.12.1set transform-set cisco match address 100interface Serial1/010 ipse
6、c-isakmp set peer 10.1.23.3set transform-set cisco match address 100interface Serial1/1ip address 10.1.12.1 255.255.255.0serial restart-delay 0crypto map ciscoip address 10.1.23.3 255.255.255.0serial restart-delay 0crypto map ciscoSiteB 去不了 SiteA，因为在 Inside 中并没有去往 1.1.1.1 的路由通过在 SiteB 上写一个静态路由，重分发进O
7、SPF 中，让 Inside 学到去 1.1.1.1 的路由crypto map cisco 10 ipsec-isakmp reverse-route（当产生 sa 的时候，会产生一条静态路由）*在做试验的时候，如果对这个命令后面加关键字的时候，要记得清IPSEC 连接状态，因为反向路由是在 IPSEC 连接后才产生的*router ospf 1redistribute static subnets reverse-route +关键字 static (直一但触发了ipsec sa 会一直产生一个静态路由，即使ipsec sa 超时也不会消失)+关键字 tag (为产生的反向路由加个 tag 标记，当重分发进 OPSF 的时候，可以做 route-map 精确匹配)+关键字 remote-peer (在GREoverIPsec 中使用，静态指定下一跳)在做热备份网关的时候，+static 关键字是不可以的，这样可能会对内部产生固定的静态路由，引起主网关失效后不能切换到备份网关必须并设置 DPD）
