實驗目的：
R1爲總公司的HUB端提供***接入，R6模擬internet，R2和R3模擬分公司SPOKE端，R2爲靜態IP，R3爲動態IP。運行eigrp學習內網路由，R2訪問R3不經過總公司R1，而通過R2和R3之間建立的SPOKE TO SPOKE信道來通信。
最終結果如下:
分公司R3經過一跳（分公司R2的tunnel地址）直接到達分公司R2內網。
r3#traceroute 2.2.2.2 source 3.3.3.3
Type escape sequence to abort.
Tracing the route to 2.2.2.2
1 123.123.123.2 16 msec * 36 msec
實驗拓撲圖：
實驗配置：
R6只需要配置端口ip地址，但必須配置一條指向總公司R1的靜態路由
R1總公司配置：
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key meng address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
mode transport //此處模式也可以是tunnel，默認就是是tunnel模式。
!
crypto ipsec profile gezi //定義ipsec profile
set transform-set myset
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface Tunnel0
ip address 123.123.123.1 255.255.255.0
no ip redirects
ip mtu 1400 //設置分片
//配置嚇一跳屬性，否則SPOKE TO SPOKE之間的通信必須經過HUB，加大了HUB的負載。
no ip next-hop-self eigrp 1
ip nhrp authentication meng //nhrp認證，不配置也行
ip nhrp map multicast dynamic //映射爲動態
ip nhrp network-id 10 //HUB和SPOKE network-id必須一致
ip nhrp cache non-authoritative
no ip split-horizon eigrp 1 //關閉eigrp水平分割，否則R2和R3之間相互學習不到路由
tunnel source 16.16.16.1 //因爲是DM***，所以只需指定source，不需指定destination
tunnel mode gre multipoint //必須指定模式爲GER
tunnel key 123456 //通道認證key
tunnel protection ipsec profile gezi 調用ipsec profile
!
interface Serial1/1
ip address 16.16.16.1 255.255.255.0
serial restart-delay 0
clock rate 64000
!
//宣告內網和tunnel接口地址，千萬不能宣告外網接口地址！並且最好精確宣告！否則會造成鄰居不穩定，瘋狂發包！
router eigrp 1
network 1.1.1.0 0.0.0.255
network 123.123.123.0 0.0.0.255
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 16.16.16.6
R2配置：
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key meng address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
mode transport
!
crypto ipsec profile gezi
set transform-set myset
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface Tunnel0
ip address 123.123.123.2 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication meng
ip nhrp map 123.123.123.1 16.16.16.1 //將nhrp的server的 tunnel地址與外網地址映射
ip nhrp map multicast 16.16.16.1 //配置將路由協議用到的組播包轉發給server16.16.16.1
ip nhrp network-id 10
ip nhrp nhs 123.123.123.1 //指定nh server地址（總公司R1 tunnel的地址）
ip nhrp cache non-authoritative
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 123456
tunnel protection ipsec profile gezi
!
interface FastEthernet0/0
ip address 26.26.26.2 255.255.255.0
duplex auto
speed auto
!
router eigrp 1
network 2.2.2.0 0.0.0.255
network 123.123.123.0 0.0.0.255
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 26.26.26.6
!
R3配置和R2基本完全相同 差別只在接口地址和tunnel地址的不同