用VPN-Client连接扩展验证VPN-SERVER配置

PC(10.0.0.1、网关10.0.0.254)-----------------（e0/0:10.0.0.254）ROUTER3620(lo0:172.16.0.1)

IOS版本c3620-ik9o3s7-mz.123-21.bin

Building configuration...

Current configuration : 1853 bytes

!

version 12.3

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname vpnserver

!

boot-start-marker

boot-end-marker

!

!

aaa new-model

!

!

aaa authentication login xauthenlocal

!利用AAA配置扩展验证,由于没有AAA服务器,只调用了本地

aaa authorization network groupauthorlocal

!使用AAA服务器查找组策略,这里使用本地,这个本地组策略也可以不配,在后面的加密影射中,调用本地组策略名即可

aaa session-id common

ip subnet-zero

!

!

ip cef

!

ip audit po max-events 100

!

!

!

!

!

!

!

!

!

!

!

!

username lin password 0 cisco

!

!

!

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

!

!指定组策略属性,并进入组策略配置模式,这些配置会被push给客户端

crypto isakmp client configuration group clientgroup

key cisco123