ipsec vpn丢包率50%

》1.

R1#sho run
Building configuration...
*Mar  1 01:04:52.711: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 1209 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
ip domain name lab.local
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!         
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
ip address 192.168.10.1 255.255.255.0
duplex auto
speed auto
!
interface Serial2/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/2
ip address 12.1.1.1 255.255.255.0
serial restart-delay 0
!
interface Serial2/3
no ip address
shutdown
serial restart-delay 0
!
router rip
version 2
network 12.0.0.0
network 192.168.10.0
no auto-summary
!
no ip http server
no ip http secure-server
!
ip forward-protocol nd
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end





R2#sho run
Building configuration...
Current configuration : 2085 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
ip domain name lab.local
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key ruijie123 address 36.1.1.6
!
!
crypto ipsec transform-set vpn1 ah-md5-hmac esp-des esp-md5-hmac
!
crypto map vpn-set 100 ipsec-isakmp
set peer 36.1.1.6
set transform-set vpn1
match address 110
!
!
!
!
interface FastEthernet0/0
ip address 23.1.1.2 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map vpn-set
!         
interface FastEthernet1/0
ip address 192.168.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Serial2/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/2
ip address 12.1.1.2 255.255.255.0
ip nat inside
ip virtual-reassembly
serial restart-delay 0
!         
interface Serial2/3
no ip address
shutdown
serial restart-delay 0
!
router rip
version 2
network 12.0.0.0
network 192.168.20.0
no auto-summary
!
no ip http server
no ip http secure-server
!
ip default-network 23.0.0.0
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 23.1.1.3
!
ip nat pool internet 23.1.1.2 23.1.1.5 netmask 255.255.255.0
ip nat inside source list 100 pool internet overload
!
access-list 100 deny   ip 192.168.0.0 0.0.255.255 192.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.0.0 0.0.255.255 any
access-list 110 permit ip 192.168.0.0 0.0.255.255 192.168.30.0 0.0.0.255
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end




R6#sho run
Building configuration...
Current configuration : 1878 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R6
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
ip domain name lab.local
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key ruijie123 address 23.1.1.2
!
!
crypto ipsec transform-set vpn1 ah-md5-hmac esp-des esp-md5-hmac
!
crypto map vpn-set 100 ipsec-isakmp
set peer 23.1.1.2
set transform-set vpn1
match address 110
!
!
!
!
interface FastEthernet0/0
ip address 36.1.1.6 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map vpn-set
!         
interface FastEthernet1/0
ip address 192.168.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Serial2/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/3
no ip address
shutdown
serial restart-delay 0
!
no ip http server
no ip http secure-server
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 36.1.1.3
!
ip nat inside source list 100 interface FastEthernet0/0 overload
!
access-list 100 deny   ip 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 any
access-list 110 permit ip 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255
!
!
!
control-plane
!
!
!         
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end
R6#

天涯迪

检查下路由，是不是负载均衡了