目的：实现PC1与PC2通讯使用×××隧道，PC1通过PAT能远程telnet到R2。
1.建立连接.
pc1
int f 0/0
ip add 192.168.1.2 255.255.255.0
no sh
exit
no ip routing
ip default-gateway 192.168.1.1
pc2
int f 0/0
ip add 192.168.2.2 255.255.255.0
no sh
exit
no ip routing
ip default-gateway 192.168.2.1
R1
int f 0/0
ip add 10.0.0.1 255.255.255.0
no sh
exit
int f 1/0
ip add 192.168.10.2 255.255.255.0
no sh
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
//此acl定义nat需要转换的私有地址，先将需要***转换的地址拒绝掉
access-list 100 per ip any any
//这是需要nat转换的私有地址
ip nat inside so li 100 int f 0/0 o
//启用nat转换，引用acl 100，符合acl 100的地址将被转换
ip nat in so stat udp 192.168.10.1 4500 int f 0/0 4500
ip nat in so stat udp 192.168.10.1 500 int f 0/0 500 （此4500和500的端口为协议的端口号）
在R1路由器上实现nat-t穿越
int f 0/0
ip nat outside
int f 1/0
ip nat inside
ip route 0.0.0.0 0.0.0.0 10.0.0.2
ip route 192.168.1.0 255.255.255.0 192.168.10.1
# debug ip nat
R2
int f 0/0
ip add 10.0.0.2 255.255.255.0
no sh
int f 1/0
ip add 10.1.1.2 255.255.255.0
no sh
enab pass 123
line vty 0 4
pass 123
login
ASA1
int e 0/1
ip add 192.168.10.1 255.255.255.0
no shut
nameif outside
secu 0
int e 0/0
ip add 192.168.1.1 255.255.255.0
no sh
nameif inside
secu 100
route outside 0 0 192.168.10.2
cry isa en out
cry isa po 1
en des
gr 2
au pr
hash sha
exit
cry isa key benet-key add 10.1.1.1
access-list 100 per ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
cry ipsec tran benet-set esp-des esp-sha-hmac
cry map benet-map 1 set tran benet-set
cry map benet-map 1 set peer 10.1.1.1
cry map benet-map 1 match add 100
cry map benet-map int outside
ASA2
int e 0/1
ip add 10.1.1.1 255.255.255.0
no sh
nameif outside
secu 0
exit
int e 0/0
ip add 192.168.2.1 255.255.255.0
no sh
nameif inside
secu 100
cry isa en ou
cry isa po 1
en des
gr 2
au pr
hash sha
exit
cry isa key benet-key add 10.0.0.1
access-list 100 per ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
cry ipsec tran benet-set esp-des esp-sha-hmac
cry map benet-map 1 set peer 10.0.0.1
cry map benet-map 1 set tran benet-set
cry map benet-map 1 match add 100
cry map benet-map int outside
route outside 0 0 10.1.1.2
2.验证。
在R1开始BEBUG测试是否正确，当PC1与PC2通讯是DEBUG测试不会显示PC1的真实地址二是ASA的地址，当PC1远程telnet到R2是则会显示PC1真实地址的转换过程。