拓扑：
GW:
aaa new-model
!
aaa authentication login noacs line none
aaa authentication login hr_authen local
aaa authorization network ht_author local
!
username cisco password 0 cisco
!
!
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group hrgroup
key cisco
pool hr_pool
crypto isakmp profile isakmap_profile
match identity group hrgroup
client authentication list hr_authen
isakmp authorization list ht_author
client configuration address respond
virtual-template 100//关联virtual-template 100
!
!
crypto ipsec transform-set hr_trans esp-des esp-md5-hmac
!
crypto ipsec profile hr_ipsec_profile
set transform-set hr_trans
set isakmp-profile isakmap_profile
!
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface Serial0/0
ip address 12.1.1.2 255.255.255.0
ip nat outside
ip virtual-reassembly
serial restart-delay 0
!
interface Serial0/1
ip address 23.1.1.2 255.255.255.0
ip nat inside
ip virtual-reassembly
serial restart-delay 0
!
interface FastEthernet1/0
ip address 192.168.10.254 255.255.255.0
duplex auto
speed auto
!
interface Virtual-Template100 type tunnel
ip unnumbered Loopback0
ip nat inside
ip virtual-reassembly
tunnel source FastEthernet1/0
tunnel mode ipsec ipv4
tunnel protection ipsec profile hr_ipsec_profile
!
ip local pool hr_pool 10.1.1.10 10.1.1.20
！
ip route 3.3.3.0 255.255.255.0 23.1.1.3
!
ip nat inside source list nat interface Serial0/0 overload
!
ip access-list extended nat
deny ip 3.3.3.0 0.0.0.255 10.1.1.0 0.0.0.255
permit ip 3.3.3.0 0.0.0.255 any
permit ip 10.1.1.0 0.0.0.255 any
R1配置：
interface Serial0/0
ip address 12.1.1.1 255.255.255.0
line vty 0 4
no login
line vty 5 871
no login
R2配置：
interface Loopback0
ip address 3.3.3.3 255.255.255.0
!
interface Serial0/1
ip address 23.1.1.3 255.255.255.0
serial restart-delay 0
ip route 0.0.0.0 0.0.0.0 23.1.1.2
验证：
