機能冗長の設定

<pre> access-list 100 permit udp 200.200.200.1 0.0.0.0 eq 500 any eq 500 access-list 100 permit 50 200.200.200.1 0.0.0.0 any access-list 101 permit udp 100.100.100.1 0.0.0.0 eq 500 any eq 500 access-list 101 permit 50 100.100.100.1 0.0.0.0 any access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ! ip route 100.100.100.1 255.255.255.255 tunnel 102 ip route 192.168.1.0 255.255.255.0 tunnel 1 50 ip route 192.168.1.0 255.255.255.0 tunnel 2 event-track event_track 10 ip route 200.200.200.1 255.255.255.255 tunnel 101 ! event-track event_track ! survey 192.168.1.254 name survey survey-map survey_map source port-channel 11 nexthop tunnel 1 ! survey-map survey_map ttl 255 hop-limit 255 retry 3 frequency every 10000 exit ! event-action 1 event survey survey down action 1.1 event-track event_track up exit ! event-action 2 event survey survey up action 1.1 event-track event_track down exit ! crypto ipsec policy P2_POLICY_BACKUP set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set mtu 1454 set mss 1300 set ip df-bit 0 set ip fragment post exit ! crypto ipsec policy P2_POLICY_MAIN set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set mtu 1454 set mss 1300 set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR_MAIN src 1 ipv4 192.168.2.0 255.255.255.0 dst 1 ipv4 192.168.1.0 255.255.255.0 exit ! crypto ipsec selector SELECTOR_BACKUP src 1 ipv4 any dst 1 ipv4 any exit ! crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile P1_PROFILE_1 keepalive interval 10 self-identity user-fqdn Kyoten_1@furukawa.co.jp set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY_MAIN set peer 200.200.200.1 ike-version 1 local-key secret exit ! crypto isakmp profile P1_PROFILE_2 keepalive interval 10 self-identity user-fqdn Kyoten_2@furukawa.co.jp set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY_BACKUP set peer 100.100.100.1 ike-version 1 local-key secret exit ! crypto map CryptoMap_1 ipsec-isakmp match address SELECTOR_MAIN set isakmp-profile P1_PROFILE_1 exit ! crypto map CryptoMap_2 ipsec-isakmp match address SELECTOR_BACKUP set isakmp-profile P1_PROFILE_2 exit ! interface GigaEthernet 1/1 vlan-id 11 bridge-group 11 channel-group 11 exit ! interface GigaEthernet 2/1 vlan-id 21 bridge-group 21 pppoe enable exit ! interface GigaEthernet 3/1 vlan-id 31 bridge-group 31 pppoe enable exit ! interface Port-channel 11 ip address 192.168.2.254 255.255.255.0 exit ! interface Tunnel 1 tunnel mode ipsec map CryptoMap_1 exit ! interface Tunnel 2 tunnel mode ipsec map CryptoMap_2 exit ! interface Tunnel 101 tunnel mode pppoe profile PPPoE_MAIN ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable pppoe interface gigaethernet 2/1 exit ! interface Tunnel 102 tunnel mode pppoe profile PPPoE_BACKUP ip access-group 101 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable pppoe interface gigaethernet 3/1 exit ! pppoe profile PPPoE_BACKUP account user2@yyyy.ne.jp secret2 ncp ipcp exit ! pppoe profile PPPoE_MAIN account user1@yyyy.ne.jp secret1 ncp ipcp exit ! ! end </pre> <pre> access-list 100 permit udp any eq 500 200.200.200.1 0.0.0.0 eq 500 access-list 100 permit 50 any 200.200.200.1 0.0.0.0 access-list 101 permit udp any eq 500 100.100.100.1 0.0.0.0 eq 500 access-list 101 permit 50 any 100.100.100.1 0.0.0.0 access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ip route 192.168.2.0 255.255.255.0 tunnel 2 50 ! crypto ipsec policy P2_POLICY_BACKUP set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set mtu 1454 set ip df-bit 0 set ip fragment post exit ! crypto ipsec policy P2_POLICY_MAIN set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set mtu 1454 set ip df-bit 0 set ip fragment post sa-up route distance 1 exit ! crypto ipsec selector SELECTOR_BACKUP src 1 ipv4 any dst 1 ipv4 any exit ! crypto ipsec selector SELECTOR_MAIN_0001 src 1 ipv4 192.168.1.0 255.255.255.0 dst 1 ipv4 192.168.2.0 255.255.255.0 exit ! crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile P1_PROFILE_1 match identity user Kyoten_1@furukawa.co.jp local-address 200.200.200.1 keepalive interval 10 set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY_MAIN ike-version 1 local-key secret tunnel-route ip interface tunnel 101 exit ! crypto isakmp profile P1_PROFILE_2 match identity user Kyoten_2@furukawa.co.jp local-address 100.100.100.1 keepalive interval 10 set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY_BACKUP ike-version 1 local-key secret tunnel-route ip interface tunnel 102 exit ! crypto map CryptoMap_1 ipsec-isakmp match address SELECTOR_MAIN_0001 set isakmp-profile P1_PROFILE_1 exit ! crypto map CryptoMap_2 ipsec-isakmp match address SELECTOR_BACKUP set isakmp-profile P1_PROFILE_2 exit ! interface GigaEthernet 1/1 vlan-id 11 bridge-group 11 channel-group 11 exit ! interface GigaEthernet 2/1 vlan-id 21 bridge-group 21 pppoe enable exit ! interface GigaEthernet 3/1 vlan-id 31 bridge-group 31 pppoe enable exit ! interface Port-channel 11 ip address 192.168.1.254 255.255.255.0 exit ! interface Tunnel 1 tunnel mode ipsec map CryptoMap_1 exit ! interface Tunnel 2 tunnel mode ipsec map CryptoMap_2 exit ! interface Tunnel 101 ip address 200.200.200.1 255.255.255.0 ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable tunnel mode pppoe profile PPPoE_MAIN pppoe interface gigaethernet 2/1 exit ! interface Tunnel 102 ip address 100.100.100.1 255.255.255.0 ip access-group 101 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable tunnel mode pppoe profile PPPoE_BACKUP pppoe interface gigaethernet 3/1 exit ! pppoe profile PPPoE_BACKUP account user2@xxxx.ne.jp secret2 ncp ipcp exit ! pppoe profile PPPoE_MAIN account user1@xxxx.ne.jp secret1 ncp ipcp exit ! ! end </pre> <pre> access-list 100 permit udp any 192.0.2.1 0.0.0.0 eq 500 access-list 100 permit udp any 192.0.2.1 0.0.0.0 eq 4500 access-list 100 permit 50 any 192.0.2.1 0.0.0.0 access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ip route 0.0.0.0 0.0.0.0 tunnel 2 ip route 192.168.1.0 255.255.255.0 tunnel 1 ip route 192.168.1.0 255.255.255.0 null 0 150 ip nat list 1 192.168.0.0 0.0.0.255 ! hardware-fault-detection action reboot ! logging buffer level informational ! aaa authentication login default local aaa authorization exec default local ! username guest password guest-secret ! hostname CENTER ! crypto ipsec udp-encapsulation nat-t ! crypto ipsec policy IPsec_POLICY set pfs group14 set security-association lifetime seconds 1800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-aes esp-sha256-hmac set mtu 1454 set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR1 src 1 ipv4 any dst 1 ipv4 any exit ! crypto isakmp keepalive interval 35 crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy ISAKMP_POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 3600 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile PROF1 match identity host id-kyoten local-address 192.0.2.1 self-identity address 192.0.2.1 set isakmp-policy ISAKMP_POLICY set ipsec-policy IPsec_POLICY ike-version 1 local-key SECRET-VPN exit ! crypto map MAP1 ipsec-isakmp match address SELECTOR1 set isakmp-profile PROF1 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 pppoe enable exit ! interface Port-channel 1 ip address 192.168.0.1 255.255.255.0 exit ! interface Tunnel 1 tunnel mode ipsec map MAP1 link-state sync-sa exit ! interface Tunnel 2 ip address 192.0.2.1 255.255.255.255 ip nat inside source list 1 interface tunnel mode pppoe profile PPPOE_PROF pppoe interface gigaethernet 2/1 ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable exit ! pppoe profile PPPOE_PROF account user@xxxx.ne.jp secret exit ! ! end </pre> <pre> access-list 100 permit udp any eq 67 any eq 68 access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500 access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 4500 any