***

一、實驗拓撲：

二、實驗步驟：

===============================

r1:
int s1/2
ip add 12.1.1.1 255.255.255.0
no shu
int l0
ip add 1.1.0.1 255.255.255.0
int l1
ip add 1.1.1.1 255.255.255.0
int l2
ip add 1.1.2.1 255.255.255.0
int l3
ip add 1.1.3.1 255.255.255.0
int l4
ip add 1.1.4.1 255.255.255.0
int l5
ip add 1.1.5.1 255.255.255.0
int l6
ip add 1.1.6.1 255.255.255.0
int l7
ip add 1.1.7.1 255.255.255.0
int l8
ip add 1.1.8.1 255.255.255.0

router os 110
router-id 1.1.1.1
net 12.1.1.1 0.255.255.255 a 0
ip route 0.0.0.0 0.0.0.0 s1/2
ip route 4.4.0.0 255.255.0.0 192.168.1.2

---------------------------------------

r2:
int s1/3
ip add 12.1.1.2 255.255.255.0
no shu
int s1/2
ip add 23.2.2.2 255.255.255.0
no shu
int l0
ip add 2.2.2.2 255.255.255.0
router os 110
router-id 2.2.2.2
net 12.1.1.1 0.255.255.255 a 0
net 23.2.2.2 0.255.255.255 a 0
net 2.2.2.2 0.255.255.255 a 0

---------------------------------------

r3:
int s1/3
ip add 23.2.2.3 255.255.255.0
no shu
int s1/2
ip add 34.3.3.3 255.255.255.0
no shu
int l0
ip add 3.3.3.3 255.255.255.0
router os 110
router-id 3.3.3.3
net 23.2.2.2 0.255.255.255 a 0
net 34.3.3.3 0.255.255.255 a 0
net 3.3.3.3 0.255.255.255 a 0

-------------------------------------------

r4:
int s1/3
ip add 34.3.3.4 255.255.255.0
no shu
int l0
ip add 4.4.0.4 255.255.255.0
int l1
ip add 4.4.1.4 255.255.255.0
int l2
ip add 4.4.2.4 255.255.255.0
int l3
ip add 4.4.3.4 255.255.255.0
int l4
ip add 4.4.4.4 255.255.255.0
int l5
ip add 4.4.5.4 255.255.255.0
int l6
ip add 4.4.6.4 255.255.255.0
int l7
ip add 4.4.7.4 255.255.255.0
int l8
ip add 4.4.8.4 255.255.255.0

router os 110
router-id 4.4.4.4
net 34.3.3.3 0.255.255.255 a 0

ip route 0.0.0.0 0.0.0.0 s1/3
ip route 1.1.0.0 255.255.0.0 192.168.1.1

==========================================================================================

***的配置

r-1:

crypto isakmp policy 1
authentication pre-share
group 1
encryption 3des
hash sha
exit
crypto isakmp key 0 ccna address 34.3.3.4
crypto ipsec transform-set ccnp ah-md5-hmac esp-3des
exit
crypto map ccie 10 ipsec-isakmp
set peer 34.3.3.4
set transform-set ccnp
match address 100
exit
int tunnl 0
ip add 192.168.1.1 255.255.255.0
tunnl source 12.1.1.1
tunnle destination 34.3.3.4
no ip directed-broadcast
crypto map ccie
exit
int s1/2
no ip directed-broadcast
crypto map ccie
exit
<access-list 100 permit gre host 12.1.1.1 host 34.3.3.4>
access-list 100 permit ip 1.1.0.0 0.0.255.255 4.4.0.0 0.0.255.255

#################################################################################################r-4:p

crypto isakmp policy 1
authentication pre-share
group 1
encryption 3des
hash sha
exit
crypto isakmp key 0 ccna address 12.1.1.1
crypto ipsec transform-set ccnp ah-md5-hmac esp-3des
exit
crypto map ccie 10 ipsec-isakmp
set peer 12.1.1.1
set transform-set ccnp
match address 100
exit
int tunnel 0
ip add 192.168.1.2 255.255.255.0
no ip directed-broadcast
crypto map ccie
exit
int s1/3
no ip directed-broadcast
crypto map ccie
exit
<access-list 100 permit gre host 34.3.3.4 host 12.1.1.1>
access-list 100 permit ip 4.4.0.0 0.0.255.255 1.1.0.0 0.0.255.255