配置 Cisco VPN 5000 与路由器，以打开一条 GRE 隧道

简介

本文提供要求的配置的概述，该配置允许运行Cisco IOS®软件的路由器和Cisco VPN 5000系列集中器打开通用路由封装(GRE)隧道。

先决条件

要求

本文档没有任何特定的要求。

使用的组件

本文档中的信息基于以下软件和硬件版本：

• Cisco IOS 软件版本 12.0(7)T

• Cisco VPN 5000集中器软件版本5.2.19US

• Cisco VPN 5002 集中器

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

规则

有关文档规则的详细信息，请参阅 Cisco 技术提示规则。

配置

本部分提供有关如何配置本文档所述功能的信息。

注：要查找有关本文档中所用命令的其他信息，请使用命令查找工具(仅限注册用户)(仅限注册客户)。

网络图

本文档使用此图所示的网络设置。

配置

本文档使用此处所示的配置。

• Cisco VPN 5002 集中器

• 运行Cisco IOS软件的路由器

[ General ]
 IPSecGateway             = 200.1.1.2
 DeviceName               = "omar5002"
 EthernetAddress          = 00:00:a5:
 e9:c8:00
 DeviceType               = VPN 5002/8 Concentrator
 ConfiguredOn             = Timeserver not configured
 ConfiguredFrom           = Command Line, from Console
 EnablePassword           =
 Password                 =


[ IP Ethernet 1:0 ]
 Mode                     = Routed
 SubnetMask               = 255.255.255.0
 IPAddress                = 200.1.1.1


[ IP Ethernet 0:0 ]
 Mode                     = Routed
 SubnetMask               = 255.255.255.0
 IPAddress                = 10.10.10.1


[ Tunnel Partner VPN 1 ]
 EncryptMethod            = None
 Encryption               = Off
 Authentication           = Off
 KeyManage                = Manual
 Mode                     = Main
 Partner                  = 100.1.1.1
 LocalAccess              = "10.10.10.0/24"
 BindTo                   = "ethernet1:0"
 Peer                     = "20.20.20.0/24"


[ IP Static ]
 20.20.20.0 255.255.255.0 vpn 1 1


[ IP VPN 1 ]
 Numbered                 = Off
 Mode                     = Routed
 Configuration size is 1107 out of 65500 bytes.
 omar5002#

Router Configuration:
Router#show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
!
ip subnet-zero
!
!
!
interface Tunnel0
ip unnumbered Ethernet1
no ip directed-broadcast
tunnel source 100.1.1.1
tunnel destination 200.1.1.1
!
interface Ethernet0
ip address 100.1.1.1 255.255.255.0
no ip directed-broadcast
!
interface Ethernet1
ip address 20.20.20.1 255.255.255.0
no ip directed-broadcast
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 100.1.1.2 1
ip route 10.10.10.0 255.255.255.0 Tunnel0
no ip http server
!
!
line con 0
transport input none
line aux 0
line vty 0 4
login
!
end

验证

本部分所提供的信息可用于确认您的配置是否正常工作。

命令输出解释程序工具（仅限注册用户）支持某些 show 命令，使用此工具可以查看对 show 命令输出的分析。

• show vpn statistics verbose — 提供详细的隧道信息。

• show interface — 提供接口统计信息。

这是从Cisco VPN 5002集中器收集的show vpn statistics verbose的示例命令输出。

omar5002#show vpn statistic verbose
Current  In       High     Running  Tunnel   Tunnel   Tunnel
Active   Negot    Water    Total    Starts   OK       Error
--------------------------------------------------------------
Users     0        0        0        0        0        0        0
Partners  1        0        1        1        0        0        0
Total     1        0        1        1        0        0        0
Stats             VPN0:1
Wrapped              697
Unwrapped            697
BadEncap               0
BadAuth                0
BadEncrypt             0
rx IP                718
rx IPX                 0
rx Other               0
tx IP                734
tx IPX                 0
tx Other               0
IKE rekey              0
Input VPN pkts dropped due to no SA: 0
Input VPN pkts dropped due to no free queue entries: 0
ISAKMP Negotiation stats
Admin packets in        0
Fastswitch packets in   0
No cookie found         0
Can't insert cookie     0
Inserted cookie(L)      0
Inserted cookie(R)      0
Cookie not inserted(L)  0
Cookie not inserted(R)  0
Cookie conn changed     0
Cookie already inserted  0
Deleted cookie(L)       0
Deleted cookie(R)       0
Cookie not deleted(L)   0
Cookie not deleted(R)   0
Forwarded to RP         0
Forwarded to IOP        0
Bad UDP checksum        0
Not fastswitched        0

这是从路由器采取的show interface命令的示例命令输出。

Router#show interface tunnel 0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Interface is unnumbered. Using address of Ethernet1 (20.20.20.1)
MTU 1476 bytes, BW 9 Kbit, DLY 500000 usec,
reliability 255/255, txload 55/255, rxload 113/255
Encapsulation TUNNEL, loopback not set
Keepalive set (10 sec)
Tunnel source 100.1.1.1, destination 200.1.1.1
Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled
Checksumming of packets disabled,  fast tunneling enabled
Last input 00:00:15, output 00:00:15, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/0, 1 drops; input queue 0/75, 0 drops
5 minute input rate 4000 bits/sec, 5 packets/sec
5 minute output rate 11000 bits/sec, 5 packets/sec
1309 packets input, 129264 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
1348 packets output, 316468 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out 
Router#

故障排除

目前没有针对此配置的故障排除信息。

相关信息

• Cisco VPN 5000 系列集中器支持页面
• Cisco VPN 5000 客户端支持页
• IPSec（IP 安全协议）支持页
• 技术支持 - Cisco Systems