eq 4500 access-list 100 permit 50 192.0.2.1 0.0.0.0 any access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ip route 0.0.0.0 0.0.0.0 dhcp port-channel 1 ip route 192.168.0.0 255.255.255.0 tunnel 1 ip route 192.168.0.0 255.255.255.0 null 0 150 ip nat list 1 192.168.1.0 0.0.0.255 ! monitor signal-quality logging lte-module interval 600 ! syslog filter LTE_LIMIT message Call count reached limit exit ! event-action 1 event syslog filter LTE_LIMIT action 1.1 cli exec command crypto isakmp discard action 2.1 cli exec command clear crypto sa action 3.1 cli exec command lte-module disconnect moff action 4.1 cli exec command lte-module connect reverse moff action 5.1 cli exec command no crypto isakmp discard exit ! hardware-fault-detection action reboot ! logging filter 1 LTE_LIMIT event-action logging buffer level informational ! aaa authentication login default local aaa authorization exec default local ! username guest password guest-secret ! hostname KYOTEN ! crypto ipsec udp-encapsulation nat-t ! crypto ipsec policy IPsec_POLICY set pfs group14 set security-association always-up set security-association rekey always set security-association lifetime seconds 1800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-aes esp-sha256-hmac set mtu 1454 set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR1 src 1 ipv4 any dst 1 ipv4 any exit ! crypto isakmp keepalive always-send interval 30 crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy ISAKMP_POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 3600 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile PROF1 match identity address 192.0.2.1 local-address source-interface port-channel 1 self-identity fqdn id-kyoten set isakmp-policy ISAKMP_POLICY set ipsec-policy IPsec_POLICY set peer 192.0.2.1 ike-version 1 local-key SECRET-VPN exit ! crypto map MAP1 ipsec-isakmp match address SELECTOR1 set isakmp-profile PROF1 exit ! interface GigaEthernet 1/1 vlan-id 2 bridge-group 2 channel-group 2 exit ! interface Port-channel 1 ip dhcp service client ip nat inside source list 1 interface exit ! interface Port-channel 2 ip address 192.168.1.1 255.255.255.0 exit ! ! interface Tunnel 1 tunnel mode ipsec map MAP1 link-state sync-sa exit ! interface LTE-Module 1 channel-group 1 sim-profile 1 SIM1 default sim-profile 2 SIM2 ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable exit ! sim-profile SIM1 account xxx123yyy@xxxxx.xx.jp XXX123 pdp ipv4 apn-name lte-ocn.ntt.com max-call 5 exit ! sim-profile SIM2 account xxx456yyy@xxxxx.xx.jp XXX456 pdp ipv4 apn-name lte-ocn.ntt.com max-call 5 exit ! ! end </pre> <pre> access-list 100 permit udp any eq 500 192.0.2.1 0.0.0.0 eq 500 access-list 100 permit 50 any 192.0.2.1 0.0.0.0 access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ! ip route 0.0.0.0 0.0.0.0 192.168.1.200 ip route 192.168.2.0 255.255.255.0 192.168.1.252 100 ip route 192.168.2.0 255.255.255.0 tunnel 2 ip route 192.168.3.0 255.255.255.0 192.168.1.252 100 ip route 192.168.3.0 255.255.255.0 tunnel 3 ip vrrp enable ! track 10 ip host 192.0.2.1 reachability delay-up 30 ! logging buffer level informational ! aaa authentication login default local aaa authorization exec default local ! username guest password guest-secret ! hostname CENTER1 ! crypto ipsec policy P2-POLICY set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-aes esp-sha256-hmac set mtu 1454 set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! hardware-fault-detection action reboot ! logging level informational crypto isakmp keepalive crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail crypto isakmp tunnel-route ip interface tunnel 1 ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile PROF0001 match identity user id-kyoten1 local-address 192.0.2.1 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY ike-version 1 local-key SECRET-VPN exit ! crypto isakmp profile PROF0002 match