本站之前通过场景实例向大家展示了用Virtual Routing and Forwarding (VRF，虚拟路由转发)将一个路由器分割成八个虚拟路由器的方法。当时我向大家演示了如何配置VRF，在本文中我们继续使用这个场景，并通过IPsec配置，将完全一致的拓扑结构和地址复制到八个实验环境。整个环境能够顺利进行，首先需要带有ASA的虚拟路由与Cisco 路由器建立VPN。这需要 VRF参与的IPsec。因此我需要一种方法能够实现完全一致的 isakmp 策略，一致的pre-shared keys, 一致的 crypto ACL, 也就是每个 VRF上的参数一致。实际的配置过程可能比我们想像的简单一些。下面我就来举例说明整个过程。
首先是建立ISAKMP 策略：
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
在配置过程中，我们可以在八个VRF中使用相同的元素，因此只需要建立一个ISAKMP 策略。接下来建立crypto ACL 以及一个 IPsec transform set。
ip access-list extended VPN
permit ip 10.0.100.0 0.0.0.255 10.0.1.0 0.0.0.255
crypto ipsec transform-set VPN-TRANS esp-aes esp-sha-hmac.
接下来是建立 pre-shared key。在本例中我曾经使用过一个keyring 作为 预共享 key，因此我直接将其绑定到 VRF即可。
crypto keyring POD1keys vrf POD1
pre-shared-key address 192.168.1.2 key cisco123
crypto keyring POD2keys vrf POD2
pre-shared-key address 192.168.1.2 key cisco123
crypto keyring POD3keys vrf POD3
pre-shared-key address 192.168.1.2 key cisco123
crypto keyring POD4keys vrf POD4
pre-shared-key address 192.168.1.2 key cisco123
crypto keyring POD5keys vrf POD5
pre-shared-key address 192.168.1.2 key cisco123
crypto keyring POD6keys vrf POD6
pre-shared-key address 192.168.1.2 key cisco123
crypto keyring POD7keys vrf POD7
pre-shared-key address 192.168.1.2 key cisco123
crypto keyring POD8keys vrf POD7
pre-shared-key address 192.168.1.2 key cisco123
!
接下来建立 crypto-maps.
!
crypto map pod1 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
match address VPN
!
crypto map pod2 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
match address VPN
!
crypto map pod3 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
match address VPN
!
crypto map pod4 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
match address VPN
!
crypto map pod5 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
match address VPN
!
crypto map pod6 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
match address VPN
!
crypto map pod7 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
set isakmp-profile pod7
match address VPN
!
crypto map pod8 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set VPN-TRANS
set pfs group2
match address VPN
!