Cisco隧道问题

Question

我对VPN配置有问题。这是我创建的拓扑：

首次更新许可证以使VPN可用：

许可证引导模块c1900技术-包securityk9

IPsec路由器NetworkA配置：

ip route 0.0.0.0 0.0.0.0 200.100.100.2 
!
access-list 100 permit ip 192.168.10.0 0.0.0.255 103.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.10.0 0.0.0.255 103.168.40.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 103.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 103.168.40.0 0.0.0.255
!
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key VPN address 200.200.100.1
crypto ipsec transform-set VPN esp-aes 256 esp-sha-hmac
crypto map VPN 10 ipsec-isakmp 
set peer 200.200.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set VPN
match address 100
!
interface gigabitEthernet 0/0
 crypto map VPN
!

Ipsec路由器NetworkB:

ip route 0.0.0.0 0.0.0.0 200.200.100.2 
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.20.0 0.0.0.255
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key VPN address 200.100.100.1
crypto ipsec transform-set VPN esp-aes 256 esp-sha-hmac
crypto map VPN 10 ipsec-isakmp 
set peer 200.200.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set VPN
match address 100
!
interface gigabitEthernet 0/0
 crypto map VPN
!

VLAN路由器NetworkA

interface gigabitEthernet 0/1.1
 encapsulation dot1Q 10 
 ip address 192.168.10.1 255.255.255.0 
!
interface gigabitEthernet 0/1.2
 encapsulation dot1Q 20 
 ip address 192.168.20.1 255.255.255.0
!

VLAN路由器NetworkB

interface gigabitEthernet 0/1.1
 encapsulation dot1Q 30 
 ip address 192.168.30.1 255.255.255.0 
!
interface gigabitEthernet 0/1.2
 encapsulation dot1Q 40 
 ip address 192.168.40.1 255.255.255.0
!

Switch1

interface gigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
!
interface range fastEthernet 0/1-11
 switchport access vlan 10
!
interface range fastEthernet 0/11-20
 switchport access vlan 20
!

Switch2

interface gigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan 30,40
!
interface range fastEthernet 0/1-11
 switchport access vlan 30
!
interface range fastEthernet 0/11-20
 switchport access vlan 40
!

我希望VLAN能够相互通信，但是VPN隧道有问题。

我想我需要配置NAT，但不知道如何配置。

输出"show crypto isakmp sa“在两个路由器上是相同的：

IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
!
IPv6 Crypto ISAKMP SA
!

Answer 1

访问列表中有一个错误，不允许流量进入VPN隧道：

access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.20.0 0.0.0.255

注103.168.10.0而不是192.168.10.0