identity user id-kyoten2 local-address 192.0.2.1 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY ike-version 1 local-key SECRET-VPN exit ! crypto map KYOTEN_1 ipsec-isakmp match address SELECTOR set isakmp-profile PROF0001 exit ! crypto map KYOTEN_2 ipsec-isakmp match address SELECTOR set isakmp-profile PROF0002 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 pppoe enable exit ! interface Port-channel 1 ip address 192.168.1.251 255.255.255.0 mss 1300 vrrp 1 address 192.168.1.254 vrrp 1 priority 200 vrrp 1 preempt vrrp 1 track 10 decrement 110 exit ! interface Tunnel 1 description FLETS ip address 192.0.2.1 255.255.255.255 ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable tunnel mode pppoe profile PPPOE_PROF pppoe interface gigaethernet 2/1 exit ! interface Tunnel 2 tunnel mode ipsec map KYOTEN_1 link-state sync-sa exit ! interface Tunnel 3 tunnel mode ipsec map KYOTEN_2 link-state sync-sa exit ! pppoe profile PPPOE_PROF account abc012@***.***.ne.jp xxxyyyzzz exit ! end </pre> <pre> access-list 100 permit udp any eq 500 192.0.2.2 0.0.0.0 eq 500 access-list 100 permit 50 any 192.0.2.2 0.0.0.0 access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ! ip route 0.0.0.0 0.0.0.0 192.168.1.200 ip route 192.168.2.0 255.255.255.0 tunnel 2 ip route 192.168.3.0 255.255.255.0 tunnel 3 ip route 192.168.2.0 255.255.255.0 null 0 250 ip route 192.168.3.0 255.255.255.0 null 0 250 ip vrrp enable ! logging buffer level informational ! aaa authentication login default local aaa authorization exec default local ! username guest password guest-secret ! hostname CENTER2 ! crypto ipsec policy P2-POLICY set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-aes esp-sha256-hmac set mtu 1454 set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! hardware-fault-detection action reboot ! logging level informational crypto isakmp keepalive crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail crypto isakmp tunnel-route ip interface tunnel 1 ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile PROF0001 match identity user id-kyoten1 local-address 192.0.2.2 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY ike-version 1 local-key SECRET-VPN exit ! crypto isakmp profile PROF0002 match identity user id-kyoten2 local-address 192.0.2.2 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY ike-version 1 local-key SECRET-VPN exit ! crypto map KYOTEN_1 ipsec-isakmp match address SELECTOR set isakmp-profile PROF0001 exit ! crypto map KYOTEN_2 ipsec-isakmp match address SELECTOR set isakmp-profile PROF0002 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 pppoe enable exit ! interface Port-channel 1 ip address 192.168.1.252 255.255.255.0 mss 1300 vrrp 1 address 192.168.1.254 vrrp 1 priority 100 vrrp 1 preempt exit ! interface Tunnel 1 description FLETS ip address 192.0.2.2 255.255.255.255 ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable tunnel mode pppoe profile PPPOE_PROF pppoe interface gigaethernet 2/1 exit ! interface Tunnel 2 tunnel mode ipsec map KYOTEN_1 link-state sync-sa exit ! interface Tunnel 3 tunnel mode ipsec map KYOTEN_2 link-state sync-sa exit ! pppoe profile PPPOE_PROF account abc123@***.***.ne.jp yyyxxxzzz exit ! end </pre> <pre> access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500 access-list 100 permit 50 192.0.2.1 0.0.0.0 any access-list 100 permit udp 192.0.2.2 0.0.0.0 eq 500 any eq 500 access-list 100 permit 50 192.0.2.2 0.0.0.0 any access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ! ip route 0.0.0.0 0.0.0.0 tunnel 1 ip route 192.168.1.0 255.255.255.0 null 0 150 ip route 192.168.1.0 255.255.255.0 tunnel 2 survey name t2_ICMP ip route 192.168.1.0 255.255.255.0 tunnel 3 100 ip nat list 1 192.168.2.0 0.0.0.255 ! survey 192.168.1.251 name t2_ICMP survey-map ICMP-Kanshi source port-channel 1 nexthop tunnel 2 interworking ! survey-map ICMP-Kanshi retry 2 interval 10000 