一、实验环境：

    1.固定IP端(FTTB/固定制DSL…)
        Ⅰ.公网IP一组，Cisco 1841路由器一台
        Ⅱ.路由器 IOS feature Code 附带 k8/k9 的版本

    2.非固定IP端(PPPoE拨接上网)
        Ⅰ.非固定制ADSL+Cisco 1721路由器一台
        Ⅱ.路由器 IOS feature Code 附带 y7及k8/k9 的版本

---

二、架构图：

---

三、配置及说明：

hostname C1721_PPPoE
!
crypto isakmp policy 1
 hash md5
 authentication pre-share
 lifetime 28800
crypto isakmp key SeCrEt address 220.166.83.66
crypto isakmp keepalive 10 10
!
crypto ipsec transform-set MySet esp-des esp-md5-hmac
!
crypto map VPN 10 ipsec-isakmp
 set peer 220.166.83.66
 set transform-set MySet
 match address 101
!
interface FastEthernet0
 ip address 10.254.254.46 255.255.255.252
!
interface Dialer0                                                                                             此为PPPoE虚拟拨号介面
 ip address negotiated                                                                                  
 crypto map VPN
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
access-list 101 permit ip 10.254.254.44 0.0.0.3 192.168.16.0 0.0.0.255

---

hostname C1841_Fixed_IP
!
crypto isakmp policy 1
 hash md5
 authentication pre-share
 lifetime 28800
crypto isakmp key SeCrEt address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 10 10
!
crypto ipsec transform-set MySet esp-des esp-md5-hmac
!
crypto dynamic-map DyMap 100
 set transform-set MySet
 reverse-route remote-peer 220.166.83.1
!
crypto map VPN 200 ipsec-isakmp dynamic DyMap
!
interface FastEthernet0/1
 ip address 220.166.83.66 255.255.255.0
 crypto map VPN
!
ip route 0.0.0.0 0.0.0.0 220.166.83.1

---

四、验证

C1721_PPPoE#show crypto isakmp sa
dst                      src                        state        conn-id   slot   status
220.166.83.66    218.170.50.162    QM_IDLE           1       0    ACTIVE


C1721_PPPoE#ping 192.168.16.254 source 10.254.254.46
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.16.254, timeout is 2 seconds:
Packet sent with a source address of 10.254.254.46
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 64/72/92 ms
C1721_PPPoE#

---

五、补充：

    就以上架构而言，当C1721 PPPoE动建或IPSec Lifetime逾时就会导致整个VPN中断。若要重建VPN也只能仰赖C1721定义的关注流量去触发IKE会谈；但若今天流量发起者为C1841该如何解决。

    在不动架构的情况下，唯一的方法就周期性的从C1721送流量至C1841，在GRE Over IPSec的架构下可以靠DPD/Routing Protocol 来解决，但在PPPoE架构下可能得配置一个RTR 来周期发送icmp包，如此即能决解上述问题。

    RTR语法如下：

C1721_PPPoE#sh run | b rtr 99
rtr 99
 type echo protocol ipIcmpEcho 192.168.16.254 source-ipaddr 10.254.254.46
 timeout 1000
rtr schedule 99 life forever start-time now
!
line con 0
line aux 0
line vty 0 4
 exec-timeout 0 0
 authorization exec Local_Auth
 logging synchronous
!
end
C1721_PPPoE#