求助大家来看看这道经典题目！！

UID: 55847

在R1上既做了NAT 也做了IPSEC VPN，目的是实现内网能访问外网，也能访问总部的内网
在R2上模拟的是ISP
在R3上只做了NAT转换,目的是实现内网用户访问外网
在R4上做了IPSEC VPN，目的是和分布的内网互通

最终出现的问题：
R1的内网用户可以通过NAT访问R2的12.1.1.2地址
R1的内网用户不可以通过NAT访问R3的23.1.1.3地址
R1自身也ping不同R3
R2自身也ping不同R3(是直连网段，晕了）
但：
R3自身可以ping同R1和R2

只要是以目的地址为R3的F0/1的地址都ping 不同，但是反过来R3是可以ping通R1 /R2的
R1和R3内网段192.168.1.0--192.168.3.0可以相互访问（证明VPN没问题）
R3内网可以成功通过NAT访问外网（NAT穿越没问题)
实验工具：GNS3最新版的   IOS  2691 K9 12.4以上的

配置信息(主要是R1 R3 R4)
R1:
!
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 23.1.1.3
!
crypto ipsec transform-set tao esp-3des esp-sha-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 23.1.1.3
set transform-set tao
match address 100
!
!
interface Loopback0
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface FastEthernet0/0
ip address 12.1.1.1 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map cisco
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 12.1.1.2
!
!
no ip http server
no ip http secure-server
ip nat inside source list 101 interface FastEthernet0/0 overload
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 permit ip any any
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

R2:
!
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
interface FastEthernet0/0
ip address 12.1.1.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 23.1.1.2 255.255.255.0
duplex auto
speed auto
!
!
!
no ip http server
no ip http secure-server
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

R3:
!
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
interface FastEthernet0/0
ip address 192.168.2.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 23.1.1.3 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 23.1.1.2
ip route 192.168.3.0 255.255.255.0 192.168.2.2
!
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface FastEthernet0/1 overload
ip nat inside source static udp 192.168.2.2 4500 interface FastEthernet0/1 4500
ip nat inside source static udp 192.168.2.2 500 interface FastEthernet0/1 500
!
access-list 1 permit any
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

R4:
!
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 12.1.1.1
!
!
crypto ipsec transform-set tao esp-3des esp-sha-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 12.1.1.1
set transform-set tao
match address 100
!
!
!
!
interface FastEthernet0/0
ip address 192.168.2.2 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
interface FastEthernet0/1
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 192.168.2.1
!
!
no ip http server
no ip http secure-server
!
access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

UID: 117578

游客，如果您要查看本帖隐藏内容请登录

UID: 74710

游客，如果您要查看本帖隐藏内容请登录

UID: 72846

游客，如果您要查看本帖隐藏内容请登录

UID: 53815

游客，如果您要查看本帖隐藏内容请登录

UID: 55847

游客，如果您要查看本帖隐藏内容请登录

UID: 53815

游客，如果您要查看本帖隐藏内容请登录

UID: 53815

游客，如果您要查看本帖隐藏内容请登录

UID: 53815

游客，如果您要查看本帖隐藏内容请登录

UID: 55847

游客，如果您要查看本帖隐藏内容请登录

UID: 53815

游客，如果您要查看本帖隐藏内容请登录

UID: 55847

游客，如果您要查看本帖隐藏内容请登录

UID: 53815

游客，如果您要查看本帖隐藏内容请登录

UID: 87557

游客，如果您要查看本帖隐藏内容请登录