R1模拟总部，R2 与R3模拟分部
如图配置
要求使用 GRE over IPSec VPN 主模式，启用动态路由协议rip使得总部与两分部内网可相互通讯，但要求分部用户数据流不允许互通！
步骤：
1、 完成GRE隧道的配置
[RT1-Tunnel10]ip add 10.0.1.1 24
[[RT1-Tunnel10]source 67.61.1.1
[RT1-Tunnel10]destination 202.112.1.1
[RT1-Tunnel10]keepalive
[RT4-Tunnel10]ip add 10.0.1.2 24
[RT4-Tunnel10]source 202.112.1.1
[RT4-Tunnel10]destination 67.61.1.1
[RT1-Tunnel20]ip add 10.0.2.1 24
[RT1-Tunnel20]source 67.61.1.1
[RT1-Tunnel20]destination 202.112.2.1
[RT3-Tunnel20]ip add 10.0.2.2 24
[RT3-Tunnel20]source 202.112.2.1
[RT3-Tunnel20]destination 67.61.1.1
[RT3-Tunnel20]keepalive
2、 配置RIP协议
[RT1-rip-1]version 2
[RT1-rip-1]undo summary
[RT1-rip-1]network 172.16.0.0
[RT1-rip-1]network 10.0.1.0
[RT3-rip-1]version 2
[RT3-rip-1]undo summary
[RT3-rip-1]network 192.168.2.0
[RT3-rip-1]network 10.0.0.0
[RT4-rip-1]version 2
[RT4-rip-1]undo summary
[RT4-rip-1]network 10.0.0.0
[RT4-rip-1]network 192.168.1.0
3、 配置IKE peer
[RT1-ike-peer-rt4]proposal 1
[RT1-ike-peer-rt4]pre-shared-key simple cisco
[RT1-ike-peer-rt4]remote-address 202.112.1.1
[RT1-ike-peer-rt3]proposal 2
[RT1-ike-peer-rt3]pre-shared-key simple cisco
[RT1-ike-peer-rt3]remote-address 202.112.2.1
[RT4-ike-peer-rt1]proposal 1
[RT4-ike-peer-rt1]pre-shared-key simple cisco
[RT4-ike-peer-rt1]remote-address 67.61.1.1
[RT3-ike-peer-rt1]proposal 1
[RT3-ike-peer-rt1]pre-shared-key simple cisco
[RT3-ike-peer-rt1]remote-address 67.61.1.1
4、 配置 ipsec
policy
[RT1-acl-adv-3001]rule permit ip source 67.61.1.1 0
destination 202.112.1.1 0
[RT1-acl-adv-3002]rule permit ip source 67.61.1.1 0
destination 202.112.1.1 0
[RT1-ipsec-policy-isakmp-h3c-1]security acl 3001
[RT1-ipsec-policy-isakmp-h3c-1]ike-peer rt4
[RT1-ipsec-policy-isakmp-h3c-1]proposal rt4
[RT1-ipsec-policy-isakmp-h3c-2]security acl 3002
[RT1-ipsec-policy-isakmp-h3c-2]ike-peer rt3
[RT1-ipsec-policy-isakmp-h3c-2]proposal rt3
[RT3-acl-adv-3000]rule permit ip source 202.112.1.1 0
destination 67.61.1.1 0
[RT3-ipsec-policy-isakmp-h3c-1]security acl 3000
[RT3-ipsec-policy-isakmp-h3c-1]ike-peer rt1
[RT3-ipsec-policy-isakmp-h3c-1]proposal 1
[RT4-acl-adv-3000]rule permit ip source 202.112.2.1 0
destination 67.61.1.1 0
[RT4-ipsec-policy-isakmp-h3c-1]security acl 3000
[RT4-ipsec-policy-isakmp-h3c-1]ike-peer rt1
[RT4-ipsec-policy-isakmp-h3c-1]proposal 1
5、 应用ipsec
policy到接口
[RT1-GigabitEthernet0/0/0]ipsec policy h3c
[RT3-GigabitEthernet0/0/3]ipsec policy h3c
[RT4-GigabitEthernet0/0/2]ipsec policy h3c
6、 过滤RIP路由
[RT1-acl-basic-2000]rule deny source 192.168.2.0 0.0.0.255
[RT1-acl-basic-2000]rule deny source 192.168.1.0 0.0.0.255
[RT1-rip-1]filter-policy 2000 export
7、 测试
192.168.1.100 ping
172.16.1.100
192.168.2.100 ping 172.16.1.100
查看RT4的路由表
查看RT1的IKE SA