重慶分公司
重慶分公司，新征程啟航
為企業提供網站建設、域名注冊、服務器等服務
ISAKMPProfile技術應用
創新互聯專注于企業營銷型網站建設、網站重做改版、寧津網站定制設計、自適應品牌網站建設、H5技術、商城網站建設、集團公司官網建設、外貿營銷網站建設、高端網站制作、響應式網頁設計等建站業務，價格優惠性價比高，為寧津等各大城市提供網站開發制作服務。
ISAKMP Profile技術是IKE協商的一種新型配置方式。它主要的作用是映射我們第一階段ISAKMP參數到第
二階段IPSec隧道，可以實現一個設備和多個站點建立多個隧道。還可以很好的消除不同×××之間的影
響，讓第一階段策略和第二階段策略關聯的更加緊密。并且ISAKMP Profile普遍在EZ×××和VRF-ware
IPSec ×××配置里邊被采用。
Site1 ：
crypto keyring ccie
pre-shared-key address 61.128.1.1 key cisco
!
crypto isakmp policy 100
encr 3des
authentication pre-share
group 2
crypto isakmp profile isaprof
keyring ccie
match identity address 61.128.1.1 255.255.255.255
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map ccie 10 ipsec-isakmp
set peer 61.128.1.1
set transform-set myset
set isakmp-profile isaprof
match address ***
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
crypto map ccie
!
ip route 0.0.0.0 0.0.0.0 202.100.1.10
!
ip access-list extended ***
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255
Internet：
interface FastEthernet0/0
ip address 202.100.1.10 255.255.255.0
!
interface FastEthernet0/1
ip address 61.128.1.10 255.255.255.0
！
end
Site2:
crypto keyring ccie
pre-shared-key address 202.100.1.1 key cisco
!
crypto isakmp policy 100
encr 3des
authentication pre-share
group 2
crypto isakmp profile isaprof
keyring ccie
match identity address 202.100.1.1 255.255.255.255
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map ccie 10 ipsec-isakmp
set peer 202.100.1.1
set transform-set myset
set isakmp-profile isaprof
match address ***
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface FastEthernet0/0
ip address 61.128.1.1 255.255.255.0
crypto map ccie
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 61.128.1.10
!
ip access-list extended ***
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
!
測試：
Site1#ping 2.2.2.2 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/133/148 ms
Site1#show crypto ipsec sa
interface: FastEthernet0/0
Crypto map tag: ccie, local addr 202.100.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (2.2.2.0/255.255.255.0/0/0)
current_peer 61.128.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 202.100.1.1, remote crypto endpt.: 61.128.1.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0x96AB8F14(2527825684)
inbound esp sas:
spi: 0xF41D2511(4095550737)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 1, flow_id: SW:1, crypto map: ccie
sa timing: remaining key lifetime (k/sec): (4566332/2033)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x96AB8F14(2527825684)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2, flow_id: SW:2, crypto map: ccie
sa timing: remaining key lifetime (k/sec): (4566332/2031)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
Site1#show crypto session
Crypto session current status
Interface: FastEthernet0/0
Profile: isaprof
Session status: UP-ACTIVE
Peer: 61.128.1.1 port 500
IKE SA: local 202.100.1.1/500 remote 61.128.1.1/500 Active
IPSEC FLOW: permit ip 1.1.1.0/255.255.255.0 2.2.2.0/255.255.255.0
Active SAs: 2, origin: crypto map
本文標題：ISAKMPProfile技術應用
標題來源：http://www.xueling.net.cn/article/jihhjs.html