frequency every 10000 stability 2 interval 10000 exit ! logging buffer level informational ! aaa authentication login default local aaa authorization exec default local ! username guest password guest-secret ! hostname KYOTEN1 ! crypto ipsec policy P2-POLICY set pfs group14 set security-association always-up set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-aes esp-sha256-hmac set mtu 1454 set mss 1300 set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! hardware-fault-detection action reboot ! logging level informational crypto isakmp keepalive crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile PROF0001 self-identity user-fqdn id-kyoten1 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY set peer 192.0.2.1 ike-version 1 local-key SECRET-VPN exit ! crypto isakmp profile PROF0002 self-identity user-fqdn id-kyoten1 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY set peer 192.0.2.2 ike-version 1 local-key SECRET-VPN exit ! crypto map CENTER ipsec-isakmp match address SELECTOR set isakmp-profile PROF0001 exit ! crypto map CENTER_BK ipsec-isakmp match address SELECTOR set isakmp-profile PROF0002 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 pppoe enable exit ! interface Port-channel 1 ip address 192.168.2.254 255.255.255.0 mss 1300 exit ! interface Tunnel 1 description FLETS ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable ip nat inside source list 1 interface tunnel mode pppoe profile PPPOE_PROF pppoe interface gigaethernet 2/1 exit ! interface Tunnel 2 tunnel mode ipsec map CENTER exit ! interface Tunnel 3 tunnel mode ipsec map CENTER_BK link-state sync-sa exit ! pppoe profile PPPOE_PROF account abc345@***.***.ne.jp zzzyyyxxx exit ! end </pre> <pre> access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500 access-list 100 permit 50 192.0.2.1 0.0.0.0 any access-list 100 permit udp 192.0.2.2 0.0.0.0 eq 500 any eq 500 access-list 100 permit 50 192.0.2.2 0.0.0.0 any access-list 111 deny udp any eq 135 any access-list 111 deny udp any any eq 135 access-list 111 deny tcp any eq 135 any access-list 111 deny tcp any any eq 135 access-list 111 deny udp any range 137 139 any access-list 111 deny udp any any range 137 139 access-list 111 deny tcp any range 137 139 any access-list 111 deny tcp any any range 137 139 access-list 111 deny udp any eq 445 any access-list 111 deny udp any any eq 445 access-list 111 deny tcp any eq 445 any access-list 111 deny tcp any any eq 445 access-list 112 deny ip 192.168.0.0 0.0.0.255 any access-list 112 permit icmp any 192.168.0.0 0.0.0.255 access-list 113 spi tcp any any eq ftp access-list 113 spi tcp any any eq ftp-data access-list 113 spi tcp any any eq www access-list 113 spi udp any any eq domain access-list 113 spi tcp any any eq smtp access-list 113 spi tcp any any eq pop3 access-list 113 spi tcp any any eq 587 access-list 113 spi tcp any any access-list 113 spi udp any any access-list 114 permit ip any any access-list 115 deny ip any any ! ip route 0.0.0.0 0.0.0.0 tunnel 1 ip route 192.168.1.0 255.255.255.0 null 0 150 ip route 192.168.1.0 255.255.255.0 tunnel 2 survey name t2_ICMP ip route 192.168.1.0 255.255.255.0 tunnel 3 100 ip nat list 1 192.168.3.0 0.0.0.255 ! survey 192.168.1.251 name t2_ICMP survey-map ICMP-Kanshi source port-channel 1 nexthop tunnel 2 interworking ! survey-map ICMP-Kanshi retry 2 interval 10000 frequency every 10000 stability 2 interval 10000 exit ! logging buffer level informational ! aaa authentication login default local aaa authorization exec default local ! username guest password guest-secret ! hostname KYOTEN2 ! crypto ipsec policy P2-POLICY set pfs group14 set security-association always-up set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-aes esp-sha256-hmac set mtu 1454 set mss 1300 set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! hardware-fault-detection action reboot ! logging level informational