GB0-392（安全优化）

RTA: 

[RTA] iKe peer 123

[RTA-ike-peer-123] pre-shared-ke simple 123

[RTA-ike-peer-123] remote-address 10.2.1. 2

[RTA-ike-peer-123] local-address 10.2.1.1 

[RTA-ike-peer-123]quit

[RTA] ipsec proposal 1。

[RTA-ipsec-proposal-1] quit

[RTA]acl number 3000

[RTA-acl-adv-3000] rule0 permit ip source 10.1.1.00.255.255.255

[RTA]ipsec polic 1 1 isakmp

[RTA-ipsec-polic-isakmp-1 -1 ] securit acl 3000 

[RTA-ipsec-polic-isakmp-1 -1 ] ike-peer 123

[RTA-ipsec-polic-isakmp-1 -1 ] proposal 1

[RTA-ipsec-polic-isakmp-1-1] quit

[RTA] interface Ethernet 0/1/0

[RTA-Serial0/2/1] ip address 10.1.1.2 255.255.255.0

[RTA]interface Serial0/2/1

[RTA-SerialO/2/1] ip address 10.2.1.1 255.255.255.0 

[RTA-Serial0/2/1] ipsec polic 1

RTB:

[RTB]ike peer 123

[RTB-ike-peer-123] pre-shared-ke simple 123

[RTB-ike-peer-123] remote-address 10.2.1.1

[RTB-ike-peer-123] local-address 10.2.1.2

[RTB-ike-peer-123]quit

[RTB] ipsec proposal 1

[RTB-ipsec-proposal-1] quit

[RTB]acl number 3000

[RTB-acl-adv-3000] rule 0 permit ip source 10.3.1.0 0.255.255.255 

[RTB]ipsec polic 1 1 isakmp

[RTB-ipsec-polic-isakmp-1-1] securit acl 3000

[RTB-ipsec-polic-isakmp-1-1] ike-peer 123

[RTB-ipsec-polic-isakmp-1-1] proposal 1

[RTB-ipsec-polic-isakmp-1-1] quit

[RTA]interface Ethernet 0/1/0

[RTA-Serial0/2/1] ipaddress 10.3.1.1 255.255.255.0

[RTB]interface Serial0/2/1

[RTB-SerialO/2/1] ip address 10.2.1.2 255.255.255.0

[RTB-SerialO/2/1] ipsec polic 1

由此可知

RTA：

[RTA] ike peer 123

[RTA-ike-peer-123] pre-shared-ke simple 123

[RTA-ike-peer-123] remote-address 10.2.1.2

[RTA-ike-peer-123] local-address 10.2.1.1

[RTA-ike-peer-123]quit

[RTA] ipsec proposal 1

[RTA-ipsec-proposal-1 ] quit

[RTA]acl number 3000

[RTA-acl-adv-3000] rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.3.1.0 0.0.0.255 

[RTA]ipsec polic 1 1 isakmp

[RTA-ipsec-polic-isakmp-1-1] securit acl 3000

[RTA-ipsec-polic-isakmp-1 -1 ] ike-peer 123

[RTA-ipsec-polic-isakmp-1 -1 ] proposal 1

[RTA-ipsec-polic-isakmp-1 -1 ] quit

[RTA] interface Serial0/2/1

[RTA-Serial0/2/1] ip address 10.2.1.1 255.255.255.0

[RTA-Serial0/2/1] ipsec polic 1

[RTA]interface Ethernet 0/1/0

[RTA-Serial0/2/1] ip address 10.1.1.2 255.255.255.0

RTB：

[RTB]ike peer 123

[RTB-ike-peer-123] pre-shared-ke simple 123

[RTB-ike-peer-123] remote-address 10.2.1.1

[RTB-ike-peer-123] local-address 10.2.1.2

[RTB-ike-peer-123]quit

[RTB] ipsec proposal 1 

[RTB-ipsec-proposal-1] quit

[RTB]acl number 3000

[RTB-acl-adv-3000] rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 10.3.1.0 .0.0.255

[RTB]ipsec polic 1 1 isakmp

[RTB-ipsec-polic-isakmp-1-1] securit acl 3000

[RTB-ipsec-polic-isakmp-1 -1 ] ike-peer 123

[RTB-ipsec-polic-isakmp-1-1] proposal 1

[RTB-ipsec-polic-isakmp-1-1] quit

[RTB] interface Serial/2/1

[RTB-Serial0/2/1]ip address 10.2.1.2 255.255.255.0

[RTB-Serial0/2/1] ipsec polic 1

[RTA] interface Ethernet 0/1/0

[RTA-Serial0/2/1]ip address 10.1.3.1 255.255.255.0

由此可知 。

（含图）

 spi: 909448761 (0x36351639)

proposal: ESP-ENCRPT-DES ESP-AUTH-MD5 

sa remaining ke duration (btes/sec): 1887435204/83 max received sequence-number: 19 udp encapsulation used for nat traversal: N

[outbound ESP SAs]

spi: 1583842120 (0x5e678348)

proposal: ESP-ENCRPT-DES ESP-AUTH-MD5

sa remaining ke duration (btes/sec): 1887435204/83

max sent sequence-number: 20

udp encapsulation used for nat traversal: N

Interface: Seri al 0/2/1 path MTU: 1500

IPsec polic name: "1" sequence number: 1 mode: isakmp

connection id: 5

encapsulation mode: transport 

perfect forward secrec: None

 tunnel:

local address: 10.2.1.1

remote address: 10.2.1.2

Flow :

souraddr: 10.1.1.0/255.255.255.0 port: 0 protocol: IP 

dest addr: 10.3.1.0/255.255.255.0 port: 0 protocol: IP

[inbound ESP SAs]

spi: 909448761 (0x36351639)

proposal: ESP-ENCRPT-DES ESP-AUTH-MD5

sa remaining ke duration (btes/sec): 1887435204/8

max received sequence-number: 19 

udp encapsulation used for nat traversal: N

[outbound ESP SAs]

spi: 1583842120 (0x5e678348)

proposal: ESP-ENCRPT-DES ESP-AUTH-MD5

sa remaining ke duration (btes/sec): 1887435204/83

max sent sequence-number: 20

udp encapsulation used for nat traversal: N