左边：
access-list 140 extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map outside_map 20 match address 140
crypto map outside_map 20 set peer 23.1.1.3
crypto map outside_map 20 set transform-set myset
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
exit
tunnel-group 23.1.1.3 type ipsec-l2l
tunnel-group 23.1.1.3 ipsec-attributes
pre-shared-key cisco
nat (inside) 0 access-list nonat
crypto map outside_map interface outside
Crypto isakmp enable outside
右边：
access-list 140 extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map outside_map 20 match address 140
crypto map outside_map 20 set peer 12.1.1.1
crypto map outside_map 20 set transform-set myset
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
exit
tunnel-group 12.1.1.1 type ipsec-l2l
tunnel-group 12.1.1.1 ipsec-attributes
pre-shared-key cisco
nat (inside) 0 access-list nonat
crypto map outside_map interface outside
Crypto isakmp enable outside
转载于:https://blog.51cto.com/439017543/963178