拓朴图：
实验背景
在建立IPsec通道时，如果通道路径上有NAT设备也不会影响第一阶段的IKE SA的协商和第二阶段IPSec SA的协商，因为通常将IKE的数据包封装在UDP数据包中， 但是，在完成第二阶段协商后， IPsec数据包上的NAT会导致通道失败，（也就是说IPsec的通道可以建立，但是真正的User的数据无法传输） 原因可能有多个，但是最关键的原因就是： 1.对于IPsec-ESP来说，NAT设备不能找到要做端口转换的port和src IP address的位置（因为它已经被加密了） 2.对外IPsec-AH协议，NAT设备虽然可以看到port和Src IP and Dst IP address，但不可以修改，如果一修改整个IPsec数据包的完整性验证就会失败。IPsec 数据包就会被丢弃。
IPsec和NAT和平共处的解决方法：NAT-T 在 IPsec第一阶段IKE SA协商过程中，两端支持NAT-T的××× 设备会在IPSec 协商路径上检测是否有NAT设备， 1.如果没有NAT设备，IPSec数据包正常发送，接着进入IKE第二阶段 2.如果监测到NAT设备，就给要发送出去的IPSec数据包再添加一层UDP封装。可以解决认证检查失败的问题。NAT设备将其作为 UDP 封包处理，更改 UDP 包头中的源端口，不修改 AH 或 ESP 中的 SPI 包头。对端的×××设备将剥开UDP 层并处理 IPSec 封包，这样处理就会通过认证检查，因为对认证过的内容并没有做任何更改。 3.启用NAT-T之后，也只要两端的××× Gateway之间存在NAT设备时才会激活。 4.要使用NAT-T功能，两端的××× Peer都必须支持。 本次模拟试验的设备默认都是打开了NAT-T的，因此不用配置。
实验目的：
1、R3穿越配置了NAT的R2，实现与ASA建立起IPSEC×××连接， 2、PC1 PC2在连接×××的同时能够访问外网。即PC1能ping通2.2.2.2，PC2能ping通1.1.1.1思路：
1、基础配置：IP 路由以及防火墙的策略 2、配置NAT 3、配置IPSEC×××
实验配置：
ASA：interface Ethernet0/0
nameif inside ip address 192.168.1.1 255.255.255.0 no sh ! interface Ethernet0/1 nameif outside ip address 1.1.1.1 255.255.255.0 no sh exit策略
access-list outside extended permit ip any any access-list no-nat extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0NAT配置
global (outside) 1 interface nat (inside) 0 access-list no-nat nat (inside) 1 0.0.0.0 0.0.0.0 access-group outside in interface outside route outside 0.0.0.0 0.0.0.0 1.1.1.2 1IPSEC×××配置
access-list ipsec*** extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0 crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash md5 group 2 tunnel-group 2.2.2.2 type ipsec-l2l tunnel-group 2.2.2.2 ipsec-attributes pre-shared-key cisco crypto ipsec transform-set myset esp-3des esp-md5-hmac crypto map mymap 10 match address ipsec*** crypto map mymap 10 set peer 2.2.2.2 crypto map mymap 10 set transform-set myset crypto map mymap interface outsideR1
interface FastEthernet0/0
ip address 1.1.1.2 255.255.255.0 no sh ! interface Serial1/1 ip address 2.2.2.1 255.255.255.0 no sh exit
R2
interface Serial1/0
ip address 2.2.2.2 255.255.255.0 ip nat outside no sh ! interface Serial1/1 ip address 10.10.10.1 255.255.255.0 ip nat inside no sh exitip route 0.0.0.0 0.0.0.0 Serial1/0
ip route 172.16.1.0 255.255.255.0 Serial1/1
内部用户172.16.1.0访问外网的NAT
ip access-list extended nat permit ip 172.16.1.0 0.0.0.255 any ip nat inside source list nat interface Serial1/0 overload 映射ISAKMP与NAT-T的端口 ip nat inside source static udp 10.10.10.2 500 interface Serial1/0 500 ip nat inside source static udp 10.10.10.2 4500 interface Serial1/0 4500
R3
interface Serial1/0
ip address 10.10.10.2 255.255.255.0 crypto map mymap no sh ! interface Serial1/1 ip address 172.16.1.1 255.255.255.0 no sh exitip route 0.0.0.0 0.0.0.0 Serial1/0
ip access-list extended ipsec*** permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
crypto isakmp policy 10
encr 3des hash md5 authentication pre-share group 2 crypto isakmp key cisco address 1.1.1.1 ! crypto ipsec transform-set myset esp-3des esp-md5-hmac ! crypto map mymap 10 ipsec-isakmp set peer 1.1.1.1 set transform-set myset match address ipsec***
R4 //模拟的是一台PC，配置好IP和网关就可以了。
interface Serial1/0
ip address 172.16.1.2 255.255.255.0 no sh exitno ip routing
ip default-gateway 172.16.1.2
实验结果：
R4#ping 192.168.1.2
Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds: .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 16/39/76 ms
R4#ping 1.1.1.1
Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 24/57/80 ms
R3#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA dst src state conn-id slot status 1.1.1.1 10.10.10.2 QM_IDLE 1002 0 ACTIVEIPv6 Crypto ISAKMP SA
R3#sh crypto ipsec sa
interface: Serial1/0
Crypto map tag: mymap, local addr 10.10.10.2protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 1.1.1.1 port 4500 PERMIT, flags={origin_is_acl,} #pkts encaps: 140, #pkts encrypt: 140, #pkts digest: 140 #pkts decaps: 140, #pkts decrypt: 140, #pkts verify: 140 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 2, #recv errors 0local crypto endpt.: 10.10.10.2, remote crypto endpt.: 1.1.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0 current outbound spi: 0x5147BFC4(1363656644)inbound esp sas:
spi: 0x6A82D805(1786959877) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel UDP-Encaps, } conn id: 3, flow_id: 3, crypto map: mymap sa timing: remaining key lifetime (k/sec): (4389238/3497) IV size: 8 bytes replay detection support: Y Status: ACTIVEinbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x5147BFC4(1363656644) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel UDP-Encaps, } conn id: 4, flow_id: 4, crypto map: mymap sa timing: remaining key lifetime (k/sec): (4389238/3496) IV size: 8 bytes replay detection support: Y Status: ACTIVEoutbound ah sas:
outbound pcp sas: