实验环境：
GNS3 0.6
模拟CISCO 7200 ，IOS使用 c7200-advipservicesk9_li-mz.124-11.t.bin
VPN 客户端软件：sslclient-win-1.1.3.173.pkg
R0的F0/0连接cloud0，F1/0连接cloud1
Cloud0桥接到物理网卡，cloud1桥接到loopback网卡
VPC虚拟两台客户端client1，client2分别桥接到物理网卡和loopback网卡上
R0 F0/0：10.10.10.10/24 F1/0：172.16.1.1/24
Client1：10.10.10.100/24 default gateway：10.10.10.10
Client2：172.16.1.100/24 default gateway：172.16.1.1
R0上配置：
Connected to Dynamips VM "R0" (ID 0, type c7200) - Console port
% Please answer 'yes' or 'no'.
Would you like to enter the initial configuration dialog? [yes/no]: n
Press RETURN to get started!
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#int f0/0
Router(config-if)#ip add 10.10.10.10 255.255.255.0
Router(config-if)#no shut
Router(config-if)#
*May 14 19:52:22.575: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*May 14 19:52:22.579: %ENTITY_ALARM-6-INFO: CLEAR INFO Fa0/0 Physical Port Administrative State Down
*May 14 19:52:23.575: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
Router(config-if)#int f1/0
Router(config-if)#ip add 172.16.1.1 255.255.255.0
Router(config-if)#no shut
Router(config-if)#
*May 14 19:52:49.939: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to up
*May 14 19:52:49.943: %ENTITY_ALARM-6-INFO: CLEAR INFO Fa1/0 Physical Port Administrative State Down
*May 14 19:52:50.939: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0, changed state to up
Router(config-if)#exit
Router(config)#no ip domain-lookup
Router(config)#do ping 10.10.10.100
Translating "10.10.10.100"
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/74/124 ms
Router(config)#clock timezone beijing 8
Router(config)#
*May 14 19:55:57.727: %SYS-6-CLOCKUPDATE: System clock has been updated from 19:55:57 UTC Thu May 14 2009 to 03:55:57 beijing Fri May 15 2009, configured from console by console.
Router(config)#exit
Router#
*May 14 19:56:07.787: %SYS-5-CONFIG_I: Configured from console by console
Router#clock set 19:59:00 14 may 2009
Router#
*May 14 11:59:00.003: %SYS-6-CLOCKUPDATE: System clock has been updated from 03:59:01 beijing Fri May 15 2009 to 19:59:00 beijing Thu May 14 2009, configured from console by console.
Router#format disk0:
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "disk0:". Continue? [confirm]
Format: Drive communication & 1st Sector Write OK...
Writing Monlib sectors.
.....................................................................................................................................................
Monlib write complete
Format: All system sectors written. OK...
Format: Total sectors in formatted partition: 130883
Format: Total bytes in formatted partition: 67012096
Format: Operation completed successfully.
Format of disk0 complete
Router#copy tftp disk0:
Address or name of remote host []? 10.10.10.100
Source filename []? sslclient-win-1.1.3.173.pkg
Destination filename [sslclient-win-1.1.3.173.pkg]?
Accessing tftp://10.10.10.100/sslclient-win-1.1.3.173.pkg...
Loading sslclient-win-1.1.3.173.pkg from 10.10.10.100 (via FastEthernet0/0): !!
[OK - 416354 bytes]
416354 bytes copied in 57.896 secs (7191 bytes/sec)
Router#dir disk0:
Directory of disk0:/
1 -rw- 416354 May 14 2009 20:04:42 +08:00 sslclient-win-1.1.3.173.pkg
66846720 bytes total (66428928 bytes free)
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#webvpn install svc disk0:/sslclient-win-1.1.3.173.pkg
SSLVPN Package SSL-VPN-Client : installed successfully
Router(config)#do dir disk0:
Directory of disk0:/
1 drw- 0 May 14 2009 20:06:48 +08:00 webvpn
66846720 bytes total (66424832 bytes free)
Router(config)#aaa new-model
Router(config)#aaa authentication login webvpn local
Router(config)#int loopback0
Router(config-if)#
May 14 12:24:38.399: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
Router(config-if)#ip add 192.168.1.254 255.255.255.0
Router(config-if)#exit
Router(config)#ip local pool ssl-add 192.168.1.100 192.168.1.200
Router(config)#username cisco password cisco
Router(config)#webvpn gateway vpngateway
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
Router(config-webvpn-gateway)#
May 14 12:26:47.963: %SSH-5-ENABLED: SSH 1.99 has been enabled
May 14 12:26:48.419: %PKI-4-NOAUTOSAVE: Configuration was modified. Issue "write memory" to save new certificate
Router(config-webvpn-gateway)#ip add 10.10.10.10 port 443
Router(config-webvpn-gateway)#inservice
Router(config-webvpn-gateway)#exit
Router(config)#webvpn context webcontext
Router(config-webvpn-context)#gateway vpngateway
Router(config-webvpn-context)#aaa authentication list webvpn
Router(config-webvpn-context)#inservice
Router(config-webvpn-context)#
May 14 12:28:31.235: %SSLVPN-5-UPDOWN: sslvpn context : webcontext changed state to UP
Router(config-webvpn-context)#policy group sslvpn-policy
Router(config-webvpn-group)#functions svc-enable
Router(config-webvpn-group)#svc address-pool ssl-add
Router(config-webvpn-group)#svc split include 172.16.1.0 255.255.255.0
Router(config-webvpn-group)#exit
Router(config-webvpn-context)#default-group-policy sslvpn-policy
Router(config-webvpn-context)#exit
Router(config)#exit
Router#
May 14 12:30:16.363: %SYS-5-CONFIG_I: Configured from console by console
Router#write memory
Building configuration...
[OK]
Router#
Client1上配置：
社区：
