爱华网
功能实现：
在Switch 0上划分VLAN,pc0和pc1分别属于VLAN 2和VLAN 3，IP电话均属于Voice VLAN1，在Router 0上配置单臂路由实现VLAN间互通；配置DHCP，实现局域网内主机与IP电话自动获取IP地址；配置语音CallManger，实现IP电话互通；配置NAT实现访问公网服务器；配置IPSec VPN实现与上海办事处私网互通；
-------------Router0---------------------------------------------
hostname R1
!
！配置IP地址池，为VLAN 2的主机分配192.168.2.0网段的IP，为VLAN3的主机分配192.168.3.0网段的IP，option 150表示分配tftp server的IP；
！
ip dhcp poolv2
network 192.168.2.0255.255.255.0
default-router 192.168.2.1
option 150 ip192.168.2.1
ip dhcp poolv3
network 192.168.3.0255.255.255.0
default-router 192.168.3.1
option 150 ip 192.168.3.1
!
！配置IPSec VPN，实现企业两分支机构互联：
！
crypto isakmp policy1
hash md5
authentication pre-share
!
！
！123456是VPN双方的预共享密钥
crypto isakmp key 123456 address 23.1.1.2
!
！设置VPN认证使用AH，散列算法是sha，数据加密算法使用des
crypto ipsec transform-set aa ah-sha-hmac esp-des
!
crypto map aamap 1 ipsec-isakmp
set peer 23.1.1.2
set transform-set aa
match address 101
!
interface FastEthernet0/0
no ip address
ip nat inside
duplex auto
speed auto
!
！单臂路由实现VLAN间互通
interfaceFastEthernet0/0.1
encapsulation dot1Q 2
ip address 192.168.2.1 255.255.255.0
ip nat inside
!
interface FastEthernet0/0.2
encapsulation dot1Q 3
ip address 192.168.3.1 255.255.255.0
ip nat inside
!
！
interface FastEthernet0/1
ip address 12.1.1.1 255.255.255.0
ip nat outside
duplex auto
speed auto
crypto map aamap
!
interface Vlan1
no ip address
shutdown
!
！配置NAT
ip nat inside source list 100 interface FastEthernet0/1overload
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
!
！ACL 100用于NAT，拒绝语句的目的是为了迫使数据通过VPN传输
access-list 100 deny ip 192.168.0.0 0.0.3.255 192.168.10.00.0.0.255
access-list 100 permit ip any any
！
！ACL 101用于VPN
access-list 101 permit ip 192.168.0.0 0.0.3.255 192.168.10.00.0.0.255
!
！配置VoIP，当号码开头为20时，转发到23.1.1.2地址去
dial-peer voice 1 voip
destination-pattern 20..
session target ipv4:23.1.1.2
!
！
telephony-service
max-ephones 30
max-dn 30
ip source-address 192.168.3.1 port 2000
!
！配置电话号码
ephone-dn 1
number 1001
!
ephone-dn 2
number 1002
!
！将电话号码与硬件绑定，硬件使用MAC地址来标识，类型有3种，7960为CiscoIP电话，ata为模拟电话，CIPC为软电话；botton 1:1用于将电话号码与硬件绑定，后面的1表示，绑定的是ephone-dn1中设置的电话号码；
ephone 1
device-security-mode none
mac-address 0006.2A1A.5970
type 7960
button 1:1
!
ephone 2
device-security-mode none
mac-address 0001.C96C.C202
type 7960
button 1:2
-----------------Switch0---------------------------------------
interface FastEthernet0/1
switchport access vlan 2
switchport voice vlan 1
!
interface FastEthernet0/2
switchport access vlan 3
switchport voice vlan 1
interface FastEthernet0/24
switchport mode trunk