crypto isakmp keepalive crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile PROF0001 self-identity user-fqdn id-kyoten2 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY set peer 192.0.2.1 ike-version 1 local-key SECRET-VPN exit ! crypto isakmp profile PROF0002 self-identity user-fqdn id-kyoten2 set isakmp-policy P1-POLICY set ipsec-policy P2-POLICY set peer 192.0.2.2 ike-version 1 local-key SECRET-VPN exit ! crypto map CENTER ipsec-isakmp match address SELECTOR set isakmp-profile PROF0001 exit ! crypto map CENTER_BK ipsec-isakmp match address SELECTOR set isakmp-profile PROF0002 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 pppoe enable exit ! interface Port-channel 1 ip address 192.168.3.254 255.255.255.0 mss 1300 exit ! interface Tunnel 1 description FLETS ip access-group 100 in ip access-group 111 out ip access-group 112 in ip access-group 113 out ip access-group 114 out ip access-group 115 in ip access-group spi ftp-data enable ip nat inside source list 1 interface tunnel mode pppoe profile PPPOE_PROF pppoe interface gigaethernet 2/1 exit ! interface Tunnel 2 tunnel mode ipsec map CENTER exit ! interface Tunnel 3 tunnel mode ipsec map CENTER_BK link-state sync-sa exit ! pppoe profile PPPOE_PROF account abc678@***.***.ne.jp yyyzzzxxx exit ! end </pre> <pre> access-list 100 permit ip 192.168.0.2 0.0.0.0 any access-list 110 permit udp any eq 500 10.0.0.1 0.0.0.0 eq 500 access-list 110 permit 50 any 10.0.0.1 0.0.0.0 access-list 111 deny ip any any ! ip route 100.0.0.1 255.255.255.255 10.0.0.254 ip route 192.168.1.0 255.255.255.0 192.168.0.253 50 ip route 192.168.1.0 255.255.255.0 tunnel 1 survey name main_point 10 ip route 192.168.1.253 255.255.255.255 192.168.0.253 ip route 192.168.1.253 255.255.255.255 null 0 200 ip vrrp enable ! survey 192.168.1.252 name main_point survey-map survey_map source port-channel 1 nexthop tunnel 1 ! survey-map survey_map ttl 255 retry 3 frequency every 10000 exit ! crypto ipsec policy P2_POLICY set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile P1_PROFILE_0001 match identity user Kyoten_A@furukawa.co.jp local-address 10.0.0.1 keepalive interval 10 set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY ike-version 1 local-key secret exit ! crypto map CryptoMap_0001 ipsec-isakmp match address SELECTOR set isakmp-profile P1_PROFILE_0001 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 policy-route input PBR exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 channel-group 2 ip access-group 110 in ip access-group 111 in exit ! interface Port-channel 1 ip address 192.168.0.252 255.255.255.0 vrrp 1 address 192.168.0.254 vrrp 1 priority 100 vrrp 1 adver-interval 10 vrrp 1 preempt exit ! interface Port-channel 2 ip address 10.0.0.1 255.255.255.0 exit ! interface Tunnel 1 tunnel mode ipsec map CryptoMap_0001 exit ! class-map Backup match ip access-group 100 exit ! policy-route-map PBR ! class Backup count action nexthop 192.168.0.253 watch 192.168.1.253 source port-channel 1 survey-map survey_map exit ! exit ! end </pre> <pre> access-list 110 permit udp any eq 500 20.0.0.1 0.0.0.0 eq 500 access-list 110 permit 50 any 20.0.0.1 0.0.0.0 access-list 111 deny ip any any ! ip route 200.0.0.1 255.255.255.255 20.0.0.254 ip route 192.168.1.0 255.255.255.0 tunnel 1 ip vrrp enable ! crypto ipsec policy P2_POLICY set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile P1_PROFILE_0001 match identity user Kyoten_B@furukawa.co.jp local-address 20.0.0.1 keepalive interval 10 set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY ike-version 1 local-key secret exit ! crypto map CryptoMap_0001 ipsec-isakmp match address SELECTOR set isakmp-profile P1_PROFILE_0001 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 channel-group 2 ip access-group 110 in ip access-group 111 in exit ! interface Port-channel 1 ip address 192.168.0.253 255.255.255.0 vrrp 1 address 192.168.0.254 vrrp 1 priority 50 vrrp 1 adver-interval 10 vrrp 1 preempt exit ! interface Port-channel 2 ip address 20.0.0.1 255.255.255.0 exit ! interface Tunnel 1 tunnel mode ipsec map CryptoMap_0001 exit ! end </pre> <pre> access-list 100 permit ip any 192.168.0.2 0.0.0.0 access-list 110 permit udp 10.0.0.1 0.0.0.0 eq 500 any eq 500 access-list 110 permit 50 10.0.0.1 0.0.0.0 any access-list 111 deny ip any any ! ip route 10.0.0.1 255.255.255.255 100.0.0.254 ip route 192.168.0.0 255.255.255.0 192.168.1.253 50 ip route 192.168.0.0 255.255.255.0 tunnel 1 survey name main_point 10 ip vrrp enable ! survey 192.168.0.252 name main_point survey-map survey_map source port-channel 1 nexthop tunnel 1 survey 192.168.0.253 name backup_point survey-map survey_map source port-channel 1 nexthop 192.168.1.253 ! survey-map survey_map ttl 255 retry 3 frequency every 10000 exit ! event-action 1 event survey backup_point down action 1.1 cli exec command policy-flag 1 unset action 1.2 syslog message EVENT-ACTION NO1 IS FINISH. exit ! event-action 2 event survey backup_point up action 1.1 cli exec command policy-flag 1 set action 1.2 syslog message EVENT-ACTION NO2 IS FINISH. exit ! crypto ipsec policy P2_POLICY set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile P1_PROFILE_1 local-address 100.0.0.1 keepalive interval 10 self-identity user-fqdn Kyoten_A@furukawa.co.jp set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY set peer 10.0.0.1 ike-version 1 local-key secret exit ! crypto map CryptoMap_1 ipsec-isakmp match address SELECTOR set isakmp-profile P1_PROFILE_1 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 policy-route input PBR exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 channel-group 2 ip access-group 110 in ip access-group 111 in exit ! interface Port-channel 1 ip address 192.168.1.252 255.255.255.0 vrrp 1 address 192.168.1.254 vrrp 1 priority 100 vrrp 1 adver-interval 10 vrrp 1 preempt exit ! interface Port-channel 2 ip address 100.0.0.1 255.255.255.0 exit ! interface Tunnel 1 tunnel mode ipsec map CryptoMap_1 exit ! class-map Backup match ip access-group 100 match policy-flag 1 set exit ! policy-route-map PBR ! class Backup count action nexthop 192.168.1.253 exit ! exit ! end </pre> <pre> access-list 110 permit udp 20.0.0.1 0.0.0.0 eq 500 any eq 500 access-list 110 permit 50 20.0.0.1 0.0.0.0 any access-list 111 deny ip any any ! ip route 20.0.0.1 255.255.255.255 200.0.0.254 ip route 192.168.0.0 255.255.255.0 tunnel 1 ip vrrp enable ! crypto ipsec policy P2_POLICY set pfs group14 set security-association lifetime seconds 28800 set security-association transform-keysize aes 256 256 256 set security-association transform esp-sha256-hmac set ip df-bit 0 set ip fragment post exit ! crypto ipsec selector SELECTOR src 1 ipv4 any dst 1 ipv4 any exit ! crypto isakmp log sa crypto isakmp log session crypto isakmp log negotiation-fail ! crypto isakmp policy P1-POLICY authentication pre-share encryption aes encryption-keysize aes 256 256 256 group 14 lifetime 86400 hash sha-256 initiate-mode aggressive exit ! crypto isakmp profile P1_PROFILE_1 local-address 200.0.0.1 keepalive interval 10 self-identity user-fqdn Kyoten_B@furukawa.co.jp set isakmp-policy P1-POLICY set ipsec-policy P2_POLICY set peer 20.0.0.1 ike-version 1 local-key secret exit ! crypto map CryptoMap_1 ipsec-isakmp match address SELECTOR set isakmp-profile P1_PROFILE_1 exit ! interface GigaEthernet 1/1 vlan-id 1 bridge-group 1 channel-group 1 exit ! interface GigaEthernet 2/1 vlan-id 2 bridge-group 2 channel-group 2 ip access-group 110 in ip access-group 111 in exit ! interface Port-channel 1 ip address 192.168.1.253 255.255.255.0 vrrp 1 address 192.168.1.254 vrrp 1 priority 50 vrrp 1 adver-interval 10 vrrp 1 preempt exit ! interface Port-channel 2 ip address 200.0.0.1 255.255.255.0 exit ! interface Tunnel 1 tunnel mode ipsec map CryptoMap_1 exit ! ! end </pre>